3 ms·
"Now just about every website on this here internet will tell you that the DNS uses UDP port 53, and that any response must fit into a single 512 byte UDP packe
by mobilio 4y ago
"Now just about every website on this here internet will tell you that the DNS uses UDP port 53, and that any response must fit into a single 512 byte UDP packet, and of course that answer is right. Except when it isn't. But let's start with that assumption and see how much data we can then fit into a single 512 byte response:"
- nineteen999 4y agoWorked for a datacenter once where the Checkpoint Firewall security expert had blocked outbound TCP port 53 from a major customer because "DNS will just use UDP port 53 instead and it's more secure with TCP blocked". The customer complained that outbound email wasn't being reliably being delivered to domains that had long MX lists - eg. Yahoo, Google etc. Their sendmail queues were long and unwieldy. Didn't take me long to see that the MX list was too big to fit in a 512-byte UDP response packet and was being truncated. Took a while to convince the stubborn security engineer that this was the problem and get him to unblock TCP Port 53 - after which, mail started flowing smoothly.
- bradknowles 4y agoI managed to cram 45 IP addresses into a single UDP DNS response for the MXes for AOL.com many years ago. However, that trick also ended up breaking all internet e-mail around the world -- see https://www.theregister.com/2018/04/16/who_me/ https://www.theregister.com/2018/04/16/who_me/
- DougN7 4y agoThat was a great read. Thank you for sharing :)