2 ms·
google's dns resolver 8.8.8.8 correctly resolves the "special character" domains btw; so if you have 8.8.8.8 as your recursive resolver in dnsmasq, this doesn't
by karel-3d 1y ago
google's dns resolver 8.8.8.8 correctly resolves the "special character" domains btw; so if you have 8.8.8.8 as your recursive resolver in dnsmasq, this doesn't seem to be an issue.
- JdeBP 1y agoSee https://news.ycombinator.com/item?id=44954517 https://news.ycombinator.com/item?id=44954517 They're giving Google Public DNS as example of a failure here. Whereas what happens in my testing is that it's a cache miss for Google Public DNS, which takes a little over 1 second to look everything up from cold in my part of the world for ~.www.example.com . And in that second they have more than enough time, at LAN speeds (since they are injecting the forged responses from the dnsmasq client machine), to send a tonne of forged DNS/UDP responses which are only around a hundred bytes long each.
- karel-3d 1y agoso the special characters are a red herring? and all they are doing is sending UDP responses locally faster than the recursive resolver? I cannot believe this is true because that would be too dumb edit: I don't see how is the avunit github related to the report. I don't think it is?
- mzajc 1y agoSame for 1.1.1.1 and 9.9.9.9. My ISP's resolver also returns NXDOMAIN immediately. Quick way to test: dig 'test~!*_' @resolver-ip