From c0bc4759442e8e7d178aeb30c149bc31a3d5d6c2 Mon Sep 17 00:00:00 2001 From: churchofnoise <65717719+churchofnoise@users.noreply.github.com> Date: Tue, 15 Mar 2022 15:40:46 +0100 Subject: [PATCH] Update unbound.conf In line with DNS Flag Day 2020, change edns-buffer-size default to 1232 --- rootfs_overlay/etc/unbound/unbound.conf | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/rootfs_overlay/etc/unbound/unbound.conf b/rootfs_overlay/etc/unbound/unbound.conf index d9aa93a..1c52dda 100644 --- a/rootfs_overlay/etc/unbound/unbound.conf +++ b/rootfs_overlay/etc/unbound/unbound.conf @@ -54,9 +54,22 @@ server: # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no - # Reduce EDNS reassembly buffer size. - # Suggested by the unbound man page to reduce fragmentation reassembly problems - edns-buffer-size: 1472 + # Reduce EDNS reassembly buffer size (see also https://docs.pi-hole.net/guides/dns/unbound/ ) + # IP fragmentation is unreliable on the Internet today, and can cause + # transmission failures when large DNS messages are sent via UDP. Even + # when fragmentation does work, it may not be secure; it is theoretically + # possible to spoof parts of a fragmented DNS message, without easy + # detection at the receiving end. Recently, there was an excellent study + # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< + # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) + # in collaboration with NLnet Labs explored DNS using real world data from the + # the RIPE Atlas probes and the researchers suggested different values for + # IPv4 and IPv6 and in different scenarios. They advise that servers should + # be configured to limit DNS messages sent over UDP to a size that will not + # trigger fragmentation on typical network links. DNS servers can switch + # from UDP to TCP when a DNS response is too big to fit in this limited + # buffer size. This value has also been suggested in DNS Flag Day 2020. + edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries # This only applies to domains that have been frequently queried