From 9d8371782429b69656dd99226afcf78b159562de Mon Sep 17 00:00:00 2001 From: mibere Date: Sat, 3 Oct 2020 16:01:04 +0200 Subject: [PATCH 1/2] Update unbound.md Adjust edns-buffer-size (DNS Flag Day 2020), see also https://github.com/NLnetLabs/unbound/commit/b6d04f500bb0f021938d87871f995bc85ca619bf Signed-off-by: DL6ER --- docs/guides/dns/unbound.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/guides/dns/unbound.md b/docs/guides/dns/unbound.md index 3756929..a8e6162 100644 --- a/docs/guides/dns/unbound.md +++ b/docs/guides/dns/unbound.md @@ -111,9 +111,9 @@ server: # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no - # Reduce EDNS reassembly buffer size. - # Suggested by the unbound man page to reduce fragmentation reassembly problems - edns-buffer-size: 1472 + # DNS Flag Day 2020 recommends a message size of 1232 bytes to avoid IP + # fragmentation while minimizaing the use of TCP + edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries # This only applies to domains that have been frequently queried From d5d6a106bb5c6709b2afed07148c1fad03e57b57 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Tue, 28 Dec 2021 09:56:01 +0100 Subject: [PATCH 2/2] Add details to EDNS buffer size choice in unbound guide. Also reduce suggested EDNS buffer size in dnsmasq warnings discussion. Signed-off-by: DL6ER --- docs/ftldns/dnsmasq_warn.md | 4 ++-- docs/guides/dns/unbound.md | 25 +++++++++++++++++++++++-- 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/docs/ftldns/dnsmasq_warn.md b/docs/ftldns/dnsmasq_warn.md index 5d8f6e5..d65f659 100644 --- a/docs/ftldns/dnsmasq_warn.md +++ b/docs/ftldns/dnsmasq_warn.md @@ -130,10 +130,10 @@ Warnings commonly seen in `dnsmasq`'s log file (`/var/log/pihole.log`) and the P You can get rid of the warning by adding a config file like `/etc/dnsmasq.d/99-edns.conf` and adding ``` plain - edns-packet-max=1280 + edns-packet-max=1232 ``` - After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). + After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our [unbound guide](../guides/dns/unbound.md) for a comment about the particular value of `1232`. !!! warning "Ignoring query from non-local network" diff --git a/docs/guides/dns/unbound.md b/docs/guides/dns/unbound.md index a8e6162..790e801 100644 --- a/docs/guides/dns/unbound.md +++ b/docs/guides/dns/unbound.md @@ -111,8 +111,21 @@ server: # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no - # DNS Flag Day 2020 recommends a message size of 1232 bytes to avoid IP - # fragmentation while minimizaing the use of TCP + # Reduce EDNS reassembly buffer size. + # IP fragmentation is unreliable on the Internet today, and can cause + # transmission failures when large DNS messages are sent via UDP. Even + # when fragmentation does work, it may not be secure; it is theoretically + # possible to spoof parts of a fragmented DNS message, without easy + # detection at the receiving end. Recently, there was an excellent study + # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< + # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) + # in collaboration with NLnet Labs explored DNS using real world data from the + # the RIPE Atlas probes and the researchers suggested different values for + # IPv4 and IPv6 and in different scenarios. They advise that servers should + # be configured to limit DNS messages sent over UDP to a size that will not + # trigger fragmentation on typical network links. DNS servers can switch + # from UDP to TCP when a DNS response is too big to fit in this limited + # buffer size. This value has also been suggested in DNS Flag Day 2020. edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries @@ -143,6 +156,14 @@ dig pi-hole.net @127.0.0.1 -p 5335 The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick. +You should also consider adding + +``` plain +edns-packet-max=1232 +``` + +to a config file like `/etc/dnsmasq.d/99-edns.conf` to signal FTL to adhere to this limit. + ### Test validation You can test DNSSEC validation using