EDNS, DNSSEC, & DoH

The original DNS spec capped UDP responses at 512 bytes. Modern DNS exceeds this constantly.

EDNS(0) (RFC 6891) — extension mechanism. The client sends an OPT record in the Additional section advertising:

• Larger UDP buffer size (e.g., 4096 bytes)
• DNSSEC OK flag (DO)
• Client subnet (CSUBNET) for geo-targeting

When the server's response is bigger than the client's advertised buffer, it sets TC=1 and the client retries over TCP.

DNSSEC — cryptographic signatures on DNS records. Adds:

• RRSIG records: signature over an RRSet
• DNSKEY records: public keys
• DS records: hash of child zone's key (in parent zone)
• NSEC/NSEC3 records: prove non-existence

A resolver validating DNSSEC walks: root key (built-in trust anchor) -> .com DS -> .com DNSKEY -> example.com DS -> example.com DNSKEY -> RRSIG over the actual record. If any link breaks, validation fails.

Adoption is partial — about 25% of zones are DNSSEC-signed.

DoH (DNS over HTTPS, RFC 8484) — DNS queries inside HTTPS POST/GET to a known endpoint. Hides DNS from network observers and prevents tampering by ISPs. Used by Firefox (Cloudflare/Mozilla), Chrome, iOS, Windows.

DoT (DNS over TLS, RFC 7858) — same idea but plain TLS over port 853, not HTTPS. Easier for system-level resolvers.

For this lesson: EDNS buffer size + truncation behavior.