<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On 9 Oct 2019, at 09:51, David <<a href="mailto:opendak@shaw.ca" class="">opendak@shaw.ca</a>> wrote:<br class=""><div><div class=""><br class="Apple-interchange-newline"></div><blockquote type="cite" class=""><div class=""><div class="">On 2019-10-09 3:28 a.m., Vladimír Čunát wrote:<br class=""><blockquote type="cite" class="">On 10/9/19 8:53 AM, Xavier Beaudouin wrote:<br class=""><blockquote type="cite" class="">I saw that DNS over TLS (not TCP) eg port 853/TCP is more and more used.<br class=""></blockquote>I expect that's due to newer Androids getting to more people? (i.e. it seems unrelated to OP)<br class=""><a href="https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html" class="">https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html</a> <br class=""></blockquote><br class="">Yeah we see that too but you are correct we are referring to normal plain-old DNS over TCP. We're now at 10x the query rates compared to pre-iOS 13, which is still not a lot but is growing each day.<br class=""></div></div></blockquote><div><br class=""></div></div>Are there any obvious patterns with QNAMEs or with the servers that receive those queries? I wonder whether there's some new query pattern that has started triggering large responses and whether what we are seeing is iOS falling back to TCP transport due to failures in receiving fragments. It'd be interesting to look for other increases within the messages being exchnged over TCP, e.g. an unusual preponderance of DO=1 or QTYPE=TLSA or something.<div class=""><br class=""></div><div class="">The observation reminds me of the iOS release that started pulling root zone DNSSEC trust anchors from <a href="http://data.iana.org" class="">data.iana.org</a> almost a decade ago. The CDN stats for <a href="http://data.iana.org" class="">data.iana.org</a> at the time revealed what looked initially like a step function but in fact was a steep curve tracking iOS upgrades amongst the iPhone-owning public. We found someone at Apple to talk to at the time to confirm that our interpretation was correct. If iOS deployment is the curve you're seeing, then I imagine you can expect more growth than 10x before you see a plateau.</div><div class=""><br class=""></div><div class="">Of course, many commonly-used applications tend to upgrade around an iOS upgrade. With iOS 13 there seem to be many popular social media apps releasing versions with this "dark mode" that I understand the youth like now.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Joe</div></body></html>