[dns-operations] Configurable TC=1?

[Ralph Babel]

Mukund Sivaraman wrote:

> Ralph Babel wrote:
>
>> is there a nameserver implementation that allows
>> me to respond with a minimal TC=1 packet if ...
>>
>>   sizeof(UDP-response) > sizeof(UDP-query) * x + y
>>
>> ..., x and y being fully configurable, preferably
>> on a per-address-range basis, maybe even dependent
>> upon the query type?
>
> What is possible from having a nameserver
> that supports this arithmetic?

You could make amplification attacks unattractive
by no longer amplifying anything (or by keeping the
possible amplification factor sufficiently small).

> Some nameservers implement an absolute maximum
> message size limit setting [...] that is sufficient
> if one wants to truncate UDP responses above a limit.

Truncating at a fixed upper bound doesn't help, as BPS
amplification obviously depends on the query size as well.