<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri, sans-serif" size="2">
<div>Is the mobile device submitting DNS queries without EDNS enabled in options, and/or is the mobile device forwarding DNS queries through a server which performs recursion without EDNS enabled?</div>
<div><font face="Consolas, monospace"> </font></div>
<div>"<i>the hostname in question was using round robin DNS, and</i><i> </i><i>had enough records that the response size was over 512 bytes, thus the</i><i> </i><i>truncate bit was set and the resolver is supposed to retry over TCP.</i><i> </i><i>So we had
them drop enough records to get the response under 512 bytes</i><i> </i><i>and the problem went away.</i>"</div>
<div><font face="Consolas, monospace"> </font></div>
<div>Betting on truncated responses to be retried via TCP should be a last resort, given that EDNS enables larger than 512 bytes within a UDP packet. Firewall admins occasionally forget to open TCP for port 53. Many (wrongly) believe DNS only uses UDP 53
for queries, thinking that TCP 53 is for zone transfers.</div>
<div><font face="Consolas, monospace"> </font></div>
<div>Trusting the firewall to track EDNS negotiation (e.g. “client auto” in newer Cisco ASA versions) initiated via client query puts a lot of faith in the firewall to get DNS right, rather than in your DNS server.</div>
<div><font face="Consolas, monospace"> </font></div>
<div>While EDNS is necessary for DNSSEC, EDNS is a separate feature and useful for any scenario where DNS packet size may increase above 512 bytes. Best practices would seem to indicate any product shipping today should operate with EDNS enabled, but don’t
under-estimate embedded or mobile devices potentially lagging behind in this regard.</div>
<div><font face="Consolas, monospace"> </font></div>
<div>UDP packets for DNS using EDNS can exceed 512 bytes in size, allowing queries and responses to be processed immediately, without having to failback to TCP (and relying upon the client and/or firewalls in the path to allow queries via TCP).</div>
<div><font face="Consolas, monospace"> </font></div>
<div>Also, if any firewalls in the path are set to discard fragments, large EDNS responses that exceed a single packet may still run into problems.</div>
<div><font face="Consolas, monospace"> </font></div>
<div>For troubleshooting, I’m not sure if the latest version of <b>dig</b> supports an option to query without EDNS, but <b>drill</b> (from ldns package) can be used to generate queries without EDNS.</div>
<div><font face="Consolas, monospace"> </font></div>
<div>--/--</div>
<div><font face="Consolas, monospace"> </font></div>
</font>
</body>
</html>