EDNS payload size

[miquecg]

Is there any max payload size imposed by dnscrypt-proxy for EDNS?

I have a dnsmasq cache in front of dnscrypt-proxy and I'm seeing this on the logs:

Oct 04 19:26:11 dnsmasq[624]: reducing DNS packet size for nameserver 127.0.0.1 to 1280
Oct 04 19:31:17 dnsmasq[624]: reducing DNS packet size for nameserver 127.0.0.1 to 1280

dnsmasq default value is 4096.

I don't know anything about the history of this project or where it comes from, but I've found this:

This size can be made larger by starting the proxy with the --edns-payload-size= command-line switch. Values up to 4096 are usually safe.

https://github.com/opendns/dnscrypt-proxy/blob/master/README.markdown

Looks like currently this option is not supported anymore.

[jedisct1]

The maximum advertised UDP payload size is set to 1252.

Higher values cause packets to be dropped on some networks, resulting in a lack of stability and performance degradation.

This can also be a security issue if the network between the proxy and clients is not trusted, and fragments are allowed.

So, the value is now fixed, and set to something safe, that works pretty much everywhere.

The implications are minimal considering the response sizes observed in the real world: