Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set large DNS packet sizes again #3451

Closed
jsha opened this issue Feb 15, 2018 · 1 comment · Fixed by #3467
Closed

Set large DNS packet sizes again #3451

jsha opened this issue Feb 15, 2018 · 1 comment · Fixed by #3467
Assignees
@jsha
Milestone
Sprint 2018-02-20

Comments

@jsha
Copy link
Contributor

jsha commented Feb 15, 2018

When we switched to UDP we stopped calling m.SetEdns0(4096, true), because we considered that a holdover from when Boulder was requesting DNSSEC records (now our resolver is validating DNSSEC). However, it turns out sometimes DNS responses are extremely large when there are lots of CAA records present. We should restore this setting to avoid failing in those cases. See https://community.letsencrypt.org/t/detail-dns-problem-server-failure-at-resolver-looking-up-caa-for/52276
@jsha jsha added this to the Sprint 2018-02-20 milestone Feb 20, 2018
@jsha jsha self-assigned this Feb 20, 2018
@jsha
Copy link
Contributor Author

jsha commented Feb 20, 2018

Note: We should set the second argument (DO, DNSSEC OK) to false.

@jsha jsha mentioned this issue Feb 21, 2018
Merged
@cpu cpu closed this as completed in #3467 Feb 21, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jsha jsha

Labels
None yet
Projects
None yet
Milestone
Sprint 2018-02-20
Development

Successfully merging a pull request may close this issue.

Accept large responses from the resolver. letsencrypt/boulder
1 participant
@jsha