How has been your experience with DoH?
Posted: Fri Nov 10, 2023 5:37 am
How has been your experience with DoH? (I mean in versions prior to 7.12, since there have been some reports of problems in this version)
I did perform quite a few tests with it in the 7.11.* versions and the thing that bothered me the most was that it seemed to do all the connection shenanigans for just a single DNS query. I mean, it would establish the TCP connection, exchange the keys for TLS and all, then do what seemed to be a single DNS query over HTTPS (obviously I can't determine it exactly because the traffic is encrypted) and then immediately close the connection (FIN/ACK/etc packets). This wasn't in any synthetic scenario of a single query. This was while opening regular websites and having to resolve a bunch of DNS names at the same time. Nothing out of the ordinary.
Given this, I experienced some annoyances and some downright problems. By "annoyances", I mean poorer overall "network efficiency" and increased latency in DNS queries, and by "problems" I mean some DNS providers with support to DoH (like Google) would very often not reply to my (very frequent) TCP SYN packets in the majority of DNS requests. With Cloudflare, those TCP SYN drops were very rare though. Here, I can only speculate that Google could be rate limiting me (and I don't blame them - if I were a DNS provider with DoH, I would also rate limit clients which open new connections for every single query instead of reusing already established ones). But, to be clear, I can only speculate about some of those behaviours based on what I could observe by sniffing packets. I can't confirm Google's nor Cloudflare's behaviour. For all I know, it could be my ISP selectively dropping packets (though it would look odd), but I also have no clear evidence of that.
Can't the established connection be reused within a few seconds, at least, for subsequent DNS queries? It's crazy to think that a DNS query goes from an exchange of 2 packets over UDP to an exchange of more than a dozen of packets over TCP.
Do you guys experience any of that?
P.S.: Yes, I observed this behaviour both with the default DNS/DoH parameters as well as after appropriately (to the best of my knowledge) tweaking them. I observed the problems I described while not having any error/warning logs related to connection limits, query limits, etc.
P.S. 2: Also, yes, I know this is not a given, and that it is complex to develop such a solution. Alongside the code complexity, there are also repercussions on memory usage on all kinds of devices which need to be taken into consideration. But perhaps just hearing something on the line of "we're evaluating it" or "we are aware of it and thinking about what can be done" or "we're working on a solution already" would be awesome.
I did perform quite a few tests with it in the 7.11.* versions and the thing that bothered me the most was that it seemed to do all the connection shenanigans for just a single DNS query. I mean, it would establish the TCP connection, exchange the keys for TLS and all, then do what seemed to be a single DNS query over HTTPS (obviously I can't determine it exactly because the traffic is encrypted) and then immediately close the connection (FIN/ACK/etc packets). This wasn't in any synthetic scenario of a single query. This was while opening regular websites and having to resolve a bunch of DNS names at the same time. Nothing out of the ordinary.
Given this, I experienced some annoyances and some downright problems. By "annoyances", I mean poorer overall "network efficiency" and increased latency in DNS queries, and by "problems" I mean some DNS providers with support to DoH (like Google) would very often not reply to my (very frequent) TCP SYN packets in the majority of DNS requests. With Cloudflare, those TCP SYN drops were very rare though. Here, I can only speculate that Google could be rate limiting me (and I don't blame them - if I were a DNS provider with DoH, I would also rate limit clients which open new connections for every single query instead of reusing already established ones). But, to be clear, I can only speculate about some of those behaviours based on what I could observe by sniffing packets. I can't confirm Google's nor Cloudflare's behaviour. For all I know, it could be my ISP selectively dropping packets (though it would look odd), but I also have no clear evidence of that.
Can't the established connection be reused within a few seconds, at least, for subsequent DNS queries? It's crazy to think that a DNS query goes from an exchange of 2 packets over UDP to an exchange of more than a dozen of packets over TCP.
Do you guys experience any of that?
P.S.: Yes, I observed this behaviour both with the default DNS/DoH parameters as well as after appropriately (to the best of my knowledge) tweaking them. I observed the problems I described while not having any error/warning logs related to connection limits, query limits, etc.
P.S. 2: Also, yes, I know this is not a given, and that it is complex to develop such a solution. Alongside the code complexity, there are also repercussions on memory usage on all kinds of devices which need to be taken into consideration. But perhaps just hearing something on the line of "we're evaluating it" or "we are aware of it and thinking about what can be done" or "we're working on a solution already" would be awesome.
