From ab70b2b0066baec8150c69a536acf80d88667500 Mon Sep 17 00:00:00 2001 From: quindecim Date: Thu, 26 Mar 2020 04:48:14 -0400 Subject: [PATCH] Synced with the main template --- config/example-dnscrypt-proxy.toml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/config/example-dnscrypt-proxy.toml b/config/example-dnscrypt-proxy.toml index 9d125f7..9a829e9 100644 --- a/config/example-dnscrypt-proxy.toml +++ b/config/example-dnscrypt-proxy.toml @@ -624,12 +624,19 @@ cache_neg_max_ttl = 600 # Cisco servers currently cannot handle queries larger than 1472 bytes, and don't # truncate reponses larger than questions as expected by the DNSCrypt protocol. -# This prevents large responses from being received, and breaks relaying. + +# This prevents large responses from being received over UDP, and breaks relaying. # A workaround for the first issue will be applied to servers in list below. -# Quad9 appears to be dropping fragmented UDP queries, but only for some networks. +# Relaying cannot be reliable until the servers are fixed. # Do not change that list until the bugs are fixed server-side. -broken_query_padding = ['cisco', 'cisco-ipv6', 'cisco-familyshield'] +fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri'] + +# Quad9 ignores the query instead of sending a truncated response when the +# response is larger than the question. +# Do not change that list until the bugs are fixed server-side. + +larger_responses_dropped = ['quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri']