<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18904"></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=695031601-23042010><FONT color=#0000ff
size=2 face=Arial>I get a "connection timed out; no servers could be reached"
after the "Truncated, retrying in TCP mode" even with
+bufsiz=512</FONT></SPAN></DIV>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff size=2 face=Arial>I am
not blocking tcp/53. In fact, telnet dns1.uspto.gov 53 will happily
establish a connection :-) I'm on a fiber (Verizon FiOS business) circuit
- given that others are seeing this over a wide geography, seems like the
investigation needs to start closer to the .gov servers...</FONT></SPAN></DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff size=2 face=Arial>If
you're into numerology, 1736 is 1500 + 236 -- with a 20 byte header on the 236,
you get 256 for the fragement - which is mildly
curious.</FONT></SPAN></DIV><!-- Converted from text/plain format --><FONT
size=2>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff size=2 face=Arial>Folks
on DSL should remember that their magic number is less than 1500 bytes (1492 is
common, as is 1453). </FONT></SPAN></DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=695031601-23042010><FONT color=#0000ff
face=Arial>Sigh.</FONT></SPAN></DIV>
<P>---------------------------------------------------------<BR>This
communication may not represent my employer's views,<BR>if any, on the matters
discussed.</FONT> </P>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV><FONT
size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><BR>
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> Casey Deccio [mailto:casey@deccio.net]
<BR><B>Sent:</B> Thursday, April 22, 2010 18:22<BR><B>To:</B> Michael
Sinatra<BR><B>Cc:</B> bind-users@isc.org<BR><B>Subject:</B> Re: Resolving .gov
w/dnssec<BR></FONT><BR></DIV>
<DIV></DIV>On Thu, Apr 22, 2010 at 11:36 AM, Michael Sinatra <SPAN
dir=ltr><<A
href="mailto:michael@rancid.berkeley.edu">michael@rancid.berkeley.edu</A>></SPAN>
wrote:<BR>
<DIV class=gmail_quote>
<BLOCKQUOTE
style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt 0.8ex; PADDING-LEFT: 1ex"
class=gmail_quote>But it doesn't contain the RRSIGs for the DNSKEY. 'dig
+norec +cdflag dnskey <A href="http://uspto.gov" target=_blank>uspto.gov</A>
@<A href="http://dns1.uspto.gov" target=_blank>dns1.uspto.gov</A>' does not
contain RRSIGs so it is only 1131 bytes. A non-EDNS0 query will receive
the TC bit and will retry in TCP. 'dig +dnssec +norec dnskey <A
href="http://uspto.gov" target=_blank>uspto.gov</A> @<A
href="http://sns2.uspto.gov" target=_blank>sns2.uspto.gov</A>' has a response
that includes the RRSIGs and is 1736 bytes, which on most ethernets will cause
UDP fragmentation. I get a timeout when using dig with +dnssec and
without +vc. However, 'dig +bufsize=1024 +dnssec +norec dnskey <A
href="http://uspto.gov" target=_blank>uspto.gov</A> @<A
href="http://dns1.uspto.gov" target=_blank>dns1.uspto.gov</A>' which sets an
EDNS0 buffer size of 1024, does get a response, after retrying in TCP
mode.<BR><BR>In other words, <A href="http://uspto.gov"
target=_blank>uspto.gov</A>'s DNS servers and network are able to send
responses longer than 512 bytes, but if the response is longer than 1500
bytes, something in the network between those DNS servers and the rest of us
is blocking the UDP fragments.<BR><BR></BLOCKQUOTE>
<DIV><BR>Actually, what seems interesting to me is that the cutoff seems to be
at a payload size of 1736, which happens to be the exact size of the complete
response. Is this just coincidence?<BR><BR>$ dig +bufsize=1735 +dnssec @<A
href="http://dns1.uspto.gov">dns1.uspto.gov</A> <A
href="http://uspto.gov">uspto.gov</A> dnskey<BR><BR>;; Truncated, retrying in
TCP mode.<BR><BR>$ dig +bufsize=1736 +dnssec @<A
href="http://dns1.uspto.gov">dns1.uspto.gov</A> <A
href="http://uspto.gov">uspto.gov</A> dnskey<BR> <BR>; <<>> DiG
9.6.1-P3 <<>> +bufsize=1736 +dnssec @<A
href="http://dns1.uspto.gov">dns1.uspto.gov</A> <A
href="http://uspto.gov">uspto.gov</A> dnskey<BR>; (1 server found)<BR>;; global
options: +cmd<BR>;; connection timed out; no servers could be
reached<BR><BR>Casey<BR></DIV></DIV></BODY></HTML>