by accepting only a predefined set of public keys. This can be used by commercial DNS services to identify customers without having to rely on IP addresses.

Queries and responses are encrypted using the same algorithm and padded to a multiple of 64 bytes in order to avoid leaking packet sizes. Over UDP, when a response would be larger than the question leading to it, a server can respond with a short packet whose TC (truncated) bit has been set. The client should then retry using TCP and increase the padding of subsequent queries.

Versions

1.Previous
3.Next