ELI5 description?
—— DNS Cookies are a lightweight DNS transaction security mechanism that provides limited protection to DNS servers and clients against a variety of increasingly common denial-of-service and amplification/forgery or cache poisoning attacks by off-path attackers. DNS Cookies are tolerant of NAT, NAT-PT (Network Address Translation - Protocol Translation), and anycast and can be incrementally deployed. (Since DNS Cookies are only returned to the IP address from which they were originally received, they cannot be used to generally track Internet users.) ——
At the end of the day, the data can really be any 8 byte set of data for the client part and up to 32 bytes for the server section. Which you could technically use to store anything you want (or the upstream resolver could).
The linked article talks about using it for tracking users, which the abstract ironically says isn’t generally possible.
"With 2 IP addresses available in the pool, a 32-bit identifier requires 32 correlated connections. With 256 IP addresses, a 32-bit identifier requires only 4 correlated connections."
IPv6 brings it down to just one.
In May 2016, RFC 7873 was published which also uses the term "DNS cookies".
These two things share a name but have different meanings. The naming collision is an unfortunate coincidence.
I had assumed it was the afore mentioned RFC. That explains why the site make no mention of EDNS or OPT records.
TIL...