This culminated in RFC 8482, co-authored by Cloudflare, unsurprisingly legitimizing Cloudflare’s position.
This culminated in RFC 8482, co-authored by Cloudflare, unsurprisingly legitimizing Cloudflare’s position.
Ironically enough, avoiding the "expensive" query type resulted in potentially doubling the amount of DNS traffic from a typical dual-stack client ("A?" + "AAAA?" instead of single "ANY?")
EDIT: ...or warranted adding laggy heuristics that eventually settles into either, as Avamander points out below.
Edit: Also seems to still be the case when you have your resolver set to a v6 address.
On the other hand, deprecating "ANY" requests as standard, once percolated into BIND and other resolvers, would cut the attack[2] on the amplification stage (middle of the picture of [1]).
[1] https://www.cloudflare.com/img/learning/ddos/dns-amplificati...
[2] or at least significantly decrease choice and depth of large amplification factor requests available to the attacker.
No, they explicitly say it was “too expensive”. The traffic amplification excuse is why they got away with doing it – they, themselves, do not benefit from that aspect. Note that most other DNS vendors in the world has kept ANY queries. Cloudflare removed ANY queries because it does not fit their data model of what DNS is, and faking the correct reply to ANY queries as the standard DNS data model would require would be hard for them, since they don’t operate that way, and they don’t see DNS like that.