Post #2447688
2026-05-09 12:45 UTC
@i@toot.pouyan.net @stiiin@infosec.space @freci@piaille.fr @SRAZKVT@tech.lgbt It's not even an extra round trip. It's a DNS lookup which should be cached nearby, and which can be done concurrently with the A and AAAA ones.
Replies (1)
-
@stiiin@infosec.space 2026-05-09 13:14
@dalias@hachyderm.io @i@toot.pouyan.net @freci@piaille.fr @SRAZKVT@tech.lgbt Yeah, exactly. And requesting signatures is only a matter of setting an extra flag in a DNS query (the DO bit, if I understand correctly). The requirement for larger message sizes is difficult if you're stuck with plain UDP, but since implementing DoH/DoT was no problem at all for browsers, the "extra roundtrip" argument is bogus on all fronts.