* Mark Andrews:

...

On 14 Jun 2018, at 6:51 am, Florian Weimer <fw@deneb.enyo.de> wrote:

* Petr Špaček:

...

you might be interested in information about "DNS flag day" coordinated by open-source DNS vendors and is planned for 2019-02-01 (February 1st 2019).

Further information can be found on https://dnsflagday.net/

Is there still no reduction of EDNS buffer size to around 1200 bytes? Isn't it time after ten years to address that particular vulnerability?

If you are talking about fragmentation reassembly attacks you need to use something with a cryptographic hash independent of EDNS.

Or you can avoid fragmentation in the first place, which includes ignoring ICMP Fragmentation Needed But DF Bit Set messages. Unbound does that if you tell it to use it a buffer size which is sufficiently small. Theoretically, even with a 1200-byte EDNS buffer size, there could be IPv4 network paths which trigger fragmentation, but those will be unusual. Another benefit of this change is that many of the ENDS-related problems go away.