Hi, to see whether kresd 4.0.0 would do a comparable or better job than doh-httpproxy we analyzed failure rates by looking at HTTP response codes for each setup and found some significant differences for HTTP response code 400: sample size: 1 000 000 HTTP requests for each run HTTP Code [1] [2] [3] -------------------------------- 200 93.96 97.04 96.33 499 3.28 2.45 3.11 400 2.07 0.18 0.22 <<< 415 0.68 0.32 0.34 408 0.002 0.002 0.002 413 0.001 0 0 Numbers show percent. setups: [1] nginx -> (http, no tls) kresd [2] nginx -> (http, no tls) doh-httpproxy -> (udp/53) unbound To reduce the likelihood of measuring unrelated issues (like issues caused by qname minimization differences between unbound and kresd) we also used kresd as DNS resolver without touching its DoH code path: [3] nginx -> (http, no tls) doh-httpproxy -> (udp/53) kresd The HTTP request rate for [1] was slightly lower when compared with [2] and [3]. To be more precise, doh-httproxy services was configured with two running instances as described here: https://facebookexperimental.github.io/doh-proxy/tutorials/nginx-dohhttppro… version information: kresd 4.0.0 nginx 1.14.2 unbound 1.9.0 https://github.com/facebookexperimental/doh-proxy @ 9f943a4c232bd018ae155b7839a6b4e13181a5fd This information on its own is not very useful but it might help motivate further tests in a test-environment with no real end-user traffic that allows for more verbose logging. We would also like to hear from other kresd DoH adopters if they observe similar failure rates on their setups. Some open questions for further tests: - How reproducible are these results? - Does the HTTP method (GET vs. POST) change the error rate? - Can the error rate be reduced by running multiple kresd backends? (nginx sending requests to two kresd bakcends) - Is the DNS transaction ID of always 0 as per RFC8484 an issue when kresd is not also terminating the initial HTTPS connection from the DoH client? (from a backend's perspective two distinct queries might look identical when a reverse proxy sits between the DoH client and kresd) regards, Christoph

On 5/2/19 10:56 PM, Christoph wrote: I'd suggest looking at the requests causing the 4xx responses, as these code are meant for incorrect requests.  It's even possible that kresd is more strict about these.

that's very interesting! Thank you for reaching out. Let's continue discussion on IETF DoH WG mailing list, this has impact far beyond Knot Resolver implementation.