A workaround prior to this was to have a local instance of dnsmasq or Unbound or any other resolver that can use TCP / EDNS. Some companies do this on all nodes regardless to avoid hammering their edge recurive DNS servers and improve retry methods. And optionally have query logging to a ram disk for security tools to monitor queries and to block santioned tld's at the source instead of flooding the edge.
LinuxBender|1 year ago
A workaround prior to this was to have a local instance of dnsmasq or Unbound or any other resolver that can use TCP / EDNS. Some companies do this on all nodes regardless to avoid hammering their edge recurive DNS servers and improve retry methods. And optionally have query logging to a ram disk for security tools to monitor queries and to block santioned tld's at the source instead of flooding the edge.
[1] - https://www.theregister.com/2023/05/16/alpine_linux_318/