Rate limit for DNS over HTTPS

[Birajendu Sahu]

What is the QPS rate limit for https://dns.google.com/query? .




I have observed different rate limits for my testes in different Geo locations, but wanted to confirm before implementing in my application. here we may end up requesting more than 1000 requests for seconds from same large organisation ip. If ther is a rate limit how to overcome that?







Thanks and Regards,

Birajendu




[Alex Dupuy]

You can request an increased rate limit at https://issuetracker.google.com/issues/new?component=191885&template=1024641.

Note that there are multiple internal limits besides the raw QPS, so that even with an increased limit, some queries may be dropped, depending on usage patterns.

[bira...@netskope.com]

Is this rate limit is 100 QPS as limited for 8.8.8.8 DNS server?

[Alex Dupuy]

Rate limits are applied equally for UDP and HTTPS transports, but HTTPS traffic is also subject to general Google web service limits.

[bira...@netskope.com]

Is there any specific error code when this service hits rate limit, I have noticed few times 502 error, most of the time request timeout!

[Alex Dupuy]

Thanks for your question, birajendu.

You wrote:

Is there any specific error code when this service hits rate limit, I have noticed few times 502 error, most of the time request timeout!

In the UDP cases, we just drop the DNS request, since there is no useful DNS response for rate limiting. Returning a NODATA response with the TC (truncated) flag set is useful for amplification limits to redirect legitimate clients to TCP and protect against reflection attacks, but when there are simply too many queries, moving the query load over to TCP would be counter-productive. Letting the query time out will naturally reduce the load, whereas returning a SERVFAIL error for a query to 8.8.8.8 would often result in an immediate retry on 8.8.4.4 or an IPv6 address (or worse, cause the entire resolution to fail).

For TCP and DNS-over-TLS, amplification limits don't apply, but the remainder of the logic is essentially the same. Since Google Public DNS can respond to queries on a TCP connection out of order, clients should be able to send other queries without waiting for the response to a previous one.

With DNS-over-HTTPS, we probably ought to be returning a 429 Too Many Requests error response with a Retry-After: 1 header rather than dropping queries.

You can file a feature request on our public issue tracker if you think this would be helpful.

[Birajendu Sahu]

Thanks you for the clarification...

[George Ge]

Hi, Alex.

Here is my issue for an increase in rate limit: https://issuetracker.google.com/issues/119839388.

Is it correctly proposed?

在 2018年10月23日星期二 UTC+8下午9:54:16，Alex Dupuy写道：