DoH service adds EDNS Padding even if client does not indicate EDNS support

When I ask 1.1.1.1 a question over UDP or TCP, I get no EDNS Padding. This is correct behaviour.

When I ask 1.1.1.1 a question over TLS, I get EDNS Padding as long as my query has an EDNS OPT Additional. This is correct behaviour.

Over DoH (to https://dns.cloudflare.com/dns-query, with Content-Type and Accept set to application/dns-message), I get EDNS padding, even if my query does not have an EDNS OPT Additional. This appears to be a bug.

Please do not pad responses if the client has not indicated EDNS support.

2 Likes