EDNS(0) Padding
The EDNS(0) Padding option, defined in RFC 7830, adds a block of extra zero-value bytes to a DNS message so its total size no longer reveals which specific query or response it is. Even when a DNS query travels over an encrypted transport like DoH, DoT, or DoQ, an observer who can't read the encrypted content can often still measure the packet's length, and many domain names or record types produce a distinctive, recognizable message size -- defeating part of the privacy benefit encryption was supposed to provide. Padding closes that side channel by rounding messages up to a small set of fixed sizes, so two different queries that happened to produce different lengths unpadded can end up looking identical on the wire. RFC 7830 is explicit that padding must only be used over an already-encrypted transport: padding an unencrypted UDP query would instead make it a larger, more effective tool for a DNS amplification attack, the opposite of its intended purpose.
By AdminKit team, Netbase JSC · Updated