DoT and UDP requirements

[Havard Eidnes]

> Having setup DoT and got it all working, I was under the impression
> that all DNS queries would now use TLS over TCP.

Where?  Between your client and your unbound recursor (where you have
control and can enable DNS-over-TLS-over-TCP), or outwards from your
unbound recursor to the rest of the net?  For the latter to work, each
and every publishing name server out there would have to have deployed
DNS-over-TLS-over-TCP.  To put it mildly, "we're not there yet", and
I'm doubtful we ever will be.

Even if you dropped "TLS", and only wanted to do TCP, I think that
would also work poorly, since still too many publishing name servers
either don't do DNS-over-TCP or there are firewalls on the path which
prohibit it from working.

Regards,

- Håvard