Hello Folks,

I digged into the F5 Proxy capability for DNS over TLS and stumbled upon a problem.

Flow is:

1. Client -> Virtual Server DNS Plain (udp/53) -> DNS Server DNS over TLS (DTLS) (udp/853)
2. Client -> Virtual Server DNS Plain (tcp/53) -> DNS Server DNS over TLS (TLS) (tcp/853)

While the second one with tcp works without problems, the first one with UDP protocol does not work. I am now unsure if DNS over TLS should work with UDP via dtls. Has anyone implemented this functionality? I could not find any documentation, only a F5 lab that mentioned this configuration for TCP (https://clouddocs.f5.com/training/community/dns/html/class5/module3/module3.html).

Configuration is simple as:

ltm virtual vs_dns_to_dot_udp {
    destination 10.12.24.56:domain
    ip-protocol udp
    mask 255.255.255.255
    pool dot-pool
    profiles {
        serverssl-dns {
            context serverside
        }
        udp { }
    }
    serverssl-use-sni disabled
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    translate-address enabled
    translate-port enabled
}
ltm virtual vs_dns_to_dot_tcp {
    destination 10.12.24.56:domain
    ip-protocol tcp
    mask 255.255.255.255
    pool dot-pool
    profiles {
        serverssl-dns {
            context serverside
        }
        tcp { }
    }
    serverssl-use-sni disabled
    source-address-translation {
        type automap
    }
    translate-address enabled
    translate-port enabled
}

I can see outgoing UDP packets, but no answer. I tested with Google and Quad9 public DNS Servers. Both are providing DoT services.