Does dnscrypt-proxy support persistent connections to DoH servers?

[Hermholtz]

While tracing performance issues, I noticed that dnscrypt-proxy opens a new connection to a DoH server whenever it needs to resolve a name. Afterwards the connection goes into time_wait state and is closed. That means every request opens a separate https connection which requires encryption set up what takes time. Is it possible to establish just one connection, keep it alive and use for all requests? HTTP/2 is able to handle many requests on a single connections (multiplexing) so it shouldn't be an issue. I think DoH servers would also appreciate that.

Thanks.

[Hermholtz]

Friendly bump in case it was missed.

[lifenjoiner]

I think the key here is that dnscrypt-proxy uses a different working model: picking one of the fastest server(s) rather than a specified one. After each query, the servers' ranking may be updated. At this point, persistent connections would be complicated ...

[Hermholtz]

Thanks for that. It could be an option then, there are valid use cases for both approaches. For example I would prefer having a persistent connection to Cloudflare DNS to save CPU and speed up name resolution, and others may want what you have described.

[jedisct1]

Connections are kept open until there's been zero traffic for keepalive seconds.

The default value can be bumped up, but keeping tons of idle connections is not great for servers. They can stop accepting new connections even though most of the established ones are actually not in use.

[Hermholtz]

They really do? I was under the impression that a new one is always opened (see this), and I've got confirmation of that behavior from my router (the conn is closed as soon as the response comes in).