Hide a length clue inside encrypted DNS

Padding changes message length; encrypted transport remains a prerequisite.

• DNS means Domain Name System. A DNS requestor asks a question and a responder supplies an answer. EDNS(0), version zero of the Extension Mechanisms for DNS, carries extra control options in an OPT pseudo-record. RFC 7830 defines option code 12, Padding, to increase DNS message size by a variable number of octets (§§1–3,5; RFC 6891 §§6.1.1–6.1.2). An octet is eight bits.
• Even when DNS messages are encrypted, their sizes can help correlate them with known unencrypted messages. Padding aims to hamper that size-based correlation; it does not encrypt a message or provide anonymity by itself (§1). These figures label the inner DNS length, not the complete TLS record, TCP stream, IP packet or observed network trace.
• Chosen example queries for tea.example. and picnic.example. occupy 40 and 43 DNS octets when each already has an empty OPT record. Adding the four-octet Padding header and respectively 20 or 17 data octets makes both DNS messages 64 octets. The names and block size are fictional teaching choices, not a default required by RFC 7830.
• Implementations MUST NOT use the Padding option if DNS transport is not encrypted (§6). EDNS support or a peer’s request for padding does not waive this condition. The illustration stops cleartext use before any padded message is sent. Encrypted DNS transports such as DNS over TLS are separate specifications.