DoH

OSI gives you 7 clean layers and tells you every packet goes through all of them in order. Modern networking disagrees. This post proposes a replacement model built around how systems actually behave: OS Kernel as its own layer, Proxy/Middleware as a first-class citizen, floating layers for protocols that shift placement based on deployment (TLS, eBPF, mTLS), and stack profiles for DPDK bypass, eBPF extension, and sidecar mesh. Positions taken on DoH, AF_XDP, io_uring, TOE offloads, and hardware crypto.

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.