FINDING · EVALUATION

Adding artificial inter-arrival time delays — a standard DNS obfuscation technique in unconstrained networks — is infeasible for constrained IoT devices due to long inherent delays and high packet loss rates on constrained wireless links; the paper explicitly excludes timing-based obfuscation for this reason. EDNS(0) padding at recommended multiples of 128 bytes similarly inflates packet sizes to the point of forcing fragmentation, multiplying loss in constrained networks.

From 2026-lenders-secrets-best-not — Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT · §1 / §3.1 · 2026 · arXiv preprint

Implications

For circumvention transports targeting high-latency or lossy links (satellite, LPWAN, mobile in censored regions), design obfuscation around packet format and header field elision rather than timing jitter or fixed-multiple padding.
Avoid fixed-increment padding schemes (e.g., multiples of 128 bytes) on links where MTU is small — block-wise transfer with a tunable small block size achieves length equalization without mandatory fragmentation.