@@ -457,7 +457,7 @@ To initiate a DNSCrypt session, a client transmits an ordinary unencrypted `TXT`
 
 A client MAY use UDP or TCP according to local policy.
 
-A common strategy is to try UDP first and retry over TCP after failure, timeout, or truncation.
+Clients SHOULD try UDP first and retry over TCP after failure, timeout, or truncation. A PQ-capable client uses the rollover-sized padding target defined in Certificate Retrieval Amplification; although this can cause IP fragmentation, fragmented UDP works on most paths. A client on a path already known to block fragmented UDP MAY use TCP immediately.
 
 A resolver MUST serve certificates over both UDP and TCP; the UDP response MAY be truncated, with the TC flag set, to direct the client to TCP. Deployed clients begin certificate retrieval over UDP and only retry over TCP after a truncated response.
 
@@ -982,7 +982,7 @@ For compatibility with deployed DNSCrypt v2 clients and resolvers, a resolver MA
 
 A resolver MUST NOT add PQ certificates or other large certificate records to a UDP certificate response unless the complete response is no larger than the request that triggered it.
 
-A client that wants a PQ certificate over UDP therefore pads its certificate query to at least the size of the expected response, exactly as a query that carries a ciphertext is already large enough to cover its response.
+A client retrieving PQ certificates over UDP therefore MUST pad its certificate query to at least the size of the expected response, exactly as a query that carries a ciphertext is already large enough to cover its response.
 
 The advertised EDNS(0) {{!RFC6891}} UDP payload size is a fragmentation-avoidance hint and MUST NOT be used as the amplification limit, because a spoofed query can advertise an arbitrarily large buffer while remaining small.
 
@@ -995,7 +995,7 @@ For relay-compatible PQ deployments, resolvers SHOULD use the following certific
 
 Resolvers SHOULD NOT exceed the rollover certificate set over UDP, and SHOULD keep certificate responses below 4096 octets.
 
-A client cannot tell from outside whether a rotation is in progress, so a client that wants PQ certificates over UDP across rotations SHOULD pad its certificate query to cover the rollover set rather than only the steady-state set; otherwise it silently drops to the classical certificate for the duration of every rollover window.
+A client cannot tell from outside whether a rotation is in progress. A client retrieving PQ certificates over UDP therefore MUST pad its certificate query to cover the rollover set rather than only the steady-state set; otherwise it silently drops to the classical certificate for the duration of every rollover window. This padding exceeds common fragmentation-avoidance targets, but clients SHOULD try UDP first because fragmented UDP works on most paths, and retry over TCP only after timeout or truncation.
 
 If the certificate response containing the PQ set would be larger than the request, the resolver MUST NOT return that oversized PQ response over UDP; it SHOULD instead return the classical certificate response with the TC flag set, so a classical-only client can proceed while a PQ-capable client learns that more certificates may be available.
 
@@ -1217,13 +1217,15 @@ If the client connects to the relay over TCP, the relay still forwards the inner
 
 Certificate retrieval through a relay is different: the relay forwards the certificate query to the resolver over UDP and forwards a matching certificate response back to the client, and it applies the same response-size check, dropping any response larger than the query it relayed.
 
-A client that wants a PQ certificate over UDP through a relay therefore pads its certificate query to at least the size of the expected certificate response, as described in Certificate Retrieval Amplification, so the response passes both the resolver's and the relay's anti-amplification check.
+A client retrieving a PQ certificate over UDP through a relay therefore MUST pad its certificate query to at least the size of the expected certificate response, as described in Certificate Retrieval Amplification, so the response passes both the resolver's and the relay's anti-amplification check.
 
 A client that does not, or cannot, pad far enough receives only the certificates that fit within the inner UDP query size, typically a classical certificate with the TC flag set; if even that response is larger than the inner query, the relay drops it.
 
 Retrying over TCP to an Anonymized DNSCrypt relay does not make the relay use TCP upstream: relays still forward the inner certificate query to the resolver over UDP.
 
-Therefore, a client that retrieves certificates through a relay MUST make the inner certificate query large enough for the expected UDP certificate response, or retrieve certificates directly from the resolver over TCP before using the relay for encrypted queries.
+Nevertheless, carrying a rollover-sized inner certificate query over the client-to-relay TCP connection avoids IP fragmentation on that leg while giving the relay a large enough request to forward upstream and a sufficient anti-amplification budget for the response. The inner query remains EDNS(0)-padded to the expected UDP response size; only its transport to the relay changes.
+
+Therefore, after a rollover-sized UDP attempt times out or returns a truncated certificate response, a client retrieving certificates through a relay SHOULD retry over TCP to the relay with an inner query large enough for the expected UDP certificate response. Alternatively, it can retrieve certificates directly from the resolver over TCP before using the relay for encrypted queries, with the associated privacy tradeoff.
 
 ## PQ Downgrade Protection
 
 
@@ -5,6 +5,7 @@
 from typing import Sequence
 
 from constants import (
+    ANON_MAGIC,
     CERTIFICATE_RECORD_TTL,
     DNS_CLASS_IN,
     DNS_HEADER_SIZE,
@@ -18,9 +19,13 @@
 __all__ = [
     "build_certificate_response",
     "certificate_query",
+    "certificate_query_for_transport",
     "serve_certificates",
 ]
 
+ANONYMIZED_DNSCRYPT_HEADER_SIZE = len(ANON_MAGIC) + 16 + 2
+CERTIFICATE_ROLLOVER_QUERY_SIZE = 3200
+
 
 def _dns_name(name: str) -> bytes:
     """Encode a domain name as a sequence of length-prefixed labels."""
@@ -102,7 +107,7 @@ def certificate_query(
 ) -> bytes:
     """Build an unencrypted TXT certificate query, optionally EDNS(0)-padded.
 
-    A client that wants the larger PQ certificates over UDP pads the query to at
+    A client retrieving the larger PQ certificates over UDP pads the query to at
     least the expected response size, so the response stays within the request and
     passes the anti-amplification check at the resolver and at any relay.
     """
@@ -130,6 +135,37 @@ def certificate_query(
     return header + question + additional
 
 
+def certificate_query_for_transport(
+    provider_name: str,
+    query_id: bytes = b"\x00\x00",
+    *,
+    over_tcp: bool,
+    via_relay: bool,
+    expected_relay_response_size: int = CERTIFICATE_ROLLOVER_QUERY_SIZE,
+    udp_payload_size: int = CERTIFICATE_ROLLOVER_QUERY_SIZE,
+) -> bytes:
+    """Build a certificate query with transport-appropriate padding.
+
+    The initial UDP query covers the rollover certificate set, including the
+    Anonymized DNSCrypt prefix when present. Direct TCP needs no amplification
+    padding. TCP to a relay still carries a padded inner query because the relay
+    forwards it upstream over UDP and applies the query length as its response
+    budget.
+    """
+
+    if over_tcp:
+        padded_length = expected_relay_response_size if via_relay else 0
+    else:
+        relay_overhead = ANONYMIZED_DNSCRYPT_HEADER_SIZE if via_relay else 0
+        padded_length = udp_payload_size - relay_overhead
+        if padded_length <= 0:
+            raise ValueError("UDP payload size cannot hold the relay header")
+    query = certificate_query(provider_name, query_id, padded_length)
+    if not over_tcp and len(query) + relay_overhead > udp_payload_size:
+        raise ValueError("UDP payload size is too small for the certificate query")
+    return query
+
+
 def build_certificate_response(
     request: bytes,
     certificates: Sequence[bytes],
 
@@ -299,6 +299,29 @@ def test_certificate_retrieval_amplification(self):
             1338,
         )
 
+        # Initial UDP retrieval covers the rollover set, including the relay prefix.
+        direct_udp = d.certificate_query_for_transport(
+            provider_name, over_tcp=False, via_relay=False
+        )
+        self.assertEqual(len(direct_udp), 3200)
+        relay_udp = d.certificate_query_for_transport(
+            provider_name, over_tcp=False, via_relay=True
+        )
+        self.assertEqual(
+            len(d.anonymized_dnscrypt_query("192.0.2.1", 443, relay_udp)), 3200
+        )
+
+        # Direct TCP needs no padding. TCP to a relay keeps the inner query large
+        # enough for the relay's UDP response budget.
+        direct_tcp = d.certificate_query_for_transport(
+            provider_name, over_tcp=True, via_relay=False
+        )
+        self.assertEqual(direct_tcp, base_query)
+        relay_tcp = d.certificate_query_for_transport(
+            provider_name, over_tcp=True, via_relay=True
+        )
+        self.assertEqual(len(relay_tcp), 3200)
+
         # A query padded past the response carries the PQ certificate over UDP.
         padded = d.certificate_query(provider_name, padded_length=1600)
         served = d.serve_certificates(padded, [classical], [pq], over_udp=True)