Does DNS use UDP or TCP, and what happens with large responses?
Show the answer
Say this first
Both, on port 53. Most queries use UDP. Classic DNS capped UDP answers at 512 bytes. EDNS(0) lets the client advertise a bigger buffer, and 1232 bytes is today's recommended size because it avoids IP fragmentation. If an answer does not fit, the server sets the TC (truncated) bit and the client retries over TCP. Zone transfers always use TCP. A firewall that blocks TCP 53 or drops fragments breaks only the large answers, which makes it a confusing fault.
Go deeper
The pieces
- EDNS(0) (RFC 6891): an OPT pseudo-record in the additional section carries the client's UDP buffer size and the DO bit that asks for DNSSEC records.
- 1232 bytes: the IPv6 minimum MTU of 1280, minus 40 bytes of IPv6 header and 8 of UDP. It was the value agreed for DNS Flag Day 2020.
- TCP: RFC 7766 makes TCP support mandatory for DNS software. It is not just for transfers.
What produces big answers
DNSSEC signatures, long TXT records (SPF, verification tokens), names with many A or AAAA records.
The symptom
Most names resolve, a few fail with SERVFAIL or time out. When an answer is too big, dig prints this line before it retries over TCP:
;; Truncated, retrying in TCP mode.If dig +tcp to the same server then times out, TCP 53 is blocked. Older firewall DNS inspection
profiles also capped messages at 512 bytes and dropped EDNS answers.
Encrypted DNS
| Protocol | Transport |
|---|---|
| DNS over TLS (DoT) | TCP 853 |
| DNS over HTTPS (DoH) | TCP 443, or HTTP/3 over UDP 443 |
| DNS over QUIC (DoQ) | UDP 853 |
DoH matters to network teams because it looks like ordinary web traffic and can bypass the internal resolvers that enforce policy.
They will ask next
Why is 1232 the magic number?
It is the largest DNS payload that fits in a 1280-byte IPv6 packet, the minimum every IPv6 link must carry, so the answer never needs fragmenting.
How do you prove TCP 53 is blocked between a resolver and a server?
Run
dig @server nameanddig +tcp @server namefrom the resolver. UDP answers and TCP times out: something in the path drops TCP 53.
Traps
- Saying DNS uses UDP and TCP is only for zone transfers. TCP carries any answer too big for UDP.