Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm the process of setting up a monitoring of DNS servers of several large web hosts. My goal is to compare their dns servers response times by tracking their response to ping.

In the process, I discovered that Bluehost nameservers do not respond to ping. I tried to get more information by running Pingdom DNS Check on bluehost.com and it produced the following error:

Name server ns1.bluehost.com (74.220.195.31) does not answer queries over TCP.

The name server failed to answer queries sent over TCP. This is probably due to the name server not correctly set up or due to misconfgured filtering in a firewall. It is a rather common misconception that DNS does not need TCP unless they provide zone transfers - perhaps the name server administrator is not aware that TCP usually is a requirement.

I would like to know the following:

  • To what extent is the above statement true?
  • What are the implications of a nameserver not answering queries over TCP?
share|improve this question
add comment

3 Answers

up vote 20 down vote accepted

The diagnostic text from Pingdom is exactly correct. TCP is not just for zone transfers.

DNS server implementations are now "required" (in so much as any RFC requires anything) to support TCP, per RFC 5966, "DNS Transport over TCP - Implementation Requirements".

Note that this is a requirement on the server software implementation, it does not strictly apply to the operation of any server - operational practice is not covered.

That said, if your particular DNS servers are not configured to support TCP, or if it is blocked, then the longer term effect will be an inability to support DNSSEC correctly. Similarly any other DNS data which causes responses to exceed 512 bytes might be blocked.

ob disclaimer: I wrote that RFC.

share|improve this answer
    
Thank you for the great answer. –  tarasm Sep 20 '10 at 19:49
add comment

it should support TCP and UDP - the TCP is for responses sizes >512 bytes (which would include zone transfers) (according to stuff I've read, anyway. I usually enable TCP and UDP for the NS's I run...)

share|improve this answer
add comment

TCP is only required, and usually only used when a long reponse is required. Zone transers are done over TCP as the are large, and need to be reliable. Not allowing TCP from untrusted servers is one way to ensure that only small answers are given.

With the introduction of signed DNS answers, there has been a loosening of the 512 byte limit to UPD answers.

It is perfectly possible to run a DNS server which only has UDP port 53 open to the Internet. TCP access to DNS peers is required, but this is a small list of hosts.

share|improve this answer
    
DNSSEC didn't loosen the limit, EDNS0 did, in 1999 (see RFC 2671). –  Alnitak Sep 17 '10 at 8:28
    
No, as explained by Alnitak, TCP is required in most cases (unless you can be absolutely certain that you'll never have a reply > 512 bytes, something you typically don't know in advance) –  bortzmeyer Sep 17 '10 at 11:53
    
I have successfully run DNS through a firewall allowing only UDP. Barring pathalogical configurations, address lookups will be under 512 characters. I have seen references that DNS paths are limited to 256 characters. Evidence in the database for my mail server suggests that server DNS paths rarely exceed 100 characters, and sites which have multiple names returned by a PTR record rarely returs over 256 characters. All these reponses would run on UDP. Does anyone have a reasonable case that runs near 512 characters without DNSSEC or a zone transfer. –  BillThor Sep 20 '10 at 0:40
    
Re DNSSEC, I didn't verify RFC for extended sizes, but the only references I have seen to using extended packet sizes on UDP have ben DSNSEC. –  BillThor Sep 20 '10 at 0:42
    
One of the large content providers came unstuck a few year back when they added so many A records for one of their webfarms that it exceeded 512 bytes. That caused real interop problems. –  Alnitak Sep 20 '10 at 21:15
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.