Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Is it true that a nameserver have to answer queries over TCP?

I know DNS uses UDP for most of its queries, but in what circumstances will it use TCP instead?

share|improve this question

migrated from Jul 4 '12 at 21:32

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

marked as duplicate by Chris S Jul 4 '12 at 22:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

The Stack Exchange sites are not forums. They are Q&A sites. Please see the FAQs for why that matters. The "closed as exact dupe" question isn't the same Question, but has the same answer, and Alnitak is pretty much a DNS demi-god. – Chris S Jul 4 '12 at 22:02
up vote 14 down vote accepted

DNS goes over TCP when the size of the request or the response is greater than a single packet such as with responses that have many records or many IPv6 responses or most DNSSEC responses.

The maximum size was originally 512 bytes but there is an extension to the DNS protocol that allows clients to indicate that they can handle UDP responses of up to 4096 bytes.

DNSSEC responses are usually larger than the maximum UDP size.

Transfer requests are usually larger than the maximum UDP size and hence will also be done over TCP.

share|improve this answer
DNSSEC does not do any certificate negotiation! The resource records added for DNSSEC are no different than other resource records. DNSSEC works just fine over UDP and will only resort to TCP when the response is too large (compare dig +dnssec com. any and dig +dnssec com. dnskey) – Cakemox Jul 4 '12 at 21:59
Indeed, I stand corrected. That second query certainly did work just fine over UDP. I'll amend my answer. – Ladadadada Jul 4 '12 at 22:14
Are requests larger than 512 something that happens in practice, or is it merely a theoretical case? I can't think of a valid DNS request which wouldn't fit in 512 bytes. – kasperd May 16 '15 at 21:13
@kasperd ANY queries are notorious for producing large packets, which is why they're often used in DNS amplification attacks. With EDNS0, attackers try to send a small query that produces a response size just under the standard 4096 byte limit. – Zenexer Apr 27 at 3:19
@Zenexer Amplification attacks exploit large responses. I was questioning whether large requests is something that actually happens. – kasperd Apr 27 at 8:32

The Transmission Control Protocol (TCP) is used when the response data size exceeds 512 bytes, or for tasks such as zone transfers.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.