I think your data needs some new approximations, since a usual DNS server reply is smaller than 520 bytes (in fact, most of the routers (or networking equipment) can give you headaches when the UDP packet size passes 512kb mark - but we're not talking here about only UDP).
Here it goes - will use two very known linux tools to approximate the size of a typical DNS request.
dig linux.org +stats
; <<>> DiG 9.6.1-P1 <<>> linux.org +stats
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7061
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; QUESTION SECTION:
;linux.org. IN A
;; ANSWER SECTION:
linux.org. 43200 IN A 22.214.171.124
;; AUTHORITY SECTION:
linux.org. 43180 IN NS ns0.aitcom.net.
linux.org. 43180 IN NS ns.invlogic.com.
;; Query time: 239 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 29 11:52:44 2009
;; MSG SIZE rcvd: 100
As you see, I made a DNS query to the local DNS server, loopback interface (for simplicity and clarness).
You should find interesting the last row "MSG SIZE"...
Confirm it with tcpdump (running on loopback interface) :
IP localhost.36855 > localhost.domain: 7061+ A? linux.org. (27)
IP localhost.domain > localhost.36855: 7061 1/2/0 A 126.96.36.199 (100)
What you see in the end of each row it's the actual size (the thing you're looking for).
I advise you to run several test queries and average your DNS request size in your calculations. Keep an eye out for domains that aren't directely served from your DNS servers (that should be an interesting bit).