5

We've set up a tunnel to a partner firm. Part of their security policy insists that our DNS queries are TCP only (UDP will not be routed).

We're able to use dig +tcp and verify that queries are resolved correctly, but our own AD-integrated (Server 2008) DNS servers use UDP for the forwarded query, which will timeout and reuslt in a SERVFAIL back to the originating client.

The settings for conditional forwarders make no provision for protocol selection: Server 2008 Conditional Forwarder

RFC 1123 says

a DNS resolver or server that is sending a non-zone-transfer query MUST send a UDP query first.

...but this has been replaced in 5966 by

A resolver SHOULD send a UDP query first, but MAY elect to send a TCP query instead if it has good reason to expect the response would be truncated if it were sent over UDP

This doesn't bode well if I'm on Server 2008 (the last RFC was from 2010). Does anyone know of a way I can force my forwarder to use TCP only (or at least first)? Is it possible in any other DNS implementations, in case I have to set one up as an intermediary?

  • I'm not a Windows DNS admin, but I'm inclined to say "no, there isn't". Can you elaborate on what their DNS server provides? This makes all the difference between us telling you "they're cowards who can't be bothered to do UDP DNS right" and "you're not supposed to be using them as a forwarder anyway". – Andrew B Aug 15 '14 at 14:43
  • You can also verify TCP works using nslookup and the "set vc" option. However, I'm not aware of a flag or regkey that would allow you to force the forwarder to only use TCP. Personally, I'd work with the partner firm on this. If they aren't using Windows servers at all perhaps an exception can be made for the UDP 53 traffic from just your DCs. If they are using Windows servers...ask them how they managed to get it working with just TCP. – TheCleaner Aug 15 '14 at 14:51
  • I'm not certain, but I think they're AD-integrated DNS, possibly on a newer server version. Not that I think there's any special configuration there, it's just that UDP 53 packets are dropped at an internal hop by a network policy that only applies to this class of link. (They may well use UDP internally) – SmallClanger Aug 15 '14 at 15:09
  • 1
    If the partner is scared of UDP packets on port 53, I would be very wary of connecting my network to theirs! The only reason I can fathom us that they are running a creaky old DNS and trying to protect it instead of fixing it. – rmalayter Aug 15 '14 at 16:56
4

There is no way to turn UDP off in Microsoft DNS Server (check dnscmd documentation).

This restriction on UDP packets seems unreasonable and sure their firewall is flexible enough to accept an exception that your servers are allowed to send requests through UDP port 53.

Whenever the RFC says "SHOULD", you'd better follow what it says to avoid running into unspecified/unpredictable behavior. The correct way is to only use TCP after a UDP with a truncated response has been received.

RFC 1035 (regarding preferred method):

UDP is not acceptable for zone transfers, but is the recommended method for standard queries in the Internet.

RFC 2181 (regarding UDP truncated resposes):

Where TC is set, the partial RRSet that would not completely fit may be left in the response. When a DNS client receives a reply with TC set, it should ignore that response, and query again, using a mechanism, such as a TCP connection, that will permit larger replies.

They'd better have a very good reason for not allowing UDP 53 (extremely unlikely).

  • Agreed. It would be somewhat less flaky if their intent was to provide an endpoint for zone transfers (still flaky because automatic ones are usually preceded with a UDP query for SOA), but that does not seem to be the case here. – Andrew B Aug 15 '14 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.