We've set up a tunnel to a partner firm. Part of their security policy insists that our DNS queries are TCP only (UDP will not be routed).
We're able to use
dig +tcp and verify that queries are resolved correctly, but our own AD-integrated (Server 2008) DNS servers use UDP for the forwarded query, which will timeout and reuslt in a SERVFAIL back to the originating client.
The settings for conditional forwarders make no provision for protocol selection:
RFC 1123 says
a DNS resolver or server that is sending a non-zone-transfer query MUST send a UDP query first.
...but this has been replaced in 5966 by
A resolver SHOULD send a UDP query first, but MAY elect to send a TCP query instead if it has good reason to expect the response would be truncated if it were sent over UDP
This doesn't bode well if I'm on Server 2008 (the last RFC was from 2010). Does anyone know of a way I can force my forwarder to use TCP only (or at least first)? Is it possible in any other DNS implementations, in case I have to set one up as an intermediary?