I'm trying to estimate the amount of traffic 20,000,000 DNS requests a month will generate in terms of bandwidth. I'll include my calculations below but they all hinge on my estimation of the amount of data used to make a simple A request to a DNS server.

From my tests I think that 50 bytes is about right but wondered if anyone knew differently.

My calculations based around 50 bytes per query:

520 bytes for a DNS request
200000000 DNS monthly requests
104000000000 monthly bytes
832000000000 monthly bits
27733333333.33 daily bits
320987.65 bits/s
313.46 kb/s

Thanks for getting this far!

  • 1
    could you comment on if the answer below changed your numbers?
    – svrist
    Commented Mar 20, 2012 at 11:24
  • DNS queries and replies have completely different sizes, and it depends on records. Name compression changes sizes too. Also if you use DNSSEC or not changes the picture. Commented Apr 21, 2021 at 17:14

1 Answer 1


I think your data needs some new approximations, since a usual DNS server reply is smaller than 520 bytes (in fact, most of the routers (or networking equipment) can give you headaches when the UDP packet size passes 512kb mark - but we're not talking here about only UDP).

Here it goes - will use two very known linux tools to approximate the size of a typical DNS request.

$ dig linux.org +stats

; <<>> DiG 9.6.1-P1 <<>> linux.org +stats
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7061
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0

;linux.org.                     IN      A

linux.org.              43200   IN      A

linux.org.              43180   IN      NS      ns0.aitcom.net.
linux.org.              43180   IN      NS      ns.invlogic.com.

;; Query time: 239 msec
;; WHEN: Thu Oct 29 11:52:44 2009
;; MSG SIZE  rcvd: 100

As you see, I made a DNS query to the local DNS server, loopback interface (for simplicity and clarity). You should find interesting the last row "MSG SIZE"...

Confirm it with tcpdump (running on loopback interface) :

IP localhost.36855 > localhost.domain: 7061+ A? linux.org. (27)
IP localhost.domain > localhost.36855: 7061 1/2/0 A (100)

What you see in the end of each row it's the actual size (the thing you're looking for).

I advise you to run several test queries and average your DNS request size in your calculations. Keep an eye out for domains that aren't directely served from your DNS servers (that should be an interesting bit).


  • 1
    Perfect - thanks very much for this info. I used tcpdump originally to get my estimated data size.
    – James C
    Commented Oct 29, 2009 at 11:15
  • "when the UDP packet size passes 512kb mark". 512bytes mark, not "kb". But in general 1) the packet can be bigger than that, even over UDP and 2) very important because often forgotten, DNS works on both UDP and TCP by default and by design. For any query. Commented Apr 21, 2021 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .