Re: DNS requests switch from UDP to TCP

muxaul_at_lenta.ru
Date: 04/19/05 

Date: 19 Apr 2005 07:04:53 -0700

Trygve Selmer wrote:
> muxaul@lenta.ru wrote:
> > Thank you for the reply. I would like to clarify it if possible.
> > Do you mean that this is the machine that sends a DNS
> > request `decides' whether to use UDP or TCP? The point
> > is that this was _my_ machine, not the DNS server that
> > was switching UDP to TCP.
>
> Normally your machine sends an UDP request to the server, and you get
an
> UDP response back. If the response is too big to fit into one UDP
> packet, the server will return an indication of this. The client
(your
> machine) then retries the request, this time using TCP.

Oh, thanks! I've got it.

Still, there seems to be an issue related to firewalling.
AFAIK, a common practice of protecting DNS servers is to
accept UDP requests from anyone but accept TCP requests
from a limited number of `upper-level' DNS servers only
(those that really need to transfer your zone). For all
other clients, TCP queries are prohibited. Thus, there
seems to be a collision between firewall rules and the
protocol suggested by the DNS server itself.

Mikhail

Relevant Pages