networking dns ai_generated true

DNS response truncated (TC bit set), retrying over TCP failed

ID: networking/dns-truncated-response

Also available as: JSON · Markdown
85%Fix Rate
87%Confidence
35Evidence
2023-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

The DNS response exceeded the 512-byte UDP limit and was truncated (TC bit set). The client should retry over TCP, but if TCP port 53 is blocked by a firewall or the server does not support TCP DNS, the query fails with incomplete data.

generic

Workarounds

  1. 90% success Ensure TCP port 53 is open between the client and DNS server 
    1. Test TCP DNS connectivity: dig example.com A +tcp
2. If it fails, check firewall rules: iptables -L -n | grep 53
3. Open TCP 53 in the firewall: iptables -A INPUT -p tcp --dport 53 -j ACCEPT
4. Verify with: dig example.com ANY +tcp
5. On cloud environments, check security groups and NACLs for TCP 53
  2. 80% success Enable EDNS0 with a larger payload size to reduce truncation frequency 
    1. Add 'options edns0' to /etc/resolv.conf
2. Or configure the resolver to use EDNS0 with a larger buffer: dig +bufsize=4096 example.com
3. Verify EDNS0 is negotiated: dig example.com +dnssec | grep 'udp:'
4. If middleboxes strip EDNS0, use a DNS-over-HTTPS or DNS-over-TLS resolver instead

Dead Ends

Common approaches that don't work:

  1. Increase the UDP buffer size on the client resolver to avoid truncation 65% fail

    While EDNS0 allows larger UDP responses, the 512-byte limit is a protocol constraint and many middleboxes strip EDNS0 options. If the response is genuinely large (many records), truncation occurs regardless of buffer settings.

  2. Ignore the truncation and use the partial response 80% fail

    A truncated response may be missing critical records (e.g., additional A records for NS referrals, DNSSEC signatures). Using partial data leads to resolution failures or security validation errors.

Error Chain

Leads to:
Preceded by:
Frequently confused with: