When I tried packet capture with wireshark, I observed that the Don't fragment bit is always set for 1. all TCP packets and 2. DNS query response.

I understood why it is so in case 1, here

Now, my question is 1. Why it is always set for DNS query reponse ? 2. If the DF bit is not set for this packet and it gets fragmented on the way to client, will it cause any problems at the client ?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10 '17 at 15:40

So to be frank, I had no idea this was a thing or why - but a bit of Google-fu was able to provide an answer. Please do some more research in the future.

Stole part of a response from ServerFault: https://serverfault.com/questions/587625/why-dns-through-udp-has-a-512-bytes-limit

  1. Firewalls will typically set a hard 512 byte limit on DNS packets (this is adjustable). Per the IP RFC (http://tools.ietf.org/html/rfc791):

Every internet destination must be able to receive a datagram of 576 octets either in one piece or in fragments to be reassembled.

As DNS is usually UDP, (with the exception of things like zone transfers, or DNSSEC which are TCP) as such, delivery is not ensured. The above statement in the RFC guarantees the host will be able to handle the response size. This appropriately, corresponds to the smallest possible MTU of 576 bytes.

  1. It can, as mentioned above if you're using additional DNS features (DNSSEC, EDNS, etc.). Typically in those cases you can increase the packet size maximum on the firewall(s). Here's an example: http://www.cisco.com/web/about/security/intelligence/dnssec.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.