DF bit always set for DNS query response

Question

When I tried packet capture with wireshark, I observed that the Don't fragment bit is always set for 1. all TCP packets and 2. DNS query response.

I understood why it is so in case 1, here

Now, my question is 1. Why it is always set for DNS query reponse ? 2. If the DF bit is not set for this packet and it gets fragmented on the way to client, will it cause any problems at the client ?

Answer 1

So to be frank, I had no idea this was a thing or why - but a bit of Google-fu was able to provide an answer. Please do some more research in the future.

Stole part of a response from ServerFault: https://serverfault.com/questions/587625/why-dns-through-udp-has-a-512-bytes-limit

1. Firewalls will typically set a hard 512 byte limit on DNS packets (this is adjustable). Per the IP RFC (https://www.rfc-editor.org/rfc/rfc791):

Every internet destination must be able to receive a datagram of 576 octets either in one piece or in fragments to be reassembled.

As DNS is usually UDP, (with the exception of things like zone transfers, or DNSSEC which are TCP) as such, delivery is not ensured. The above statement in the RFC guarantees the host will be able to handle the response size. This appropriately, corresponds to the smallest possible MTU of 576 bytes.

2. It can, as mentioned above if you're using additional DNS features (DNSSEC, EDNS, etc.). Typically in those cases you can increase the packet size maximum on the firewall(s). Here's an example: http://www.cisco.com/web/about/security/intelligence/dnssec.html