A DNS answer can fail on one network when a large UDP response is fragmented or filtered while a smaller response succeeds. EDNS advertises additional DNS capabilities and a receive size; it does not guarantee that every network path will deliver a packet of that size.
IN THIS ARTICLE
Gather the details you will need
Record the affected resolver, authoritative server, address family and query. Compare at least one working network with the failing network. Keep the DNS content unchanged while checking whether the failure follows response size or transport.
01 Investigate DNS answers that fail on one network but work elsewhere
- Repeat the query with the normal settings, then explicitly over TCP. If TCP succeeds while large UDP responses fail, investigate the UDP path and fragmentation handling.
- Compare a smaller advertised EDNS buffer size using a read-only diagnostic query. A value such as 1232 is a common diagnostic choice, not proof that every resolver/server setting should use one universal number. The UDP-only example below intentionally suppresses TCP retry so you can inspect truncation; normal production lookups should retain fallback.
- Check for a truncated UDP response and whether the resolver completes TCP fallback. A firewall that drops TCP port 53 can turn a manageable size limit into a lookup failure.
- Review firewall, VPN, MTU and packet-inspection behaviour with the network administrator. DNSSEC data can make the size issue visible without being the underlying fault.
- Apply any permanent resolver or authoritative-server tuning through the vendor's supported configuration and test both IPv4 and IPv6 paths.
02 Read-only diagnostic example
dig @ns1.example.net example.com DNSKEY +dnssec +bufsize=1232 +notcp +ignore
dig @ns1.example.net example.com DNSKEY +dnssec +tcpReplace example names and documentation addresses with the exact authorised service details. These commands query existing configuration; they do not change DNS.
Confirm the expected result
Retest the same name/type on the formerly failing network. Confirm that large or truncated responses complete successfully and that signed answers still validate.
If the problem continues
A change that removes DNSSEC data from the test may make the packet smaller without repairing transport. Keep the original failing example and compare packet sizes, truncation and TCP behaviour rather than disabling validation.
A common question
Should I increase the UDP buffer to the largest possible value?
Not automatically. Larger UDP packets can be more vulnerable to fragmentation and filtering. The effective answer depends on both endpoints and the intervening path. Reliable TCP fallback and measured network behaviour matter more than choosing the biggest number.