DNS Over UDP, TCP and HTTPS

DNS normally sends each query and answer as a single UDP datagram on port 53, because most answers are small and UDP needs no handshake. It switches to TCP, also on port 53, when an answer is too large for one datagram, and for copying whole zones between servers. To keep queries private from the network, it can also run encrypted, inside HTTPS or TLS.

UDP and its size limit. Classic DNS limited UDP answers to 512 bytes. An extension called EDNS lets the client advertise a larger buffer, today usually around 1,232 bytes, to stay below sizes that get fragmented. An answer larger than that, such as a long list of addresses or records signed with DNSSEC, does not fit.

The fallback to TCP. When the answer does not fit, the server sends what it can with the truncated flag set. The client then repeats the query over TCP, which carries any size. Every DNS server must support TCP for this reason, and a firewall that blocks TCP port 53 breaks large lookups in ways that are hard to spot.

Encrypted DNS. Ordinary DNS is plain text, so anyone on the path can see every name a device looks up, and change the answers. DNS over TLS (DoT) wraps queries in TLS on a dedicated port, 853. DNS over HTTPS (DoH) sends them as HTTPS requests on port 443, which makes them look like any other web traffic. Browsers increasingly use DoH to a resolver of their choice, which can bypass the resolver a company or network configured.

Encryption protects the path to the resolver only. The resolver itself still sees every query, so choosing an encrypted resolver is also choosing whom to trust with that list.

So when DNS works for small names and fails for large ones, check whether TCP port 53 is allowed; and when DNS answers differ between a browser and the terminal, check whether the browser is using DoH.