But does DNS use TCP or UDP? The answer is both. DNS uses UDP for most standard queries because it has lower overhead, while TCP is used for DNS zone transfers, when a response is truncated, and in other situations that require it.
Understanding the difference between DNS over TCP and DNS over UDP helps network administrators troubleshoot lookup failures, configure firewalls, and keep websites accessible. Let's look at how these protocols work, when DNS uses each one, and how to identify common problems.
Does DNS Use TCP or UDP by Default?
DNS traditionally uses UDP for most standard queries. UDP allows a device to send a DNS request without establishing a connection with the receiving server first. This makes it suitable for DNS lookups, which usually involve a small request and a short response. A browser needs the IP address of a website, so it sends a query and waits for the answer. UDP keeps the process lightweight by avoiding the connection setup and delivery checks associated with TCP.
For example, when you visit example.com, your device may send a UDP query to a DNS resolver. The resolver finds the required record and returns the answer. If the response contains the information the device needs, the lookup can finish without using TCP.
Why Does DNS Usually Use UDP?
There are three main reasons:
- Lower overhead: UDP doesn't require a connection handshake before sending a query. This reduces the work needed to complete a typical DNS lookup.
- Faster exchanges: Most routine DNS queries and responses are small enough to fit into a single UDP message, allowing the information to travel with minimal overhead.
- Efficient at scale: DNS handles a large number of queries across the internet. Using UDP for these short exchanges helps resolvers manage requests without establishing a separate TCP connection for every lookup.
However, UDP does not guarantee that a message will reach its destination. Packets can be lost, duplicated, or arrive out of order. DNS software handles potential packet loss through timeouts and retries when needed. If a response doesn't arrive, the resolver may send the query again.
Does DNS Always Use UDP?
No. DNS also uses TCP when the situation calls for it. For example, if a UDP response is truncated because it doesn't fit within the available message size, the resolver can retry the query over TCP to retrieve the complete answer. TCP is also used for DNS zone transfers, which move DNS records between servers.
The choice isn't simply about speed. UDP works well for routine lookups, while TCP provides reliable, ordered delivery for exchanges that need it. That's why DNS supports both protocols, even though UDP handles most standard queries.
What Is the Difference Between DNS Over TCP and DNS Over UDP?
TCP establishes a connection between the sender and receiver before transferring data. It uses sequence numbers, acknowledgments, and retransmissions to make sure data arrives reliably and in the correct order. If a segment is lost during transmission, TCP can retransmit it. This makes TCP useful for DNS exchanges that need reliable delivery, such as zone transfers or retrieving complete responses after UDP truncation.
UDP takes a simpler approach. It sends DNS messages in individual datagrams without establishing a connection or waiting for delivery acknowledgments. This reduces protocol overhead and makes it efficient for short request-response exchanges. However, UDP itself doesn't recover lost packets or guarantee that messages arrive in order. DNS resolvers handle missing responses through timeouts and retries when necessary.
Here are the differences at a glance:
| Feature | DNS over UDP | DNS over TCP |
|---|---|---|
| Connection | Connectionless | Connection-oriented |
| Connection setup | No handshake required | Uses a connection handshake |
| Delivery | No built-in delivery guarantee | Reliable, ordered delivery |
| Overhead | Usually lower | Usually higher |
| Common use | Routine DNS queries | Truncated responses and zone transfers |
| Default port | UDP 53 | TCP 53 |
Which is Faster: DNS Over TCP or UDP?
UDP generally has lower overhead because it doesn't require a connection handshake before sending a query. For a typical DNS lookup, the client can send a request and receive a response without the extra steps involved in establishing a TCP connection.
TCP adds connection setup and transport-level reliability mechanisms. However, the actual performance difference depends on network latency, packet loss, response size, and whether an existing TCP connection can be reused. When UDP packets are repeatedly lost, or a response requires TCP anyway, using UDP doesn't necessarily result in a faster completed lookup.
For most routine DNS queries, UDP is an efficient transport protocol. TCP becomes useful when the response is truncated, or the operation requires reliable transfer of larger amounts of DNS data.
When Does DNS Use TCP Instead of UDP?
Although DNS commonly uses UDP, several situations require or may lead to the use of TCP.
Large DNS Responses
Some DNS queries return more data than others. A simple A record lookup may return one IPv4 address, while a query for certain DNSSEC records or other data may produce a much larger response.
Traditional DNS over UDP had a 512-byte message limit. However, EDNS(0) allows clients and servers to advertise larger UDP message sizes. This means DNS does not automatically switch to TCP whenever a response exceeds 512 bytes.
If the response cannot fit within the available UDP message size, the server may send a truncated response. The resolver can then retry the query over TCP to retrieve the complete answer.
Truncated DNS Responses
A DNS response can include a TC (truncated) flag when the server cannot return the full answer in the available message. When a resolver receives a truncated response, it can retry the query over TCP. TCP allows the DNS message to be transferred without the same UDP datagram-size constraints, although the network and DNS implementation must still support the connection.
For example, a DNSSEC-enabled domain may return a larger response because the answer includes additional records or signatures. If the UDP response is truncated, the resolver may need to retry over TCP to obtain the full data.
DNS Zone Transfers
DNS servers use TCP for zone transfers, which copy DNS zone data from one server to another.
Two common types are:
- AXFR (Authoritative Zone Transfer): Transfers an entire DNS zone.
- IXFR (Incremental Zone Transfer): Transfers changes made to a zone since a previous version.
Zone transfers may contain many records, so reliable delivery is important. TCP provides ordered data transfer and retransmission, making it suitable for these operations.
Also, zone transfers are different from ordinary DNS lookups. A user visiting a website typically does not trigger an AXFR or IXFR request.
DNS Implementations and Network Conditions
TCP may also be used when a resolver or DNS application explicitly requests it or when an implementation follows a particular transport requirement.
Network conditions can affect whether a query succeeds over UDP. For example, firewalls may block certain UDP packets, or a network may have problems handling large UDP responses. A resolver may retry using TCP when it receives a truncated answer, but a timeout does not guarantee that a TCP retry will happen automatically in every situation. This is why network administrators should check both protocols rather than assuming that allowing UDP port 53 is enough for every DNS operation.
How Do DNS Queries Work Over TCP and UDP?
To understand DNS TCP or UDP behavior, it helps to follow a typical lookup.
Step 1: A Device Requests a DNS Record
When you enter a domain name into your browser, the device first checks available local information, such as its DNS cache. If it cannot find a usable answer, it sends a query to a configured DNS resolver. For a typical lookup, the query travels over UDP to the resolver on port 53.
Step 2: The Resolver Finds the Answer
If the resolver has a valid cached record, it can return the answer immediately. Otherwise, it may contact other DNS servers to find the information, depending on its configuration and the query. The resolver then sends the requested record back to the device. If the response fits within the available UDP message size and is not truncated, the lookup can finish over UDP.
Step 3: The Resolver Retries if the Response is Truncated
If the server returns a truncated UDP response, the resolver can retry the query over TCP.
TCP establishes a connection between the communicating systems and provides reliable, ordered delivery. DNS over TCP also uses a two-byte length field before each DNS message, allowing the receiver to determine the message length. Once the complete response arrives, the resolver can process it and return the answer to the client.
Step 4: The Browser Connects to the Website
After the device receives the IP address, the browser can use it to connect to the website. DNS resolution and the subsequent website connection are separate processes. The website itself may use TCP or another transport depending on the application protocol and configuration.
How to Check DNS Records
If you manage a domain, checking its DNS records can help you identify configuration problems before they affect users.
You can use the NSLookup.io DNS Lookup tool to inspect DNS records associated with a domain. For a broader review, run a free DNS health check to look for potential configuration and security issues. These checks can help you investigate whether the correct records exist, but they do not replace testing the actual network path between a resolver and a DNS server.
Conclusion: DNS Uses Both TCP and UDP
So, does DNS use TCP or UDP? It uses both. UDP handles most routine DNS queries because it has lower overhead, while TCP supports truncated-response retries, zone transfers, and other situations that need reliable data transfer.
If you manage a domain, check its DNS records and run a DNS health check to identify potential configuration issues. For ongoing visibility, DNS monitoring can also help you spot unexpected record changes before they become bigger problems.
Frequently Asked Questions
Does DNS over TLS use TCP or UDP?
DNS over TLS (DoT) uses TCP to carry encrypted DNS messages, commonly over port 853. It protects DNS queries in transit, helping prevent intermediaries from reading or modifying the messages.
Does DNSSEC require TCP?
No. DNSSEC can work with DNS over either UDP or TCP. Because DNSSEC records and signatures can increase response sizes, some queries may receive truncated UDP responses and require a TCP retry.
Does using TCP or UDP make DNS queries encrypted?
No. Standard DNS over TCP and UDP is not encrypted by the transport protocol alone. DNS encryption requires a protocol such as DNS over HTTPS or DNS over TLS, configured between compatible endpoints.