Network & Infrastructure / DNS, DNSSEC & Service Discovery
EDNS response size, fragmentation and DNSSEC timeouts
Small DNS queries work while DNSSEC-related responses time out across one firewall. Larger UDP responses may fragment or trigger behavior the path does not reliably carry.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record advertised EDNS size, actual response length, truncation flags, fragmentation and TCP fallback attempts. Compare authoritative and recursive paths because they can face different bottlenecks.
Explain the result
EDNS allows larger DNS messages but does not guarantee that the network delivers them. A resolver also needs a usable fallback path when a UDP response cannot fit or is truncated.
Plan the fix
Align resolver response sizing with supported path behavior and permit required DNS over TCP. Fix demonstrated fragmentation or feedback problems rather than disabling DNSSEC to shrink responses.
Check the result and rollback
Validate large signed responses over each required network path and verify fallback completion. Restore prior settings if changes reduce interoperability or produce repeated retries without useful answers.