Network & Infrastructure / DNS, DNSSEC & Service Discovery
DNS over TCP is a functional dependency, not an optional extra
A firewall allows DNS UDP but blocks TCP, and only selected lookups fail. Responses that require truncation or larger transfers expose the incomplete service policy.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Capture truncated UDP responses, subsequent TCP attempts and firewall decisions. Test the resolver's actual upstream and client-facing paths instead of checking only one local port.
Explain the result
DNS clients and resolvers can require TCP for ordinary resolution behavior, not just zone transfer. A working small UDP lookup therefore does not demonstrate a complete DNS service.
Plan the fix
Permit the documented TCP DNS paths between authorized clients, resolvers and authoritative servers. Keep transfer authorization separate so allowing resolution does not grant unrestricted zone replication.
Check the result and rollback
Validate truncated-response fallback and concurrent query load. Revert policy changes if unrelated endpoints gain access, and retain a negative test proving unauthorized transfers are still refused.