Windows Server / DNS, DHCP & Server Networking
Investigate DNS failures that occur only for larger responses
A path can allow ordinary UDP DNS while blocking TCP fallback or larger responses. Compare a permitted name over both query paths.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Resolve-DnsName -Name example.com -Server DNS01
Resolve-DnsName -Name example.com -Server DNS01 -TcpOnlyRead the result
In PowerShell, the second request explicitly uses TCP. Results depend on the selected name and server; one small answer does not exercise every size condition.
Resolve and verify
Correlate failures with firewall and resolver logs and test the actual affected record through the approved path. Repair narrow DNS transport rules as required.
Before changing production
Do not reduce DNS security settings or open unrestricted ports solely because one protocol test fails.