Why DNS Uses UDP for Queries and TCP for Zone Transfers

The Domain Name System (DNS) relies on both the User Datagram Protocol (UDP) and the Transmission Control Protocol (TCP) at the transport layer to balance performance with reliability. While standard DNS queries prioritize the speed and minimal overhead of UDP, zone transfers depend on the guaranteed, error-free delivery provided by TCP. This dual-protocol design ensures that routine internet browsing remains fast while critical domain synchronization between servers remains intact and consistent.

Why Standard DNS Queries Use UDP

Standard DNS queries—such as resolving a domain name like example.com into an IP address—are designed to be as fast and lightweight as possible. UDP is the ideal choice for these transactions for several reasons:

• Speed and Low Latency: UDP is a connectionless protocol. It does not require the multi-step handshake (SYN, SYN-ACK, ACK) that TCP demands before data can be transmitted. A client simply sends a request and receives a response, completing the lookup in a single round-trip.
• Minimal Resource Overhead: Because UDP does not maintain connection states, DNS servers can handle tens of thousands of concurrent requests per second without exhausting memory or tracking open connections.
• Small Payload Size: Most basic DNS requests and responses easily fit within the original 512-byte limit defined for standard DNS packets, making the complex flow-control mechanisms of TCP unnecessary.
• Application-Level Retries: If a UDP packet is lost in transit, the DNS client or resolver simply re-sends the query after a brief timeout.

Why DNS Zone Transfers Use TCP

A DNS zone transfer (typically using the AXFR or IXFR protocols) occurs when a secondary DNS server copies the entire database of DNS records for a domain from a primary DNS server. This operation has fundamentally different requirements that make TCP essential:

• Large Data Volume: Zone files often contain hundreds, thousands, or millions of resource records. This volume of data far exceeds the size of a single UDP packet and must be segmented across multiple packets.
• Guaranteed Delivery and Ordering: Unlike a failed single-query lookup that can simply be retried, a corrupted or incomplete zone transfer can break domain-wide name resolution. TCP provides built-in packet sequencing, acknowledgment, and automatic retransmission to guarantee that no records are missing or out of order.
• Connection-Oriented Integrity: TCP establishes a reliable point-to-point connection between the primary and secondary nameservers, ensuring that synchronization completes fully before the connection closes.

When Standard Queries Fall Back to TCP

While UDP is the default for standard queries, DNS will automatically switch to TCP under specific conditions:

• Truncated Responses (The TC Bit): If a standard response exceeds the maximum supported UDP payload size (such as large responses containing multiple DNSSEC signatures), the server sets the Truncation (TC) flag in the DNS header. Upon receiving this flag, the client immediately retries the query using TCP.
• Enhanced Security Implementations: Modern encrypted protocols like DNS over TLS (DoT) and DNS over HTTPS (DoH) operate exclusively over TCP to support cryptographic handshakes and continuous secure streams.