IPFYI
RFC 5966 Proposed Standard

DNS Transport over TCP - Implementation Requirements

R. Bellis · 2010-08

Abstract

RFC 5966 updates RFC 1123 to mandate that DNS implementations MUST support TCP as a transport for DNS queries and responses, not merely as an optional fallback for responses exceeding 512 bytes. It documents operational scenarios where TCP is required and recommends that firewalls and middleboxes not block DNS over TCP.

Why This RFC Matters

The historical assumption that DNS was UDP-only caused many firewalls and operators to block TCP port 53, breaking large DNS responses (DNSSEC, IPv6 AAAA records, SPF records) that exceed the 512-byte UDP limit. RFC 5966 made TCP support mandatory, paving the way for EDNS(0) buffer sizes, DNS over TLS (RFC 7858), and the larger DNSSEC-signed responses that are now common. Its successor, RFC 7766, further strengthened TCP DNS requirements.

Related Protocols

DNS TCP UDP

Related Terms

dns ipv4 ipv6

More in Infrastructure

RFC 1591 Domain Name System Structure and Delegation RFC 1878 Variable Length Subnet Table for IPv4 RFC 1996 A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) RFC 2050 Internet Registry IP Allocation Guidelines RFC 2142 Mailbox Names for Common Services, Roles and Functions RFC 2317 Classless IN-ADDR.ARPA Delegation RFC 2460 Internet Protocol, Version 6 (IPv6) Specification RFC 3596 DNS Extensions to Support IP Version 6