dig +tcp: query DNS over TCP instead of UDP (truncated answers, firewalls)
- tool
- dig / nslookup
- command
- dig
- flag
- +tcp
- default
- +notcp (UDP, except for ANY and IXFR queries, which use TCP, and AXFR, which always does)
dig +tcp example.com TXT sends the query over TCP port 53 instead of UDP. The BIND manual states that dig uses UDP by default unless a type ANY or IXFR query is requested, in which case TCP is the default, and that AXFR always uses TCP. Forcing TCP is how you test that a DNS server and the firewalls in front of it accept TCP, which RFC 7766 makes mandatory, and how you check whether large answers (DNSSEC signatures, long TXT records, many addresses) arrive intact.
Typical commands
dig +tcp example.com # same query, TCP transport
dig +tcp @ns1.example.com example.com DNSKEY # large DNSSEC answer from the authoritative server
dig +notcp +ignore example.com TXT # UDP only, do not retry over TCP when truncated
dig +tcp +keepopen @192.0.2.53 a.example b.example # reuse one TCP connection for several queriesThe ;; SERVER: line in the statistics shows the server and protocol used, for example (TCP) or (UDP).
Related transport options
| Option | Effect |
|---|---|
| +tcp / +vc | Use TCP (+vc is the older name, "virtual circuit") |
| +ignore | Do not retry over TCP when a UDP answer is truncated; show the truncated answer |
| +bufsize=B | EDNS0 UDP buffer size advertised to the server (0 to 65535) |
| +keepopen | Keep the TCP socket open between queries |
| +tls | DNS over TLS (port 853) |
| +https | DNS over HTTPS |
| -p PORT | Query a non-standard port |
Diagnosing with +tcp
- Works over UDP, times out over TCP: TCP port 53 is filtered. Clients will fail on large responses and on DNSSEC-signed zones; dig reports connection timed out; no servers could be reached.
- TCP refused: nothing listens on TCP 53, or a firewall rejects it actively; see communications error: connection refused.
- Different answers over UDP and TCP: a middlebox rewrites UDP DNS (captive portals, DNS interception); compare both with
+noall +answer, see dig +noall +answer. - Truncation: a UDP answer with the
tcflag in the header means the response did not fit; with+ignoreyou see what was cut, without it dig retries over TCP automatically.
To direct the query at a particular resolver or authoritative server, combine +tcp with @server, as on query a specific DNS server.
FAQ
When does dig use TCP on its own?
For AXFR always, for ANY and IXFR queries by default, and when a UDP response comes back with the TC (truncated) flag set, in which case dig retries over TCP unless +ignore is given.
Why does dig +tcp time out while normal dig works?
A firewall between you and the server allows UDP port 53 but blocks TCP port 53. RFC 7766 requires DNS servers to support TCP, so the firewall should be fixed; large responses such as DNSSEC or many TXT records will otherwise fail.
What does the TC flag mean?
The UDP response was too large for the advertised buffer and was truncated. The client is expected to repeat the query over TCP to get the complete answer.