DNS normally uses UDP port 53. In which situation does a DNS client or server fall back to TCP on port 53?

LPIC-1 Exam 102-500, objective 109. Networking fundamentals hard

Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.

Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

The options

Correct When the response is too large for a single UDP datagram and comes back with the truncation flag set, and for zone transfers between servers

Correct. A truncated (TC bit) response tells the resolver to retry over TCP, and zone transfers (AXFR/IXFR) always use TCP because they are bulk, reliable transfers.

Not correct Whenever the query asks for an MX or TXT record rather than an A record

Wrong. The record type does not choose the transport. Any record type is queried over UDP first; only the response size matters.

Not correct When the query is a reverse lookup in the in-addr.arpa zone

Wrong. Reverse lookups are ordinary queries and use UDP first exactly like forward lookups.

Not correct Only when the resolver is configured with the `options tcp` directive in /etc/resolv.conf

Wrong. There is no `tcp` option in resolv.conf. The glibc resolver does accept `options use-vc`, which forces TCP, but the fallback described above happens automatically without any configuration.

Why

DNS is a rare protocol that uses both transports on the same port number. Queries go out over UDP 53 for speed; if the answer exceeds what the negotiated UDP size allows, the server returns a short reply with the TC (truncated) bit set and the client repeats the query over TCP 53. Zone transfers use TCP unconditionally. A firewall that permits only UDP 53 therefore breaks large responses such as DNSSEC-signed answers.

Where this comes from

Cited
LPI exam objective 109.1
What it says
Understand the difference between TCP and UDP and which transport common services use.

Practise this

Reading one question is not practice. The trainer will draw a short set from objective 109 and space the ones you get wrong.

Practise LPIC-1 Exam 102-500

More questions on this objective

All questions on Networking fundamentals

Practise LPIC-1 Exam 102-500