Topic

DNS Message Size Limits

The size budgets that govern DNS answers, from the original 512-byte UDP cap through EDNS buffer advertisements to the truncation-and-TCP-retry path used when a response will not fit, and the interoperability failures that surface as responses grow.

Current clusters

build1 publisher

A 2,420-byte DNSSEC signature overruns the UDP buffer DNS software commonly advertises

Cloudflare switched on ML-DSA-44 validation in 1.1.1.1 to learn which resolvers and middleboxes still assume a DNS answer fits one datagram, since the signature alone runs to nearly twice the 1,232-byte limit DNS software commonly advertises.

Publishers:blog.cloudflare.com

Reality

Evidence64
Adoption22
Hype gap−10
Incentives68
Confidence58