A nameserver answers over UDP but not over TCP
What this check looks for
One of your nameservers refuses connections on the TCP port it is required to serve. Any answer too large for a single UDP packet — DNSSEC signatures, long TXT records — cannot be delivered at all.
Why it matters
The failure is selective and therefore confusing: small lookups work, and one particular record silently stops resolving for everyone. It is a firewall rule that blocked TCP/53 on the assumption that DNS is a UDP protocol, which stopped being true in practice years ago.
When the check passes, your report says: “Every nameserver answers over TCP as well as UDP”.
What it costs your score
When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.transport family ceiling of 8 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- dns.health.transport · 8
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Allow inbound TCP on port 53 to every authoritative nameserver.
Large answers, including all DNSSEC responses, can only be delivered over TCP.
Open TCP/53 inbound on the host firewall and on any network firewall or security group in front of it.
Confirm the nameserver process is listening on TCP as well as UDP.
Re-test with a query that forces TCP.
How to confirm it worked
dig +tcp SOA ‹domain› @‹nameserver› — expect an answer, not a connection error
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
# allow DNS over TCP as well as UDP
nft add rule inet filter input tcp dport 53 accept
nft add rule inet filter input udp dport 53 acceptTechnical detail
These nameservers answered a query over UDP but not the same query over TCP: ‹server list›. RFC 7766 §3 makes TCP support mandatory for every DNS implementation, not a fallback. A truncated UDP answer sets the TC bit and the resolver is expected to retry over TCP; with TCP blocked, the retry fails and the resolver returns nothing.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours