Repository navigation
DNS server returns partial TXT RRSet without setting TC bit #480
Description
Description
When responding to a TXT query whose full RRSet exceeds the typical UDP size limit, the server returns only a subset of the TXT records without setting the TC (truncation) bit. This results in a partial RRSet being served as if it were complete, which violates DNS protocol requirements. According to RFC 2181 §9, if an RRSet cannot be fully included in a response, the server must set the TC bit to indicate truncation. Returning a partial RRSet without TC can mislead clients into treating incomplete data as authoritative.
Steps to Reproduce
- Configure the following zone:
campus.edu. 500 IN SOA ns1.campus.edu. root.campus.edu. 2026013101 6048 4000 2419200 6048
campus.edu. 500 IN NS ns1.campus.edu.
campus.edu. 500 IN NS ns2.campus.edu.
ns1.campus.edu. 500 IN A 192.0.2.1
ns2.campus.edu. 500 IN A 192.0.2.2
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
big-txt.campus.edu. 500 IN TXT "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
- Query:
- Name:
big-txt.campus.edu. - Type:
TXT
Buggy Behavior
The server returns:
rcode NOERROR- Only a subset of the TXT records in the Answer section
- TC bit is not set
This results in an incomplete RRSet being returned without any indication of truncation.
Expected Behavior
The server should either:
- Return the complete TXT RRSet, or
- If the full RRSet does not fit within the UDP response size limit:
- Set the TC (truncation) bit, and
- Optionally truncate the response (allowing the client to retry over TCP)
This behavior is correctly exhibited by implementations such as gdnsd.
Activity
wcawijngaards commentedon Apr 7, 2026
It looks like this is because the TXT records are duplicates. They have identical content. This make the server collate them, it ignores the duplicates. Other implementations should also ignore duplicates, or not produce them as well.
It can be seen with the
nsd-checkzonecommand, that echoes the zone content with-p. This can then show that the TXT records are duplicates.Thus the answer received, contains only one TXT record since the other records are duplicates and ignored when the zone is read in.
Sample output of checking the zone file.