2704n router does not answer DNS queries that need TCP rather than UDP

seebee — Wed, 03 Aug 2022 10:15:05 GMT

I have a PlusNet 2704n router (Hub Zero), on the latest firmware I believe:

Firmware version: 7.275.17_F2704N_Plusnet

I have just noticed that it does not appear to use TCP when DNS answers are too large for UDP.

For example, using BBC as an example of a domain with a "large" TXT record

Ask a DNS server directly

$ dig @212.159.13.50 bbc.co.uk. TXT

; <<>> DiG 9.11.5-P4-5.1+deb10u7-Raspbian <<>> @212.159.13.50 bbc.co.uk. TXT
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38795
;; flags: qr rd ra; QUERY: 1, ANSWER: 18, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbc.co.uk. IN TXT

;; ANSWER SECTION:
bbc.co.uk. 180 IN TXT "_globalsign-domain-verification=WgTu2FOy64Yx8z8cOweOeyZ_YpUaQOmSTD9uyMwKbd"
bbc.co.uk. 180 IN TXT "miro-verification=1a94b0fef7a6d5136a272d5cb425e8dc034e8cfc"
bbc.co.uk. 180 IN TXT "v=spf1 a ip4:212.58.224.0/19 ip4:132.185.0.0/16 ip4:78.136.53.80/28 ip4:78.136.14.192/27 ip4:78.136.19.8/29 ip4:89.234.
10.72/29 ip4:89.234.53.236 ip4:212.111.33.181 ip4:78.137.117.8 ip4:46.37.176.74 ip4:185.184.237.181" " ip4:185.119.233.144/30 ip4:185.119.232.158 +include:sf.sis.bbc.co
.uk +include:spf.messagelabs.com ~all"
bbc.co.uk. 180 IN TXT "docusign=50f10407-e3e4-4f6a-aae4-712d4eb31329"
bbc.co.uk. 180 IN TXT "docusign=a10ad7b6-cf7e-472d-8157-23061f5b5116"
bbc.co.uk. 180 IN TXT "2RLXso9TrRPyhWOEhYggL0U/r1D+g8H7z9RqDBOmcJjSbj88TobGKimtkCrXZNBkDXQDj89lS4mDskNOJyWLdg=="
bbc.co.uk. 180 IN TXT "voUGv5zARbEV516E/S8Ugsy9/FOgDGg4n/rpmKZQRROVOj0+2tgzKw3Tk9+Ks6qVbNKU18KTrR5khxTQutDvBg=="
bbc.co.uk. 180 IN TXT "google-site-verification=ITX3CwHXxGVfkCmhF4eSwdfo8h2ZGLAZ3zRpYvZi5XA"
bbc.co.uk. 180 IN TXT "MS=ms10378910"
bbc.co.uk. 180 IN TXT "dropbox-domain-verification=l5djk65wpy3z"
bbc.co.uk. 180 IN TXT "adobe-idp-site-verification=9b850a4a56e3fac19aea1e0ac5db302e5cefab444cd73519dce1c72ccd4db058"
bbc.co.uk. 180 IN TXT "google-site-verification=RaiMXJBIiFvqXHd43kv_ekzmXT2l8ibq5Xy0mulndvU"
bbc.co.uk. 180 IN TXT "atlassian-domain-verification=SQsgJ5h/FqwMTXuSG/G4Nd1Gx6uX2keREOsZSa22D5XT46EsEuyaic8Aej4cR4Tr"
bbc.co.uk. 180 IN TXT "Huddle"
bbc.co.uk. 180 IN TXT "J0kgGm0XqA3/6pLD4DHeC5x/dAduzT809P1Iwx/PRCYvVS32rv75RIHKC2aVz47dJxKhPlxGf3h3KXiL6+dyXw=="
bbc.co.uk. 180 IN TXT "apple-domain-verification=jFFO0rdS9IrxgWUR"
bbc.co.uk. 180 IN TXT "msfpkey=69eew9c10ryb9cn8msgg2d4vg"
bbc.co.uk. 180 IN TXT "_globalsign-domain-verification=zgnCaep7wCvKr1E33tAk2yr9-kXVnCP93bMFk7WYQD"

;; Query time: 16 msec
;; SERVER: 212.159.13.50#53(212.159.13.50)
;; WHEN: Wed Aug 03 10:51:33 BST 2022
;; MSG SIZE rcvd: 1610

Ask the 2740n directly

$ dig @192.168.1.254 bbc.co.uk. TXT
;; Truncated, retrying in TCP mode.
;; Connection to 192.168.1.254#53(192.168.1.254) for bbc.co.uk. failed: connection refused.

It's not a problem with TXT records per se, eg ask for a smaller answer is fine

$ dig @192.168.1.254 nowtv.com. TXT

; <<>> DiG 9.11.5-P4-5.1+deb10u7-Raspbian <<>> @192.168.1.254 nowtv.com. TXT
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29149
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;nowtv.com. IN TXT

;; ANSWER SECTION:
nowtv.com. 60 IN TXT "facebook-domain-verification=2m7fhef3fynuzdzzu2kptvlppcdg8o"
nowtv.com. 60 IN TXT "MS=ms30766871"
nowtv.com. 60 IN TXT "v=msv1 t=938F2527-A2D5-41B6-BC9C-44FD5E3E8F6D"
nowtv.com. 60 IN TXT "v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:spf.messagelabs.com -all"

;; Query time: 25 msec
;; SERVER: 192.168.1.254#53(192.168.1.254)
;; WHEN: Wed Aug 03 10:52:16 BST 2022
;; MSG SIZE rcvd: 309

(Same in windows if you prefer, commands like "nslookup -type=TXT bbc.com. 192.168.1.254" fail and "nslookup -type=TXT bbc.com. 1.1.1.1" work etc)

It's not causing me any actual problems as far as I am aware, and I wouldn't know if it's related to firmware version as I don't recall seeing (or looking for) it in the past.
Does anyone else see the same?

Re: 2704n router does not answer DNS queries that need TCP rather than UDP

bobpullen — Wed, 03 Aug 2022 11:39:35 GMT

This wouldn't surprise me.

I've seen other hub DNS forwarders behave the same.

topic Re: 2704n router does not answer DNS queries that need TCP rather than UDP in My Router

2704n router does not answer DNS queries that need TCP rather than UDP

Re: 2704n router does not answer DNS queries that need TCP rather than UDP