Why does DNS mostly use UDP, and when does it switch to TCP?
A DNS lookup is one small question and one small answer, so UDP avoids the cost of a handshake. DNS falls back to TCP when the answer is too large for a UDP response (truncated flag set), for zone transfers, and for DNS over TLS.
Explain it simply
Asking a shopkeeper "how much is this?" does not need a formal introduction first. A quick question and quick answer is exactly what UDP does well. If the answer is a long price list, you ask again in writing, which is the TCP fallback.
Example
UDP 53: query (about 40-100 bytes) -> response (usually < 512 bytes,
or up to about 1232 bytes with EDNS0 as commonly configured)
TCP 53: used when response has TC (truncated) bit,
for AXFR zone transfers, and large DNSSEC answersWith TCP, a lookup would need a SYN, SYN-ACK and ACK first, one extra round trip before the question even leaves. Since the browser does a DNS lookup before almost every new connection, that overhead would add up across a page with many domains.
If a UDP reply is lost, the resolver simply retries after a timeout or asks another server. The app-level retry costs less than TCP's setup in the usual case.
What to say in the interview
"DNS uses UDP port 53 for speed: one packet each way and no handshake. If the response is truncated, the client retries over TCP. Zone transfers and DNS over TLS also use TCP."
Common mistakes
- Saying DNS never uses TCP.