Symptoms

DNS messages over TCP passing through a DNS virtual may be marked as corrupt due to a message length miscalculation.

Impact

DNS messages over TCP passing through a DNS virtual may be marked as corrupt due to a message length miscalculation.

Conditions

A virtual must have a DNS profile assigned, a DNS message must be exactly two bytes longer than a multiple of the TCP segment size, and the TCP stack on the DNS client or resolver must bundle the first two bytes (the TCP message length) with the message in the first TCP segment.

Workaround

Use UDP with EDNS instead of TCP if possible. Alternatively, adjust the TCP MSS setting by a few bytes for the DNS virtual.

Fix Information

The DNS message length is now correctly calculated.

Behavior Change