5 ms·
It is a common misconception that a DNS TXT record can only contain 255 bytes. This is not true, a TXT record can actually contain much more than 255 bytes. rf
by LeonM 3y ago
It is a common misconception that a DNS TXT record can only contain 255 bytes. This is not true, a TXT record can actually contain much more than 255 bytes.
rfc1035 defines the <character-string> string object, which consists of a length octet (byte), followed by n bytes of text. There is no null terminator. So, the maximum length of the <character-string> is 255 bytes of usable text.
However, a TXT record can contain one or more <character-string> objects, which the DNS client will stitch together into one long string. For a standard DNS record, the length is ultimately limited by the rdlength property of the resource record format (rfc1035, sect 4.1.3). The rdlength is 16 bit unsigned, so the maximum payload length of a resource record is 65,536 octets (64kb). Keeping in mind the overhead of the length octet in each <character-string> object, you'll end up with a maximum of 65,280 octets of usable characters in the TXT record.
This will work, but requires the DNS server to respond to TCP requests. UDP connections that are more typically used for DNS have a limit of about 1500 bytes in length.
- teddyh 3y ago> which the DNS client will stitch together into one long string. Not necessarily. In practice, yes, this is what clients looking for long SPF or DKIM records actually do. But there isn’t anything guaranteeing this if you invent your own use for TXT records.
- throwaway167 3y agoThat's really interesting. I could serve a whole site purely via DNS.
- ape4 3y agoCan a domain have multiple TXT records?
- LeonM 3y agoYes. Though you'd probably need to label them, or you'd run into the same UDP length issues. Also, there is no guarantee in order the records are returned.
- Geezus_42 3y agoYes, if you spend time in SMTP land you will see lots of domains with multiple TXT records for things like SPF and DKIM. Also, services like Barracuda, Gsuite, O365, etc that use a TXT record to verify you control the domain. Let's Encrypt uses that mechanism as well.
- trolan 3y agoThe dns_cloudflare [1] also automates the cert generation and follow on renewals on a cron or via nginx proxy manager. Uses cloudflare API key, modifies the TXT record, issues/updates a cert and deletes the record. [1] https://certbot-dns-cloudflare.readthedocs.io/en/stable/ https://certbot-dns-cloudflare.readthedocs.io/en/stable/
- themoonisachees 3y agoMatrix federation also uses some txt records (as well as srv) to point other servers go your matrix instance domain
- FiveNinjas 3y agoYup - you can do a lot with a TXT record. dig txt @vps7.pgregg.com artofwar.pgregg.com |sed 's/" "//g' |sed 's/`n/\n/g' |less
- semiquaver 3y ago> UDP connections that are more typically used for DNS have a limit of about 1500 bytes in length. UDP datagrams can be up to 64K using IP fragmentation, but the original DNS protocol limits UDP payload sizes to 512 bytes. Using EDNS, payloads may be as much as 4096 bytes.
- LeonM 3y agoYou are right, I think I must have mistaken MTU with UDP, thus mistakenly assumed 1500 bytes.
- tonymet 3y agoGreat research and interesting. DNS TXT has great potential for Query / response like teletext on European TVs in the 1990s Any effort to restore the internet as a diffused & usable information resource (rather than an advertising network) would be beneficial.
- voytec 3y ago> It is a common misconception that a DNS TXT record can only contain 255 bytes I got a flashback of a long-ish email exchange with a certain DNS parking provider, related to publishing public 4096bit DKIM keys...
- fanf2 3y agoDNS also has an overall message size limit of 65535 bytes, so if you try to create a max-size TXT record, the server will not be able to answer queries for it, nor transfer the zone to secondary servers.