--- title: Worth Reading: DNS over IPv6 « ipSpace.net blog | daily.dev description: DNS over IPv6 suffers from a cascade of interoperability problems caused by siloed design decisions. DNSSEC inflates DNS replies beyond MTU size, IPv6's strict... canonical: https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Worth Reading: DNS over IPv6 « ipSpace.net blog | daily.dev og:description: DNS over IPv6 suffers from a cascade of interoperability problems caused by siloed design decisions. DNSSEC inflates DNS replies beyond MTU size, IPv6's strict... og:url: https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu og:image: https://api.daily.dev/og/posts/qtIN9bLxU.png og:image:alt: Worth Reading: DNS over IPv6 « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Worth Reading: DNS over IPv6 « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 2 min read · 0 upvotes · 0 comments ## Summary DNS over IPv6 suffers from a cascade of interoperability problems caused by siloed design decisions. DNSSEC inflates DNS replies beyond MTU size, IPv6's strict no-fragmentation stance causes those replies to be dropped, ICMPv6 feedback is often blocked by overzealous firewalls, and UDP's stateless nature means the server never learns its reply was lost. The client must eventually fall back to DNS-over-TCP, adding latency. The Happy Eyeballs algorithm masks these failures until IPv4 breaks, making the problems hard to detect. Geoff Huston's analysis is referenced as the primary source. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do DNS queries fail over IPv6 when DNSSEC is enabled? DNSSEC causes DNS replies to exceed the IPv6 MTU. IPv6 enforces a strict no-fragmentation policy, so oversized replies are dropped. If ICMPv6 'packet too big' messages are also blocked by firewalls, the server never learns the reply was dropped. The client must time out and retry over DNS-over-TCP, adding significant latency before it gets a response. _Network engineers troubleshooting IPv6 DNS failures track issues like these on daily.dev._ ## Similar posts on daily.dev - [IPv6 Adoption in 2026](https://daily.dev/posts/ipv6-adoption-in-2026-fi2iowjgj) · Lobsters · 1 upvotes · 0 comments - [UDP Broadcasting And The Brave New World Of IPv6](https://daily.dev/posts/udp-broadcasting-and-the-brave-new-world-of-ipv6-kbr2qsudb) · Hackaday · 0 upvotes · 0 comments - [The world in which IPv6 was a good design](https://daily.dev/posts/the-world-in-which-ipv6-was-a-good-design-tj3i8ov0s) · Hacker News · 0 upvotes · 0 comments - [IPv6 in 2025 – Transitioning to IPv6](https://daily.dev/posts/ipv6-in-2025-transitioning-to-ipv6-x1lwgorkb) · Cisco · 0 upvotes · 0 comments --- Tags: [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Worth Reading: DNS over IPv6 « ipSpace.net blog","url":"https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu"},"datePublished":"2026-08-11T08:54:41.733Z","dateModified":"2026-08-11T09:16:23.524Z","description":"DNS over IPv6 suffers from a cascade of interoperability problems caused by siloed design decisions. DNSSEC inflates DNS replies beyond MTU size, IPv6's strict...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"dns","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Worth Reading: DNS over IPv6 « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/worth-reading-dns-over-ipv6-ipspace-net-blog-qtin9blxu#faq","mainEntity":[{"@type":"Question","name":"Why do DNS queries fail over IPv6 when DNSSEC is enabled?","acceptedAnswer":{"@type":"Answer","text":"DNSSEC causes DNS replies to exceed the IPv6 MTU. IPv6 enforces a strict no-fragmentation policy, so oversized replies are dropped. If ICMPv6 'packet too big' messages are also blocked by firewalls, the server never learns the reply was dropped. The client must time out and retry over DNS-over-TCP, adding significant latency before it gets a response. Network engineers troubleshooting IPv6 DNS failures track issues like these on daily.dev."}}]} ```