• Glossary
  • What is UDP (User Datagram Protocol)?

DNS glossary

What is UDP (User Datagram Protocol)?

User Datagram Protocol (UDP) is a transport layer protocol that sends independent messages, called datagrams, between applications without first establishing a connection. It adds only port numbers and an optional checksum to IP, so it has low overhead and leaves reliability to the application, as defined in RFC 768.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

User Datagram Protocol (UDP) is a connectionless transport layer protocol defined in RFC 768 that sends independent messages with minimal overhead, making it the default choice for DNS queries and DHCP address assignments where low latency and reduced server state are critical operational requirements. UDP trades reliability and ordered delivery for speed by eliminating connection setup, acknowledgments, and retransmission at the transport layer, leaving error handling to applications. Operationally, UDP failures manifest as silent packet loss and timeouts rather than explicit errors, requiring careful network monitoring and firewall configuration to avoid intermittent DNS resolution failures and security vulnerabilities such as reflection amplification attacks.

  • DNS typically uses UDP for port 53 queries and responses because a single small request-reply exchange avoids TCP handshake overhead and per-connection state management across high-volume resolver operations.
  • UDP provides only an 8-byte header with source port, destination port, length, and optional checksum, while each datagram is routed independently and may be lost, duplicated, or reordered by the network without transport-layer recovery.
  • Firewall rules that block UDP 53 while permitting only TCP 53, or that drop fragmented UDP responses, cause silent intermittent resolution failures because UDP provides no delivery feedback and relies entirely on application-layer retry logic.

UDP at a glance

AttributeValue
Full nameUser datagram protocol
CategoryNetwork protocol
Defined inRFC 768
Protocol and portIP protocol number 17; DNS uses port 53; DHCP uses ports 67 and 68
OSI layerLayer 4 (transport)
Primary useLow-overhead, connectionless delivery of short messages such as DNS queries and DHCP exchanges
Related termsTCP, DNS, DHCP, Port 53, EDNS0

How UDP works

UDP wraps application data in a small datagram and hands it to IP. There is no connection setup, no acknowledgment and no retransmission at the transport layer.

  1. Application builds a message: The application, such as a DNS resolver, creates a complete request that fits in one datagram.
  2. UDP adds a header: UDP prepends an 8-byte header containing the source port, destination port, length and checksum.
  3. IP delivers the datagram: The datagram travels as an IP packet. Each datagram is routed independently and may be lost, duplicated or reordered.
  4. Receiver passes data to the application: The receiving host uses the destination port, for example 53 for DNS, to hand the payload to the right service.
  5. Application handles loss: If no reply arrives, the application decides what to do, usually a timeout followed by a retry, possibly to another server.

UDP does not provide congestion control, ordering or guaranteed delivery. DNS falls back to TCP when a response is truncated or when a transfer such as a zone transfer needs reliable delivery. DHCP uses UDP because a client without an address cannot hold a TCP connection.

Why UDP matters in enterprise networks

UDP is the default transport for DNS because a typical lookup is one small question and one small answer. Skipping a handshake saves a round trip and server state, which matters when a resolver handles very large numbers of queries. RFC 1035 originally limited UDP DNS messages to 512 bytes, and EDNS0 later allowed larger payloads.

DHCP also depends on UDP. A client with no address broadcasts from port 68 to servers on port 67, which TCP cannot do. Firewalls that block these ports silently break address assignment.

Operationally, UDP means failures are quiet. Dropped datagrams appear as timeouts and retries rather than connection errors, so slow name resolution is often the first symptom of packet loss or filtering. Blocking UDP 53 while allowing only TCP, or dropping fragmented UDP responses, causes intermittent failures. Because UDP does not verify the sender, attackers can spoof source addresses, which is why open resolvers are abused for reflection and amplification attacks. Response rate limiting, source address validation and restricting recursion to trusted clients reduce that risk.

UDP vs TCP

UDP sends independent datagrams with no connection, acknowledgment or retransmission, while TCP establishes a connection and provides ordered, reliable delivery of a byte stream. What is TCP?

AttributeUDPTCP
Delivery guaranteeNone at the transport layerAcknowledged and retransmitted
OrderingNot preservedPreserved
Header size8 bytesAt least 20 bytes
Message boundariesPreserved per datagramNot preserved; continuous stream
Typical DNS useMost queries and responsesZone transfers and large or truncated responses

Common UDP issues

A rule that permits only TCP 53 lets zone transfers work while ordinary lookups time out. Clients show intermittent resolution failures, and packet captures show queries leaving with no response.

Responses larger than the UDP payload size the client advertises are truncated and the client must retry over TCP. If TCP 53 is blocked, large answers such as DNSSEC-signed records fail while small ones succeed.

Large UDP datagrams that exceed the path MTU are fragmented, and many firewalls and middleboxes drop fragments. The symptom is that only certain queries time out, often those with big responses.

Firewalls and NAT devices track UDP flows with short idle timers. A slow upstream answer can arrive after the mapping expires and be discarded, so the client sees a timeout.

UDP gives no delivery feedback, so congestion or a full interface queue shows up only as application retries and latency. Engineers must check interface drop counters and server logs rather than expect transport errors.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

UDP FAQ

Related terms

Article

TCP

A protocol that provides reliable, ordered, and error-checked delivery of bytes between applications running on hosts communicating via an IP network; part of the TCP/IP suite.

Learn more
Article

DNS – Domain Name System

A hierarchical naming system that enables communication across devices in a network.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

The standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DORA process

The sequence of discover, offer, request, and acknowledge messages exchanged between client and server for DHCP.

Learn more
Article

DNS query / DNS request

Demand for information sent from a user’s computer (DNS client) to a DNS server.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Article

DNS tunneling

Exploits the DNS protocol to tunnel malware and other data through a client-server model.

Learn more
Article

OSI model

A conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system.

Learn more
Browse the full glossary