Skip to content
ENExplore Calculators

DNSSEC Calculator

Calculate how much RRSIG and DNSKEY records inflate a DNS response, and whether it still fits UDP, EDNS0 or needs TCP.

About DNSSEC Calculator

Each RRSIG carries an 18-byte fixed header, the signer's name and the raw signature, so an RSA-2048 signature costs nearly 300 bytes per record. Add the DNSKEY RRset — two 2048-bit keys is over 500 bytes on its own — and a DNSSEC response routinely runs ten times the size of its unsigned equivalent, straight past 512 bytes and often past the 1232-byte EDNS0 buffer into TCP. Responses that exceed the path MTU or the advertised EDNS0 buffer fall back to TCP or fragment, and networks that block DNS over TCP or drop fragments turn a signed zone into an intermittent resolution failure.

Formula

DNSSEC

signed size = unsigned + RRSIGs × (38 + signature bytes) + DNSKEY RRset + 11 bytes of EDNS0 OPT.

RRSIG
Signature record: 18-byte fixed header plus signer name plus the signature itself
DNSKEY
Public key RRset returned for validation
EDNS0 OPT
Pseudo-record that advertises a larger UDP buffer

Worked example

With the default values below, DNSSEC Calculator returns Signed Response Size of 1,281. Change any input above and every figure here is recalculated in your browser.

Inputs used

Unsigned response sizeaccepts 32–4,096 bytes
128 bytes
RRSIG records in the responseaccepts 0–32 records
2 records
Signing algorithmone of RSASHA256, 2048-bit key — 256 B signature, RSASHA256, 1024-bit key — 128 B signature, ECDSAP256SHA256 — 64 B signature, ED25519 — 64 B signature
RSASHA256, 2048-bit key — 256 B signature
Response carries the DNSKEY RRset
Yes
Keys in the DNSKEY RRsetaccepts 1–16 keys
2 keys
Advertised EDNS0 buffer sizeaccepts 512–4,096 bytes
1,232 bytes

Results

Signed Response Size
1,281 bytes
Size Inflation vs Unsigned
900.8%
Bandwidth Multiplier
10.01 ×
RRSIG Overhead
588 bytes
DNSKEY Overhead
554 bytes
Transport Outcome
Exceeds the EDNS0 buffer — TCP fallback or fragmentation

Step by step

  1. 1Values used
  2. 2DNSSEC
  3. 3Signed Response Size= 1,281 bytes
  4. 4Size Inflation vs Unsigned= 900.8
  5. 5Bandwidth Multiplier= 10.01 ×
  6. 6RRSIG Overhead= 588 bytes
  7. 7DNSKEY Overhead= 554 bytes
  8. 8Transport Outcome= Exceeds the EDNS0 buffer — TCP fallback or fragmentation

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is DNSSEC calculated?

signed size = unsigned + RRSIGs × (38 + signature bytes) + DNSKEY RRset + 11 bytes of EDNS0 OPT. Each RRSIG carries an 18-byte fixed header, the signer's name and the raw signature, so an RSA-2048 signature costs nearly 300 bytes per record. Add the DNSKEY RRset — two 2048-bit keys is over 500 bytes on its own — and a DNSSEC response routinely runs ten times the size of its unsigned equivalent, straight past 512 bytes and often past the 1232-byte EDNS0 buffer into TCP.

Why does DNSSEC matter?

Responses that exceed the path MTU or the advertised EDNS0 buffer fall back to TCP or fragment, and networks that block DNS over TCP or drop fragments turn a signed zone into an intermittent resolution failure.

What values do I need to enter?

This calculator takes 6 inputs: Unsigned response size, RRSIG records in the response, Signing algorithm, Response carries the DNSKEY RRset, Keys in the DNSKEY RRset, Advertised EDNS0 buffer size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I switch from RSA to ECDSA?

For response size, yes — ECDSAP256SHA256 signatures are 64 bytes against 256 for RSA-2048, which typically brings a signed response back under the EDNS0 buffer and eliminates TCP fallback. Validate that your resolver population supports algorithm 13 first; an unsupported algorithm is treated as unsigned rather than as a failure, which quietly removes the protection.

Related Calculators

DNSSEC Calculator – Calculate Signed Response Size