Calculate how much RRSIG and DNSKEY records inflate a DNS response, and whether it still fits UDP, EDNS0 or needs TCP.
Each RRSIG carries an 18-byte fixed header, the signer's name and the raw signature, so an RSA-2048 signature costs nearly 300 bytes per record. Add the DNSKEY RRset — two 2048-bit keys is over 500 bytes on its own — and a DNSSEC response routinely runs ten times the size of its unsigned equivalent, straight past 512 bytes and often past the 1232-byte EDNS0 buffer into TCP. Responses that exceed the path MTU or the advertised EDNS0 buffer fall back to TCP or fragment, and networks that block DNS over TCP or drop fragments turn a signed zone into an intermittent resolution failure.
DNSSEC
signed size = unsigned + RRSIGs × (38 + signature bytes) + DNSKEY RRset + 11 bytes of EDNS0 OPT.
signed size = unsigned + RRSIGs × (38 + signature bytes) + DNSKEY RRset + 11 bytes of EDNS0 OPT. Each RRSIG carries an 18-byte fixed header, the signer's name and the raw signature, so an RSA-2048 signature costs nearly 300 bytes per record. Add the DNSKEY RRset — two 2048-bit keys is over 500 bytes on its own — and a DNSSEC response routinely runs ten times the size of its unsigned equivalent, straight past 512 bytes and often past the 1232-byte EDNS0 buffer into TCP.
Responses that exceed the path MTU or the advertised EDNS0 buffer fall back to TCP or fragment, and networks that block DNS over TCP or drop fragments turn a signed zone into an intermittent resolution failure.
This calculator takes 6 inputs: Unsigned response size, RRSIG records in the response, Signing algorithm, Response carries the DNSKEY RRset, Keys in the DNSKEY RRset, Advertised EDNS0 buffer size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
For response size, yes — ECDSAP256SHA256 signatures are 64 bytes against 256 for RSA-2048, which typically brings a signed response back under the EDNS0 buffer and eliminates TCP fallback. Validate that your resolver population supports algorithm 13 first; an unsupported algorithm is treated as unsigned rather than as a failure, which quietly removes the protection.