Graylog2 / Graylog2/graylog2-server
Regression in 7.1+ TXT size limit for DNS data adapter too small
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
In 7.1+ the maximum size for a TXT record received when doing a DNS query through a lookup adapter is too small. Seems to be limited to 64 characters.
## Expected Behavior
These queries work in 7.0.x and below>
* as13335.asn.cymru.com
* as8075.asn.cymru.com
## Current Behavior
On 7.1.2, queries with "long" answers (such as as13335 and as8075) fail with an error. The result structure returns "has_error:true" with these errors on the log file:
```
2026-05-25 15:36:32,158 ERROR o.g.l.a.DnsLookupDataAdapter [http-worker-59] Could not perform TXT DNS lookup for [as13335.asn.cymru.com]. Cause [label must be <= 63 but was 69.]
2026-05-25 15:38:18,896 ERROR o.g.l.a.DnsLookupDataAdapter [http-worker-58] Could not perform TXT DNS lookup for [as8075.asn.cymru.com]. Cause [label must be <= 63 but was 87.]
```
## Possible Solution
**Increase maximum size for DNS TXT responses. It seems it is a smaller number for 7.1+**. Actually a TXT record can be much bigger.
## Steps to Reproduce (for bugs)
* Create a DNS lookup adapter for TXT records both on 7.1.2 and previous versions and compare.
For example, on 7.0.5 "as13335.asn.cymru.com" returns:
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "13335 | US | arin | 2010-07-14 | CLOUDFLARENET - Cloudflare, Inc., US.",
"dns_ttl": 71617
}
]
},
"string_list_value": [
"13335 | US | arin | 2010-07-14 | CLOUDFLARENET - Cloudflare, Inc., US."
],
"has_error": false,
"ttl": 71617000
}
```
While on 7.1.2 it returns
```
{
"single_value": null,
"multi_value": null,
"string_list_value": null,
"has_error": true,
"ttl": 5000
}
```
For queries with shorter answers it works on both versions. For example,
* as714.asn.cymru.com
On 7.0.5:
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US.",
"dns_ttl": 69206
}
]
},
"string_list_value": [
"714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US."
],
"has_error": false,
"ttl": 69206000
}
```
On 7.1.2:
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US.",
"dns_ttl": 84937
}
]
},
"string_list_value": [
"714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US."
],
"has_error": false,
"ttl": 84937000
}
```
## Context
I am using a pipeline function to obtain the AS number and some data about an IP addresses. This particular query returns some data about an ASN including its name, country, NCC, etc.
Contributor guide
Assessment
This issue has not been assessed yet.