Graylog2 / Graylog2/graylog2-server

Regression in 7.1+ TXT size limit for DNS data adapter too small

Open
#26,117 5 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

In 7.1+ the maximum size for a TXT record received when doing a DNS query through a lookup adapter is too small. Seems to be limited to 64 characters.

## Expected Behavior

These queries work in 7.0.x and below>

* as13335.asn.cymru.com
* as8075.asn.cymru.com

## Current Behavior

On 7.1.2, queries with "long" answers (such as as13335 and as8075) fail with an error. The result structure returns "has_error:true" with these errors on the log file:

```
2026-05-25 15:36:32,158 ERROR o.g.l.a.DnsLookupDataAdapter [http-worker-59] Could not perform TXT DNS lookup for [as13335.asn.cymru.com]. Cause [label must be <= 63 but was 69.]
2026-05-25 15:38:18,896 ERROR o.g.l.a.DnsLookupDataAdapter [http-worker-58] Could not perform TXT DNS lookup for [as8075.asn.cymru.com]. Cause [label must be <= 63 but was 87.]
```

## Possible Solution
**Increase maximum size for DNS TXT responses. It seems it is a smaller number for 7.1+**. Actually a TXT record can be much bigger.

## Steps to Reproduce (for bugs)
* Create a DNS lookup adapter for TXT records both on 7.1.2 and previous versions and compare.

For example, on 7.0.5 "as13335.asn.cymru.com" returns:

```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "13335 | US | arin | 2010-07-14 | CLOUDFLARENET - Cloudflare, Inc., US.",
"dns_ttl": 71617
}
]
},
"string_list_value": [
"13335 | US | arin | 2010-07-14 | CLOUDFLARENET - Cloudflare, Inc., US."
],
"has_error": false,
"ttl": 71617000
}
```

While on 7.1.2 it returns

```
{
"single_value": null,
"multi_value": null,
"string_list_value": null,
"has_error": true,
"ttl": 5000
}
```

For queries with shorter answers it works on both versions. For example,

* as714.asn.cymru.com

On 7.0.5:
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US.",
"dns_ttl": 69206
}
]
},
"string_list_value": [
"714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US."
],
"has_error": false,
"ttl": 69206000
}
```
On 7.1.2:
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US.",
"dns_ttl": 84937
}
]
},
"string_list_value": [
"714 | US | arin | | APPLE-ENGINEERING - Apple Inc., US."
],
"has_error": false,
"ttl": 84937000
}
```

## Context
I am using a pipeline function to obtain the AS number and some data about an IP addresses. This particular query returns some data about an ASN including its name, country, NCC, etc.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.