Query DNS over TCP Through an SSH Local Forward

OpenSSH local forwarding carries TCP. DNS can use TCP too, provided the query tool and remote DNS service use that transport.

For a DNS server reachable from the SSH host, open a loopback-only forward:

ssh -N -L 127.0.0.1:1053:dns.internal:53 [email protected]

Then issue an explicit TCP DNS query from the local machine:

dig +tcp @127.0.0.1 -p 1053 app.internal A

Replace the DNS server, SSH host and queried name with the intended values. The SSH server side must be able to reach dns.internal:53, and forwarding policy must permit it.

The local port is above the privileged-port range. A query to a local port of 1053 does not require binding the system DNS port 53.

This does not redirect ordinary UDP DNS queries automatically. A raw UDP-to-TCP byte pipe is insufficient because DNS over TCP adds a length field and stream framing. System resolver integration needs a suitable DNS forwarder or an explicit supported TCP configuration.

Finally, obtaining an address through this path does not route the subsequent web connection through SSH. DNS lookup and destination transport remain separate choices.