diff --git a/plugin/auto/auto.go b/plugin/auto/auto.go
index 93e2732dc..f2d1ab97c 100644
--- a/plugin/auto/auto.go
+++ b/plugin/auto/auto.go
@@ -70,7 +70,7 @@ func (a Auto) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (i
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Answer, m.Ns, m.Extra = answer, ns, extra
 
 	switch result {
diff --git a/plugin/backend_lookup.go b/plugin/backend_lookup.go
index 07b147d3f..89bc56a2f 100644
--- a/plugin/backend_lookup.go
+++ b/plugin/backend_lookup.go
@@ -383,7 +383,7 @@ func SOA(b ServiceBackend, zone string, state request.Request, opt Options) ([]d
 func BackendError(b ServiceBackend, zone string, rcode int, state request.Request, err error, opt Options) (int, error) {
 	m := new(dns.Msg)
 	m.SetRcode(state.Req, rcode)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Ns, _ = SOA(b, zone, state, opt)
 
 	state.SizeAndDo(m)
diff --git a/plugin/cache/item.go b/plugin/cache/item.go
index 40dff0b65..27102da8a 100644
--- a/plugin/cache/item.go
+++ b/plugin/cache/item.go
@@ -61,7 +61,6 @@ func (i *item) toMsg(m *dns.Msg, now time.Time) *dns.Msg {
 	m1.AuthenticatedData = i.AuthenticatedData
 	m1.RecursionAvailable = i.RecursionAvailable
 	m1.Rcode = i.Rcode
-	m1.Compress = true
 
 	m1.Answer = make([]dns.RR, len(i.Answer))
 	m1.Ns = make([]dns.RR, len(i.Ns))
diff --git a/plugin/erratic/erratic.go b/plugin/erratic/erratic.go
index f763f8a67..c9cc87459 100644
--- a/plugin/erratic/erratic.go
+++ b/plugin/erratic/erratic.go
@@ -45,7 +45,6 @@ func (e *Erratic) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Compress = true
 	m.Authoritative = true
 	if trunc {
 		m.Truncated = true
diff --git a/plugin/etcd/handler.go b/plugin/etcd/handler.go
index ebd73d946..f69fdad00 100644
--- a/plugin/etcd/handler.go
+++ b/plugin/etcd/handler.go
@@ -84,10 +84,11 @@ func (e *Etcd) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Answer = append(m.Answer, records...)
 	m.Extra = append(m.Extra, extra...)
 
+	// TODO(miek): get rid of this by not adding dups in the first place, dnsutil.Append()?
 	m = dnsutil.Dedup(m)
 	state.SizeAndDo(m)
 	m, _ = state.Scrub(m)
diff --git a/plugin/etcd/stub_handler.go b/plugin/etcd/stub_handler.go
index ac533f810..300e0a350 100644
--- a/plugin/etcd/stub_handler.go
+++ b/plugin/etcd/stub_handler.go
@@ -32,8 +32,9 @@ func (s Stub) ServeDNS(ctx context.Context, w dns.ResponseWriter, req *dns.Msg)
 	if e != nil {
 		return dns.RcodeServerFailure, e
 	}
-	m.RecursionAvailable, m.Compress = true, true
+	m.RecursionAvailable = true
 	state.SizeAndDo(m)
+	m, _ = state.Scrub(m)
 	w.WriteMsg(m)
 	return dns.RcodeSuccess, nil
 }
diff --git a/plugin/federation/federation.go b/plugin/federation/federation.go
index c9cafc420..2e98875b9 100644
--- a/plugin/federation/federation.go
+++ b/plugin/federation/federation.go
@@ -103,7 +103,7 @@ func (f *Federation) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 
 	m.Answer = []dns.RR{service.NewCNAME(state.QName(), service.Host)}
 
diff --git a/plugin/file/file.go b/plugin/file/file.go
index 1f27c582d..f2294fa53 100644
--- a/plugin/file/file.go
+++ b/plugin/file/file.go
@@ -50,7 +50,7 @@ func (f File) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (i
 		if z.isNotify(state) {
 			m := new(dns.Msg)
 			m.SetReply(r)
-			m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+			m.Authoritative, m.RecursionAvailable = true, true
 			state.SizeAndDo(m)
 			w.WriteMsg(m)
 
@@ -84,7 +84,7 @@ func (f File) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (i
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Answer, m.Ns, m.Extra = answer, ns, extra
 
 	switch result {
diff --git a/plugin/forward/forward.go b/plugin/forward/forward.go
index 20d995710..a7da5f668 100644
--- a/plugin/forward/forward.go
+++ b/plugin/forward/forward.go
@@ -136,7 +136,6 @@ func (f *Forward) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 			return 0, nil
 		}
 
-		ret.Compress = true
 		// When using force_tcp the upstream can send a message that is too big for
 		// the udp buffer, hence we need to truncate the message to at least make it
 		// fit the udp buffer.
diff --git a/plugin/hosts/hosts.go b/plugin/hosts/hosts.go
index 74b6cfe31..c9ce163c9 100644
--- a/plugin/hosts/hosts.go
+++ b/plugin/hosts/hosts.go
@@ -63,7 +63,7 @@ func (h Hosts) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Answer = answers
 
 	state.SizeAndDo(m)
diff --git a/plugin/kubernetes/handler.go b/plugin/kubernetes/handler.go
index 2aaf96c46..012ce200b 100644
--- a/plugin/kubernetes/handler.go
+++ b/plugin/kubernetes/handler.go
@@ -17,7 +17,7 @@ func (k Kubernetes) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.M
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 
 	zone := plugin.Zones(k.Zones).Matches(state.Name())
 	if zone == "" {
@@ -79,6 +79,7 @@ func (k Kubernetes) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.M
 	m.Answer = append(m.Answer, records...)
 	m.Extra = append(m.Extra, extra...)
 
+	// TODO(miek): get rid of this by not adding dups in the first place, dnsutil.Append()?
 	m = dnsutil.Dedup(m)
 
 	state.SizeAndDo(m)
diff --git a/plugin/proxy/dns.go b/plugin/proxy/dns.go
index 04245ec46..d3153bdff 100644
--- a/plugin/proxy/dns.go
+++ b/plugin/proxy/dns.go
@@ -63,7 +63,6 @@ func (d *dnsEx) Exchange(ctx context.Context, addr string, state request.Request
 	if err != nil {
 		return nil, err
 	}
-	reply.Compress = true
 	reply.Id = state.Req.Id
 	// When using force_tcp the upstream can send a message that is too big for
 	// the udp buffer, hence we need to truncate the message to at least make it
diff --git a/plugin/reverse/reverse.go b/plugin/reverse/reverse.go
index 2d9dc94e6..273e20551 100644
--- a/plugin/reverse/reverse.go
+++ b/plugin/reverse/reverse.go
@@ -26,7 +26,7 @@ func (re Reverse) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 	state := request.Request{W: w, Req: r}
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 
 	switch state.QType() {
 	case dns.TypePTR:
diff --git a/plugin/route53/route53.go b/plugin/route53/route53.go
index f51e76448..f5c574e01 100644
--- a/plugin/route53/route53.go
+++ b/plugin/route53/route53.go
@@ -60,7 +60,7 @@ func (rr Route53) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 
 	m := new(dns.Msg)
 	m.SetReply(r)
-	m.Authoritative, m.RecursionAvailable, m.Compress = true, true, true
+	m.Authoritative, m.RecursionAvailable = true, true
 	m.Answer = answers
 
 	state.SizeAndDo(m)
diff --git a/plugin/template/template.go b/plugin/template/template.go
index dc43fd420..9bf5f8dd7 100644
--- a/plugin/template/template.go
+++ b/plugin/template/template.go
@@ -75,7 +75,7 @@ func (h Handler) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg)
 
 		msg := new(dns.Msg)
 		msg.SetReply(r)
-		msg.Authoritative, msg.RecursionAvailable, msg.Compress = true, true, true
+		msg.Authoritative, msg.RecursionAvailable = true, true
 		msg.Rcode = template.rcode
 
 		for _, answer := range template.answer {
@@ -105,6 +105,7 @@ func (h Handler) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg)
 		}
 
 		state.SizeAndDo(msg)
+		state.Scrub(msg)
 		w.WriteMsg(msg)
 		return template.rcode, nil
 	}
diff --git a/plugin/whoami/whoami.go b/plugin/whoami/whoami.go
index 45b8bc862..b2ba25e5e 100644
--- a/plugin/whoami/whoami.go
+++ b/plugin/whoami/whoami.go
@@ -22,7 +22,6 @@ func (wh Whoami) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg)
 
 	a := new(dns.Msg)
 	a.SetReply(r)
-	a.Compress = true
 	a.Authoritative = true
 
 	ip := state.IP()
diff --git a/request/request.go b/request/request.go
index ac5f509f4..c45f6e571 100644
--- a/request/request.go
+++ b/request/request.go
@@ -180,20 +180,25 @@ const (
 	ScrubAnswer
 )
 
-// Scrub scrubs the reply message so that it will fit the client's buffer. It sets
-// reply.Compress to true.
-// Scrub uses binary search to find a save cut off point in the additional section.
+// Scrub scrubs the reply message so that it will fit the client's buffer. It will first
+// check if the reply fits without compression and then *with* compression.
+// Scrub will then use binary search to find a save cut off point in the additional section.
 // If even *without* the additional section the reply still doesn't fit we
 // repeat this process for the answer section. If we scrub the answer section
 // we set the TC bit on the reply; indicating the client should retry over TCP.
 // Note, the TC bit will be set regardless of protocol, even TCP message will
 // get the bit, the client should then retry with pigeons.
 func (r *Request) Scrub(reply *dns.Msg) (*dns.Msg, Result) {
-	reply.Compress = true
-
 	size := r.Size()
-	rl := reply.Len()
 
+	reply.Compress = false
+	rl := reply.Len()
+	if size >= rl {
+		return reply, ScrubIgnored
+	}
+
+	reply.Compress = true
+	rl = reply.Len()
 	if size >= rl {
 		return reply, ScrubIgnored
 	}