Depends on the query type, but, hypothetically, lots!
As a purely theoretical example, I could define a (useless) DNS zone to contain, for each valid host name, one A record for every valid IPv4 address and one AAAA record for every valid IPv6 address, send an AXFR (zone transfer) query, and receive a response containing ≈2^32 + ≈2^128 IP addresses for each of its 36·37^62 + 36·37^61 + ⋯ + 36·37 + 36 hosts.
(Some DNS query types, such as AXFR, can split responses across any number of individually length-limited DNS messages.)
As a purely theoretical example, I could define a (useless) DNS zone to contain, for each valid host name, one A record for every valid IPv4 address and one AAAA record for every valid IPv6 address, send an AXFR (zone transfer) query, and receive a response containing ≈2^32 + ≈2^128 IP addresses for each of its 36·37^62 + 36·37^61 + ⋯ + 36·37 + 36 hosts.
(Some DNS query types, such as AXFR, can split responses across any number of individually length-limited DNS messages.)