wire / wire-format / dns-message

DNS message format

A DNS message is a 12-byte header followed by four sections: Question, Answer, Authority, and Additional. The header carries the transaction ID, flags (QR, Opcode, AA, TC, RD, RA, RCODE), and the four section counts (QDCOUNT/ANCOUNT/NSCOUNT/ARCOUNT). Names use length-prefixed labels with a compression pointer scheme.

wire-format kind wire-format status standard verification verified tier B wire-format@1

aka: DNS packet · DNS wire format · resource record message

wire format

spec: RFC 1035

12-byte header + Question/Answer/Authority/Additional sections. Resource records share a TYPE/CLASS/TTL/RDLENGTH/RDATA layout — RDLENGTH then RDATA is itself a length-value (TLV-like) framing. Domain names are sequences of length-prefixed labels ending in a zero-length root label; a label whose top two bits are 11 is a 14-bit offset compression pointer.

fieldsizemeaning
ID16 bitsTransaction identifier matching a response to its query.
Flags16 bitsQR (query/response), Opcode (4 bits), AA, TC (truncated), RD, RA, Z (3 bits), RCODE (4 bits, error code).
QDCOUNT16 bitsNumber of entries in the Question section.
ANCOUNT16 bitsNumber of resource records in the Answer section.
NSCOUNT16 bitsNumber of name-server resource records in the Authority section.
ARCOUNT16 bitsNumber of resource records in the Additional section.
Question sectionvariableQDCOUNT entries of QNAME (labels) + QTYPE (16 bits) + QCLASS (16 bits).
Answer / Authority / AdditionalvariableResource records: NAME + TYPE(16) + CLASS(16) + TTL(32) + RDLENGTH(16) + RDATA(RDLENGTH bytes).

example:

AA AA 01 00 00 01 00 00 00 00 00 00

ID 0xAAAA; flags 0x0100 = standard query, recursion desired (RD=1); QDCOUNT 1, ANCOUNT/NSCOUNT/ARCOUNT 0 — i.e. a recursive query with one question and no records yet.

see: dns-rrtype/AAAA


provenance

see also

agent: curl -H 'accept: application/json' wire.phall.io/wire-format/dns-message or /wire-format/dns-message.json