The DNS Header (12 bytes)

Every DNS message starts with a fixed 12-byte header:

                    1  1  1  1  1  1
      0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                      ID                       |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |QR| Opcode  |AA|TC|RD|RA|   Z    |   RCODE     |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    QDCOUNT                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    ANCOUNT                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    NSCOUNT                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    ARCOUNT                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

Fields:

• ID (16 bits): client picks; server echoes. Match request to response.
• QR: 0=query, 1=response.
• Opcode: 0=standard query, 1=inverse, 2=status, ... (4=NOTIFY, 5=UPDATE).
• AA: authoritative answer flag.
• TC: truncated (UDP response > 512 bytes — try TCP).
• RD: recursion desired (client requests recursive resolution).
• RA: recursion available (server can recurse).
• RCODE: response code (0=success, 3=NXDOMAIN, 2=SERVFAIL, ...).
• QDCOUNT, ANCOUNT, NSCOUNT, ARCOUNT: section sizes.

All multi-byte fields are network byte order (big-endian).

After the header come 4 sections: Question(s), Answer(s), Authority, Additional.