Encoded Names & Compression

DNS names are encoded as length-prefixed labels terminated by zero:

example.com  ->  07 65 78 61 6d 70 6c 65   03 63 6f 6d   00
                  e  x  a  m  p  l  e        c  o  m
                  ^                          ^             ^
                  length 7                   length 3      end

Each label is up to 63 bytes; total name up to 255 bytes.

Compression (RFC 1035): later occurrences of a name reuse earlier bytes via a pointer:

First:  example.com -> 07 ... 03 ... 00       (offset 12)
Later:  www.example.com -> 03 'w' 'w' 'w' c0 0c
                                              ^^^^^
                                              pointer: 0xC00C
                                              top 2 bits = 11 (pointer marker)
                                              remaining 14 bits = 0x000C = offset 12

So when you see a byte with top 2 bits set, it's a pointer to another offset in the SAME message. Resolve recursively (and watch for loops with malformed packets).

Pros: significant size savings — common suffixes appear once. Cons: parser complexity. Most DNS bugs come from compression handling.

For this lesson we just encode/decode names without compression.