Reading — step 1 of 5
Read
~1 min readDNS Wire Format
Question Section
After the header, the Question section holds (typically) ONE question:
+----------+
| QNAME | encoded name (variable length)
+----------+
| QTYPE | 16-bit type
+----------+
| QCLASS | 16-bit class (almost always IN = 1)
+----------+
Common QTYPE values:
| Type | Number | Meaning |
|---|---|---|
| A | 1 | IPv4 address |
| NS | 2 | name server |
| CNAME | 5 | canonical alias |
| SOA | 6 | start of authority |
| PTR | 12 | reverse lookup (IP -> name) |
| MX | 15 | mail exchanger |
| TXT | 16 | arbitrary text (often verification) |
| AAAA | 28 | IPv6 address |
| SRV | 33 | service location |
| ANY | 255 | any (deprecated; many resolvers reject) |
QCLASS is almost always IN (Internet, value 1). The other classes (CH/Chaos, HS/Hesiod) are historical curiosities.
Multiple questions (QDCOUNT > 1) are allowed by the spec but unsupported in practice — every implementation expects exactly one question per query.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…