Skip to main content

DNS request/response structure

Short answer

DNS messages have a 12-byte header (ID, flags, counts) followed by question, answer, authority, and additional sections. Flags indicate query/response, recursion, and error codes. Example: query for www.example.com A record returns answer with IP 93.184.216.34 and TTL 3600. Tools like dig display this exchange.

What is DNS? Explain the structure of DNS request and response with a practical example.

DNS (Domain Name System) is the distributed, hierarchical naming system that maps domain names to IP addresses. A request and its response use the same message format, carried in a UDP datagram on port 53.

DNS message structure

+----------------+----------------------+
| Identification | Flags                |  12-byte
+----------------+----------------------+  header
| # Questions    | # Answer RRs         |
+----------------+----------------------+
| # Authority RRs| # Additional RRs     |
+----------------+----------------------+
| Question section (name, type, class)  |
| Answer section (resource records)     |
| Authority section (NS records)        |
| Additional section (extra records)    |
+---------------------------------------+
  • Identification (16 bits): matches a response with its query.
  • Flags (16 bits): QR (0 query, 1 response), Opcode, AA (authoritative answer), TC (truncated), RD (recursion desired), RA (recursion available), RCODE (0 no error, 3 name does not exist).
  • Counts: number of entries in each following section.
  • Question: the name queried, type (A, MX ...) and class (IN).
  • Answer / Authority / Additional: resource records (name, type, class, TTL, length, data).

Practical example: resolving www.example.com

Query (client to resolver):

ID = 0xABCD   QR=0  RD=1
Questions = 1
Question: www.example.com  Type=A  Class=IN

Response:

ID = 0xABCD   QR=1  AA=0  RD=1  RA=1  RCODE=0
Questions = 1, Answers = 1
Question: www.example.com  A  IN
Answer  : www.example.com  A  IN  TTL=3600  93.184.216.34

The client matches the ID, takes the IP address, and connects to the web server. The resolver caches the answer for 3600 s. The command nslookup www.example.com or dig www.example.com shows this exchange.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Computer Networks and Security chapter 6 questions →