Field Name

Size (bytes)

Description

ID

2

Identifier: A 16-bit identification field generated by the device that creates the DNS query. It is copied by the server into the response, so it can be used by that device to match that query to the corresponding reply received from a DNS server. This is used in a manner similar to how the Identifier field is used in many of the ICMP message types.

QR

1/8
(1 bit)

Query/Response Flag: Differentiates between queries and responses. Set to 0 when the query is generated; changed to 1 when that query is changed to a response by a replying server.

Opcode

1/2
(4 bits)

AA

1/8
(1 bit)

Authoritative Answer Flag: This bit is set to 1 in a response to indicate that the server that created the response is authoritative for the zone in which the domain name specified in the Question section is located. If it is 0, the response is non-authoritative.

TC

1/8
(1 bit)

Truncation Flag: When set to 1, indicates that the message was truncated due to its length being longer than the maximum permitted for the type of transport mechanism used. TCP doesn't have a length limit for messages, while UDP messages are limited to 512 bytes, so this bit being sent usually is an indication that the message was sent using UDP and was too long to fit. The client may need to establish a TCP session to get the full message. On the other hand, if the portion truncated was part of the Additional section, it may choose not to bother.

RD

1/8
(1 bit)

Recursion Desired: When set in a query, requests that the server receiving the query attempt to answer the query recursively, if the server supports recursive resolution. The value of this bit is not changed in the response.

RA

1/8
(1 bit)

Recursion Available: Set to 1 or cleared to 0 in a response to indicate whether the server creating the response supports recursive queries. This can then be noted by the device that sent the query for future use.

Z

3/8
(3 bits)

Zero: Three reserved bits set to zero.

RCode

1/2
(4 bits)

QDCount

2

Question Count: Specifies the number of questions in the Question section of the message.

ANCount

2

Answer Record Count: Specifies the number of resource records in the Answer section of the message.

NSCount

2

Authority Record Count: Specifies the number of resource records in the Authority section of the message. (“NS” stands for “name server”, of course. J)

ARCount

2

Additional Record Count: Specifies the number of resource records in the Additional section of the message.