A Deep Dive into how the DNS Protocol Works

Updated: Oct 19, 2026

 
pkg search tcpdump
pkg install tcpdump-4.99.6

pkg search socat
pkg install socat-1.8.1.3

dig -4 @127.0.0.1 -t soa google.com

dig -4 +trace -t soa google.com


man dig
man tcpdump
man socat

 

DNS Payload

 

Query in HEX

 2f 36 01 00 00 01 00 00 00 00 00 00 06 67 6f 6f 67 6c 65 03 63 6f 6d 00 00 06 00 01

Header
 ID      | 2f 36 | |00101111 00110110| 12086
 OPFLAGS | 01 00 | | 0| 0000 | 0| 0| 1| 0|000| 0000|
                   |QR|OPCODE|AA|TC|RD|RA| Z |RCODE|
 QCOUNT  | 00 01 | |00000000 00000001|
 ACOUNT  | 00 00 | |00000000 00000000|
 NSCOUNT | 00 00 | |00000000 00000000|
 ARCOUNT | 00 00 | |00000000 00000000|

Question Section

 QNAME   | 06 67 6f 6f 67 6c 65 03 63 6f 6d 00 | 
         |  6  g  o  o  g  l  e  3  c  o  m  0 | 
 QTYPE   | 00 06 | |00000000 00000110| | SOA
 QCLASS  | 00 01 | |00000000 00000001| | IN 

Operational Codes (OPCODE) 4 bits
 0000 Standard query
 0001 Inverse query(Deprecated)
 0010 Status
 0100 Notify
 0101 Update

Response Codes (RCODE) Orignially 4 bits (Extended Response codes bled in to Z(padding) bits)
 0000  NoError   No Error
 0001  FormErr   Format Error
 0010  ServFail  Server Failure
 0011  NXDomain  Non-Existent Domain
 0100  NotImp    Not Implemented
 0101  Refused   Query Refused
 0110  YXDomain  Name Exists when it should not
 0111  YXRRSet   RR Set Exists when it should not
 1000  NXRRSet   RR Set that should exist does not
 1001  NotAuth   Server Not Authoritative for zone
 1010  NotZone   Name not contained in zone

Extended response codes
 1 0000  BADSIG    TSIG Signature Failure
 1 0001  BADKEY    Key not recognized
 1 0010  BADTIME   Signature out of time window
 1 0011  BADMODE   Bad TKEY Mode
 1 0100  BADNAME   Duplicate key name
 1 0101  BADALG    Algorithm not supported


Common Query Types in Hex
 A (Address Record (IPv4)) - 00 01
 NS (Name Server Record) - 00 02
 CNAME (Canonical Name Record)- 00 05
 SOA (Start Of Authority Record)- 00 06
 PTR (Pointer Record) - 00 0c
 MX (Mail eXchange Record) - 00 0f
 TXT (Text Record) - 00 10
 AAAA (IPv6 Address Record) - 00 1c
 SRV (Service Record) - 00 21
 HINFO (Host Information Record) - 00 0d
 RP (Responsible Party Record) - 00 11
 LOC (Location Record) - 00 1d
 APL (Address Prefix List Record) - 00 2a
 SVCB (Service Binding Record)- 00 40
 HTTPS (Service Binding Record for HTTP) - 00 41
 SPF (Sender Policy Framework Record (Obsolete use TXT)) - 00 63
 AXFR (Zone Transfer All) - 00 fc
 IXFR (Zone Transfer Incremental) - 00 fb
 CAA (Certificate Authority Authorization Record) - 01 01





 echo -n "2f360100000100000000000006676f6f676c6503636f6d0000060001" | xxd -r -p | base64

 LzYBAAABAAAAAAAABmdvb2dsZQNjb20AAAYAAQ==

 echo -n "LzYBAAABAAAAAAAABmdvb2dsZQNjb20AAAYAAQ==" | base64 --decode | socat -x - UDP:127.0.0.1:53 | hexdump -e '1/1 " %02X"'

 dig @127.0.0.1 +qid=12086 -t soa google.com

 tcpdump -nn -i ena0 udp port 53 -w dns1.pcap
 tcpdump -nn -r dns1.pcap