DNS

DNS (the Domain Name System) is the internet's phone book: it turns a name a human can remember (www.example.com) into an address a machine can route to (93.184.216.34). This page is the wire protocol — the message on the network and the walk that resolves a name. For the Linux resolver internals (nsswitch, gethostbyname, dig, /etc/resolv.conf), see the DNS internals notes.

1 · One message, five sections

Every DNS query and every DNS response uses the same layout: a fixed 12-byte header, then four variable sections. The header's counts (QDCOUNT, ANCOUNT…) say how many entries each section holds. Zoom into the ⤢ boxes — especially the header Flags, where a single bit is the difference between a query and an answer.

2 · How a name gets resolved

Your stub resolver asks a recursive resolver to "just get me the answer" (that's the RD bit). The resolver then walks the tree from the top, following referrals down: root tells it who runs .com, .com tells it who runs example.com, and the authoritative server finally answers. Step through it — and note the resolver caches the result, so the next lookup skips the whole walk.

dig +trace example.com shows exactly this walk from your own machine — each referral on its own line.

3 · Record types

The TYPE field selects what kind of data a record carries. A handful cover almost everything you'll meet:

4 · Response codes (RCODE)

The 4-bit RCODE in the header flags tells you how the query went:

5 · Transport: UDP, then TCP, then encrypted

DNS was built on UDP port 53 — one small datagram out, one back, no connection setup. But a datagram is limited, so DNS has escape hatches, and modern DNS wraps the whole thing in encryption.