What does NXDOMAIN mean?

RCODE 3: the queried name does not exist. It is different from an empty answer, which means the name exists but has no record of the requested type.

Why is my DNS response truncated?

It exceeded the UDP size limit, so the server set the TC flag and the resolver must retry over TCP. EDNS0 raises the UDP limit and avoids most retries.

What is DNS name compression?

A pointer scheme that lets a repeated domain name be referenced by its earlier offset in the message instead of being written again — space-efficient, but it means names can't be read linearly.

DNS Record Decoder

Parse DNS wire messages and resource records into readable fields.

on the roadmapNetwork, System & Packetsfree · no sign-up

This bench is being wired up

The dns-record-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the DNS Record Decoder?

A DNS record decoder parses the binary wire format of a DNS query or response into its header flags, question section and resource records, resolving type codes and expanding compressed domain names.

A DNS message has a 12-byte header followed by four sections: question, answer, authority and additional. The header carries the transaction ID and the flag bits — QR (query or response), AA (authoritative answer), TC (truncated), RD/RA (recursion desired and available) and the RCODE, where 0 means success, 2 is SERVFAIL and 3 is NXDOMAIN.

Domain names on the wire use length-prefixed labels and a compression scheme where a pointer with the top two bits set refers back to an earlier offset. It saves space and makes hand-parsing a message awkward, since a name can be split across the packet.

The record types you meet daily are A and AAAA (addresses), CNAME (alias), MX (mail, with a preference value), NS (delegation), TXT (SPF, DKIM and domain verification), SOA (zone parameters, including the negative-caching TTL) and CAA (which CAs may issue certificates for the domain).

DNS Record Decoder at a glance

Header: 12 bytes: ID, flags, four section counts
RCODE: 0 NOERROR · 2 SERVFAIL · 3 NXDOMAIN · 5 REFUSED
UDP limit: 512 bytes without EDNS0; TC flag then forces TCP
Name compression: Pointer with the top two bits set (0xC0)

How to use the DNS Record Decoder

1Paste the DNS message bytes as hex, or a single resource record.
2Read the header flags and RCODE first — they explain most failures.
3Check the record type, TTL and data of each answer.

When you would reach for it

Diagnosing a resolution failure from a packet capture rather than a resolver's summary.
Confirming what a DNS server actually returned, TTLs included.
Learning the wire format behind dig's readable output.

DNS Record Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools