decoder.tools

DNS Record Decoder

Parse DNS wire messages and resource records into readable fields.

Network, System & PacketsFree
INPUT

Or drop a file here: a .bin DNS message (skip the UDP/IP headers)

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A DNS record decoder parses the binary wire format of a DNS query or response into its header flags, question section and resource records, resolving type codes and expanding compressed domain names.

Example

Input
123481800001000100000000076578616d706c6503636f6d0000010001076578616d706c6503636f6d00000100010000012c00045db8d822076578616d706c6503636f6d00000f00010000012c00106d61696c2e6578616d706c652e636f6d
Output
;; QUESTION
example.com	IN	A
;; ANSWER
example.com	300	IN	A	93.184.216.34
Transaction ID: 0x1234
Type: Response
Opcode: QUERY
Flags: RD RA
Response code: NOERROR
Counts: 1 question, 1 answer, 0 authority, 0 additional

What is the DNS Record Decoder?

A DNS message has a 12-byte header followed by four sections: question, answer, authority and additional. The header carries the transaction ID and the flag bits — QR (query or response), AA (authoritative answer), TC (truncated), RD/RA (recursion desired and available) and the RCODE, where 0 means success, 2 is SERVFAIL and 3 is NXDOMAIN.

Domain names on the wire use length-prefixed labels and a compression scheme where a pointer with the top two bits set refers back to an earlier offset. It saves space and makes hand-parsing a message awkward, since a name can be split across the packet.

The record types you meet daily are A and AAAA (addresses), CNAME (alias), MX (mail, with a preference value), NS (delegation), TXT (SPF, DKIM and domain verification), SOA (zone parameters, including the negative-caching TTL) and CAA (which CAs may issue certificates for the domain).

How to use the DNS Record Decoder

  1. Paste the DNS message bytes as hex, or a single resource record.
  2. Read the header flags and RCODE first — they explain most failures.
  3. Check the record type, TTL and data of each answer.

When to use it

  • Diagnosing a resolution failure from a packet capture rather than a resolver's summary.
  • Confirming what a DNS server actually returned, TTLs included.
  • Learning the wire format behind dig's readable output.

DNS Record Decoder at a glance

Header12 bytes: ID, flags, four section counts
RCODE0 NOERROR · 2 SERVFAIL · 3 NXDOMAIN · 5 REFUSED
UDP limit512 bytes without EDNS0; TC flag then forces TCP
Name compressionPointer with the top two bits set (0xC0)

Frequently asked questions

What does NXDOMAIN mean?

RCODE 3: the queried name does not exist. It is different from an empty answer, which means the name exists but has no record of the requested type.

Why is my DNS response truncated?

It exceeded the UDP size limit, so the server set the TC flag and the resolver must retry over TCP. EDNS0 raises the UDP limit and avoids most retries.

What is DNS name compression?

A pointer scheme that lets a repeated domain name be referenced by its earlier offset in the message instead of being written again — space-efficient, but it means names can't be read linearly.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown