A. DNS Message Format and Resource Records

Contents:
Master File Format
DNS Message
Header Section Format
Resource Record Data

This appendix outlines the format of DNS messages and enumerates all the resource record types. The resource records are shown in their textual format, as you would specify them in a DNS database file, and in their binary format, as they appear in DNS messages. You'll find a few resource records here that we didn't cover in the book because they are experimental or obsolete.

We've included here the portions of RFC 1035, written by Paul Mockapetris, that deal with the textual format of master files (what we called db files or DNS database files in the book) or with the DNS message format (for those of you who need to parse DNS packets).

A.1 Master File Format

(From RFC 1035, pages 33-35)

The format of these files is a sequence of entries. Entries are predominantly line-oriented, though parentheses can be used to continue a list of items across a line boundary, and text literals can contain CRLF within the text. Any combination of tabs and spaces acts as a delimiter between the separate items that make up an entry. The end of any line in the master file can end with a comment. The comment starts with a ";".

The following entries are defined:

blank[comment]

$ORIGIN domain-name [comment]

$INCLUDE file-name [domain-name] [comment]

domain-namerr [comment]

blankrr [comment]

Blank lines, with or without comments, are allowed anywhere in the file.

Two control entries are defined: $ORIGIN and $INCLUDE. $ORIGIN is followed by a domain name, and resets the current origin for relative domain names to the stated name. $INCLUDE inserts the named file into the current file, and may optionally specify a domain name that sets the relative domain name origin for the included file. $INCLUDE may also have a comment. Note that an $INCLUDE entry never changes the relative origin of the parent file, regardless of changes to the relative origin made within the included file.

The last two forms represent RRs. If an entry for an RR begins with a blank, then the RR is assumed to be owned by the last stated owner. If an RR entry begins with a domain-name, then the owner name is reset.

rr contents take one of the following forms:

[TTL] [class] type RDATA
[class] [TTL] type RDATA

The RR begins with optional TTL and class fields, followed by a type and RDATA field appropriate to the type and class. Class and type use the standard mnemonics; TTL is a decimal integer. Omitted class and TTL values are default to the last explicitly stated values. Since type and class mnemonics are disjoint, the parse is unique.

domain-names make up a large share of the data in the master file. The labels in the domain name are expressed as character strings and separated by dots. Quoting conventions allow arbitrary characters to be stored in domain names. Domain names that end in a dot are called absolute, and are taken as complete. Domain names which do not end in a dot are called relative; the actual domain name is the concatenation of the relative part with an origin specified in an $ORIGIN, $INCLUDE, or as an argument to the master file-loading routine. A relative name is an error when no origin is available.

character-string is expressed in one of two ways: as a contiguous set of characters without interior spaces, or as a string beginning with a " and ending with a ". Inside a "-delimited string any character can occur, except for a " itself, which must be quoted using a backslash ("\").

Because these files are text files, several special encodings are necessary to allow arbitrary data to be loaded. In particular:

.: Of the root.
@: A free-standing @ is used to denote the current origin.
\X: Where X is any character other than a digit (0-9), is used to quote that character so that its special meaning does not apply. For example, "\." can be used to place a dot character in a label.[1]
[1] Not implemented by BIND 4.8.3.
\DDD: Where each D is a digit is the octet corresponding to the decimal number described by DDD. The resulting octet is assumed to be text and is not checked for special meaning.[2]
[2] Not implemented by BIND 4.8.3.
( ): Parentheses are used to group data that crosses a line boundary. In effect, line terminations are not recognized within parentheses.[3]
[3] BIND 4.8.3 allows parentheses only on SOA and WKS resource records.
;: Semicolon is used to start a comment; the remainder of the line is ignored.

A.1.1 Character Case

(From RFC 1035, page 9)

For all parts of the DNS that are part of the official protocol, all comparisons between character strings (e.g., labels, domain names, etc.) are done in a case-insensitive manner. At present, this rule is in force throughout the domain system without exception. However, future additions beyond current usage may need to use the full binary octet capabilities in names, so attempts to store domain names in 7-bit ASCII or use of special bytes to terminate labels, etc., should be avoided.

A.1.2 Types

Here is a complete list of resource record types. The textual representation is used in master files. The binary representation is used in DNS queries and responses. These resource records are described on pages 13-21 of RFC 1035.

A.1.2.1 A address

(From RFC 1035, page 20)

Textual Representation:

owner class ttl A address

Example:

localhost.movie.edu.   IN A 127.0.0.1

Binary Representation:

Address type code: 1
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    ADDRESS                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
ADDRESS         A 32 bit Internet address.

A.1.2.2 CNAME canonical name

(From RFC 1035, page 14)

Textual Representation:

owner class ttl CNAME canonical-dname

Example:

wh.movie.edu.  IN  CNAME  wormhole.movie.edu.

Binary Representation:

CNAME type code: 5
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                     CNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
CNAME           A domain-name which specifies the canonical
                or primary name for the owner.  The owner name is
                an alias.

A.1.2.3 HINFO host information

(From RFC 1035, page 14)

Textual Representation:

owner class ttl HINFO cpu os

Example:

grizzly.movie.edu.  IN  HINFO  VAX-11/780 UNIX

Binary Representation:

HINFO type code: 13
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                      CPU                      /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                       OS                      /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
CPU             A character-string which specifies the CPU type.
OS              A character-string which specifies the
                operating system type.

A.1.2.4 MB mailbox domain name - experimental

(From RFC 1035, page 14)

Textual Representation:

owner class ttl MB mbox-dname

Example:

al.movie.edu.  IN  MB  robocop.movie.edu.

Binary Representation:

MB type code: 7
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   MADNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
MADNAME         A domain-name which specifies a host which has
                the specified mailbox.

A.1.2.5 MD mail destination - obsolete

MD has been replaced with MX.

A.1.2.6 MF mail forwarder - obsolete

MF has been replaced with MX.

A.1.2.7 MG mail group member - experimental

(From RFC 1035, page 16)

Textual Representation:

owner class ttl MG mgroup-dname

Example:

admin.movie.edu.  IN  MG  al.movie.edu.
                      IN  MG  ed.movie.edu.
                      IN  MG  jc.movie.edu.

Binary Representation:

MG type code: 8
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   MGMNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
MGMNAME         A domain-name which specifies a mailbox which
                is a member of the mail group specified by the
                domain name.

A.1.2.8 MINFO mailbox or mail list information - experimental

(From RFC 1035, page 16)

Textual Representation:

owner class ttl MINFO resp-mbox error-mbox

Example:

admin.movie.edu.  IN  MINFO  al.movie.edu. al.movie.edu.

Binary Representation:

MINFO type code: 14
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    RMAILBX                    /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    EMAILBX                    /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
RMAILBX         A domain-name which specifies a mailbox which
                is responsible for the mailing list or mailbox.
                If this domain name names the root, the owner of
                the MINFO RR is responsible for itself.  Note
                that many existing mailing lists use a mailbox
                X-request for the RMAILBX field of mailing list
                X, e.g., Msgroup-request for Msgroup.  This field
                provides a more general mechanism.
EMAILBX         A domain-name which specifies a mailbox which is
                to receive error messages related to the mailing
                list or mailbox specified by the owner of the
                MINFO RR (similar to the ERRORS-TO: field which has
                been proposed). If this domain name names the root,
                errors should be returned to the sender of the
                message.

A.1.2.9 MR mail rename - experimental

(From RFC 1035, page 17)

Textual Representation:

owner class ttl MR new-mbox

Example:

eddie.movie.edu.  IN  MR  eddie.bornagain.edu.

Binary Representation:

MR type code: 9
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   NEWNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
NEWNAME         A domain-name which specifies a mailbox which
                is the proper rename of the specified mailbox.

A.1.2.10 MX mail exchanger

(From RFC 1035, page 17)

Textual Representation:

owner class ttl MX preference exchange-dname

Example:

ora.com.  IN  MX  0  ora.ora.com.
          IN  MX  10 ruby.ora.com.
          IN  MX  10 opal.ora.com.

Binary Representation:

MX type code: 15
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                  PREFERENCE                   |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   EXCHANGE                    /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
PREFERENCE      A 16 bit integer which specifies the preference
                given to this RR among others at the same owner.
                Lower values are preferred.
EXCHANGE        A domain-name which specifies a host willing
                to act as a mail exchange for the owner name.

A.1.2.11 NS name server

(From RFC 1035, page 18)

Textual Representation:

owner class ttl NS name-server-dname

Example:

movie.edu.     IN NS terminator.movie.edu

Binary Representation:

NS type code: 1
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   NSDNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
NSDNAME         A domain-name which specifies a host which
                should be authoritative for the specified
                class and domain.

A.1.2.12 NULL null - experimental

(From RFC 1035, page 17)

Binary Representation:

NULL type code: 10
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                  anything               /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
Anything at all may be in the RDATA field so long as it is 65535
octets or less.

NULL is not implemented by BIND.

A.1.2.13 PTR pointer

(From RFC 1035, page 18)

Textual Representation:

owner class ttl PTR dname

Example:

1.249.249.192.in-addr.arpa.  IN PTR wormhole.movie.edu.

Binary Representation:

PTR type code: 12
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   PTRDNAME                    /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
PTRDNAME        A domain-name which points to some location in
                the domain name space.

A.1.2.14 SOA start of authority

(From RFC 1035, pages 19-20)

Textual Representation:

owner class ttl SOA source-dname mbox (
        serial refresh retry expire minimum )

Example:

movie.edu. IN SOA terminator.movie.edu. al.robocop.movie.edu. (
                      1        ; Serial
                      10800    ; Refresh after 3 hours
                      3600     ; Retry after 1 hour
                      604800   ; Expire after 1 week
                      86400 )  ; Minimum TTL of 1 day

Binary Representation:

SOA type code: 6
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                     MNAME                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                     RNAME                     /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    SERIAL                     |
    |                                               |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    REFRESH                    |
    |                                               |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                     RETRY                     |
    |                                               |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    EXPIRE                     |
    |                                               |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    MINIMUM                    |
    |                                               |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
MNAME           The domain-name of the name server that was the
                original or primary source of data for this zone.
RNAME           A domain-name which specifies the mailbox of the
                person responsible for this zone.
SERIAL          The unsigned 32 bit version number of the original
                copy of the zone.  Zone transfers preserve this
                value.  This value wraps and should be compared
                using sequence space arithmetic.
REFRESH         A 32 bit time interval before the zone should be
                refreshed.
RETRY           A 32 bit time interval that should elapse before
                a failed refresh should be retried.
EXPIRE          A 32 bit time value that specifies the upper limit
                on the time interval that can elapse before the
                zone is no longer authoritative.
MINIMUM         The unsigned 32 bit minimum TTL field that should
                be exported with any RR from this zone.

A.1.2.15 TXT text

(From RFC 1035, page 20)

Textual Representation:

owner class ttl TXT txt-strings

Example:

cujo.movie.edu.  IN  TXT  "Location: machine room dog house"

Binary Representation:

TXT type code: 16
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   TXT-DATA                    /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
TXT-DATA        One or more character-strings.

A.1.2.16 WKS well-known services

(From RFC 1035, page 21)

Textual Representation:

owner class ttl WKS address protocol service-list

Example:

terminator.movie.edu.  IN  WKS 192.249.249.3  TCP ( telnet smtp
                                              ftp shell domain )

Binary Representation:

WKS type code: 11
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                    ADDRESS                    |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |       PROTOCOL        |                       |
    +--+--+--+--+--+--+--+--+                       |
    |                                               |
    /                   BIT MAP               /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
ADDRESS         An 32 bit Internet address
PROTOCOL        An 8 bit IP protocol number
BIT MAP       A variable length bit map.  The bit map must
                be a multiple of 8 bits long.

A.1.3 New Types from RFC 1183

A.1.3.1 AFSDB Andrew File System Data Base - experimental

Textual Representation:

owner ttl class AFSDB subtype hostname

Example:

fx.movie.edu.  IN  AFSDB  1 bladerunner.fx.movie.edu.
               IN  AFSDB  2 bladerunner.fx.movie.edu.
               IN  AFSDB  1 empire.fx.movie.edu.
               IN  AFSDB  2 aliens.fx.movie.edu.

Binary Representation:

AFSDB type code: 18
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                   SUBTYPE                     |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   HOSTNAME                    /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
SUBTYPE         Subtype 1 is an AFS cell database server. Subtype 2
                is a DCE authenticated name server.
HOSTNAME        A domain-name which specifies a host that has a
                server for the cell named by the owner of the RR.

A.1.3.2 ISDN Integrated Services Digital Network address - experimental

Textual Representation:

owner ttl class ISDN ISDN-address sa

Example:

delay.hp.com.    IN  ISDN  141555514539488
hep.hp.com.      IN  ISDN  141555514539488 004

Binary Representation:

ISDN type code: 20
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                 ISDN ADDRESS                  /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                  SUBADDRESS                   /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
ISDN ADDRESS    A character-string which identifies the ISDN number
                of owner and DDI (Direct Dial In) if any.
SUBADDRESS      An optional character-string specifying the
                subaddress.

A.1.3.3 RP Responsible Person - experimental

Textual Representation:

owner ttl class RP mbox-dname txt-dname

Example:

; The current origin is fx.movie.edu
@            IN  RP   ajs.fx.movie.edu.   ajs.fx.movie.edu.
bladerunner  IN  RP   root.fx.movie.edu.  hotline.fx.movie.edu.
             IN  RP   richard.fx.movie.edu.  rb.fx.movie.edu.
ajs          IN  TXT  "Arty Segue, (415) 555-3610"
hotline      IN  TXT  "Movie U. Network Hotline, (415) 555-4111"
rb           IN  TXT  "Richard Boisclair, (415) 555-9612"

Binary Representation:

RP type code: 17
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    MAILBOX                    /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    TXTDNAME                   /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
MAILBOX         A domain-name that specifies the mailbox for
                the responsible person.
TXTDNAME        A domain-name for which TXT RR's exist.  A
                subsequent query can be performed to retrieve
                the associated TXT resource records at
                txt-dname

A.1.3.4 RT Route Through - experimental

Textual Representation:

owner ttl class RT preference intermediate-host

Example:

sh.prime.com.  IN  RT  2   Relay.Prime.COM.
               IN  RT  10  NET.Prime.COM.

Binary Representation:

RT type code: 21
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                  PREFERENCE                   |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                 INTERMEDIATE                  /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
PREFERENCE      A 16 bit integer which specifies the preference
                given to this RR among others at the same owner.
                Lower values are preferred.
EXCHANGE        A domain-name which specifies a host which will
                serve as an intermediate in reaching the host
                specified by owner.

A.1.3.5 X25 X.25 address - experimental

Textual Representation:

owner ttl class X25 PSDN-address

Example:

relay.pink.com.  IN  X25   31105060845

Binary Representation:

X25 type code: 19
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                 PSDN ADDRESS                  /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
PSDN ADDRESS    A character-string which identifies the PSDN
                (Public Switched Data Network) address in the
                X.121 numbering plan associated with owner.

A.1.4 New Types from RFC 1664

A.1.4.1 PX pointer to X.400/RFC 822 mapping information

Textual Representation:

owner ttl class PX preference RFC822 address X.400 address

Example:

ab.net2.it.  IN  PX  10   ab.net2.it.  O-ab.PRMD-net2.ADMDb.C-it.

Binary Representation:

 PX type code: 26
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    |                  PREFERENCE                   |
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    MAP822                     /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                    MAPX400                    /
    /                                               /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
where:
PREFERENCE   A 16 bit integer which specifies the preference given to
             this RR among others at the same owner.  Lower values
             are preferred.
MAP822       A domain-name element containing rfc822-domain, the
             RFC 822 part of the RFC 1327 mapping information.
MAPX400      A domain-name element containing the value of
             x400-in-domain-syntax derived from the X.400 part of
             the RFC 1327 mapping information.

A.1.5 Classes

(From RFC 1035, page 13)

CLASS fields appear in resource records. The following CLASS mnemonics and values are defined:

IN: 1 the Internet
CS: 2 the CSNET class (obsolete - used only for examples in some obsolete RFCs)
CH: 3 the CHAOS class
HS: 4 the Hesiod class