A. DNS Message Format and Resource Records

Contents:
Master File Format
DNS Message
Header Section Format
Resource Record Data

This appendix outlines the format of DNS messages and enumerates all the resource record types. The resource records are shown in their textual format, as you would specify them in a DNS database file, and in their binary format, as they appear in DNS messages. You'll find a few resource records here that we didn't cover in the book because they are experimental or obsolete.

We've included here the portions of RFC 1035, written by Paul Mockapetris, that deal with the textual format of master files (what we called db files or DNS database files in the book) or with the DNS message format (for those of you who need to parse DNS packets).

A.1 Master File Format

(From RFC 1035, pages 33-35)

The format of these files is a sequence of entries. Entries are predominantly line-oriented, though parentheses can be used to continue a list of items across a line boundary, and text literals can contain CRLF within the text. Any combination of tabs and spaces acts as a delimiter between the separate items that make up an entry. The end of any line in the master file can end with a comment. The comment starts with a ";".

The following entries are defined:



blank

[

comment

]  $ORIGIN 

domain-name

 [

comment

]  $INCLUDE 

file-name

 [

domain-name

] [

comment

]  

domain-name



rr

 [

comment

]  

blank



rr

 [

comment

]

Blank lines, with or without comments, are allowed anywhere in the file.

Two control entries are defined: $ORIGIN and $INCLUDE . $ORIGIN is followed by a domain name, and resets the current origin for relative domain names to the stated name. $INCLUDE inserts the named file into the current file, and may optionally specify a domain name that sets the relative domain name origin for the included file. $INCLUDE may also have a comment. Note that an $INCLUDE entry never changes the relative origin of the parent file, regardless of changes to the relative origin made within the included file.

The last two forms represent RRs. If an entry for an RR begins with a blank, then the RR is assumed to be owned by the last stated owner. If an RR entry begins with a domain-name , then the owner name is reset.

rr contents take one of the following forms:

[

TTL

] [

class

] 

type

 

RDATA

 [

class

] [

TTL

] 

type

 

RDATA

The RR begins with optional TTL and class fields, followed by a type and RDATA field appropriate to the type and class. Class and type use the standard mnemonics; TTL is a decimal integer. Omitted class and TTL values are default to the last explicitly stated values. Since type and class mnemonics are disjoint, the parse is unique.

domain-name s make up a large share of the data in the master file. The labels in the domain name are expressed as character strings and separated by dots. Quoting conventions allow arbitrary characters to be stored in domain names. Domain names that end in a dot are called absolute, and are taken as complete. Domain names which do not end in a dot are called relative; the actual domain name is the concatenation of the relative part with an origin specified in an $ORIGIN , $INCLUDE , or as an argument to the master file-loading routine. A relative name is an error when no origin is available.

character-string is expressed in one of two ways: as a contiguous set of characters without interior spaces, or as a string beginning with a " and ending with a ". Inside a "-delimited string any character can occur, except for a " itself, which must be quoted using a backslash ("\").

Because these files are text files, several special encodings are necessary to allow arbitrary data to be loaded. In particular:

.: Of the root.
@: A free-standing @ is used to denote the current origin.
\X: Where X is any character other than a digit (0-9), is used to quote that character so that its special meaning does not apply. For example, "\." can be used to place a dot character in a label.[1]

[1] Not implemented by BIND 4.8.3.
\DDD: Where each D is a digit is the octet corresponding to the decimal number described by DDD. The resulting octet is assumed to be text and is not checked for special meaning.[2]

[2] Not implemented by BIND 4.8.3.
( ): Parentheses are used to group data that crosses a line boundary. In effect, line terminations are not recognized within parentheses.[3]

[3] BIND 4.8.3 allows parentheses only on SOA and WKS resource records.
;: Semicolon is used to start a comment; the remainder of the line is ignored.

A.1.1 Character Case

(From RFC 1035, page 9)

For all parts of the DNS that are part of the official protocol, all comparisons between character strings (e.g., labels, domain names, etc.) are done in a case-insensitive manner. At present, this rule is in force throughout the domain system without exception. However, future additions beyond current usage may need to use the full binary octet capabilities in names, so attempts to store domain names in 7-bit ASCII or use of special bytes to terminate labels, etc., should be avoided.

A.1.2 Types

Here is a complete list of resource record types. The textual representation is used in master files. The binary representation is used in DNS queries and responses. These resource records are described on pages 13-21 of RFC 1035.

A.1.2.1 A address

(From RFC 1035, page 20)

Textual Representation:



owner

 

class

 

ttl

 A 

address

Example:

localhost.movie.edu.   IN A 127.0.0.1

Binary Representation:

Address type code: 1     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    ADDRESS                    |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: ADDRESS         A 32 bit Internet address.

A.1.2.2 CNAME canonical name

(From RFC 1035, page 14)

Textual Representation:



owner

 

class

 

ttl

 CNAME 

canonical-dname

Example:

wh.movie.edu.  IN  CNAME  wormhole.movie.edu.

Binary Representation:

CNAME type code: 5     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                     CNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: CNAME           A 

domain-name

 which specifies the canonical                 or primary name for the owner.  The owner name is                 an alias.

A.1.2.3 HINFO host information

(From RFC 1035, page 14)

Textual Representation:



owner

 

class

 

ttl

 HINFO 

cpu

 

os

Example:

grizzly.movie.edu.  IN  HINFO  VAX-11/780 UNIX

Binary Representation:

HINFO type code: 13     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                      CPU                      /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                       OS                      /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: CPU             A 

character-string

 which specifies the CPU type. OS              A 

character-string

 which specifies the                 operating system type.

A.1.2.4 MB mailbox domain name - experimental

(From RFC 1035, page 14)

Textual Representation:



owner

 

class

 

ttl

 MB 

mbox-dname

Example:

al.movie.edu.  IN  MB  robocop.movie.edu.

Binary Representation:

MB type code: 7     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   MADNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: MADNAME         A 

domain-name

 which specifies a host which has                 the specified mailbox.

A.1.2.5 MD mail destination - obsolete

MD has been replaced with MX.

A.1.2.6 MF mail forwarder - obsolete

MF has been replaced with MX.

A.1.2.7 MG mail group member - experimental

(From RFC 1035, page 16)

Textual Representation:



owner

 

class

 

ttl

 MG 

mgroup-dname

Example:

admin.movie.edu.  IN  MG  al.movie.edu.                       IN  MG  ed.movie.edu.                       IN  MG  jc.movie.edu.

Binary Representation:

MG type code: 8     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   MGMNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: MGMNAME         A 

domain-name

 which specifies a mailbox which                 is a member of the mail group specified by the                 domain name.

A.1.2.8 MINFO mailbox or mail list information - experimental

(From RFC 1035, page 16)

Textual Representation:



owner

 

class

 

ttl

 MINFO 

resp-mbox

 

error-mbox

Example:

admin.movie.edu.  IN  MINFO  al.movie.edu. al.movie.edu.

Binary Representation:

MINFO type code: 14     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    RMAILBX                    /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    EMAILBX                    /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: RMAILBX         A 

domain-name

 which specifies a mailbox which                 is responsible for the mailing list or mailbox.                 If this domain name names the root, the owner of                 the MINFO RR is responsible for itself.  Note                 that many existing mailing lists use a mailbox                 X-request for the RMAILBX field of mailing list                 X, e.g., Msgroup-request for Msgroup.  This field                 provides a more general mechanism. EMAILBX         A 

domain-name

 which specifies a mailbox which is                 to receive error messages related to the mailing                 list or mailbox specified by the owner of the                 MINFO RR (similar to the ERRORS-TO: field which has                 been proposed). If this domain name names the root,                 errors should be returned to the sender of the                 message.

A.1.2.9 MR mail rename - experimental

(From RFC 1035, page 17)

Textual Representation:



owner

 

class

 

ttl

 MR 

new-mbox

Example:

eddie.movie.edu.  IN  MR  eddie.bornagain.edu.

Binary Representation:

MR type code: 9     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   NEWNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: NEWNAME         A 

domain-name

 which specifies a mailbox which                 is the proper rename of the specified mailbox.

A.1.2.10 MX mail exchanger

(From RFC 1035, page 17)

Textual Representation:



owner

 

class

 

ttl

 MX 

preference

 

exchange-dname

Example:

ora.com.  IN  MX  0  ora.ora.com.           IN  MX  10 ruby.ora.com.           IN  MX  10 opal.ora.com.

Binary Representation:

MX type code: 15     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                  PREFERENCE                   |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   EXCHANGE                    /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: PREFERENCE      A 16 bit integer which specifies the preference                 given to this RR among others at the same owner.                 Lower values are preferred. EXCHANGE        A 

domain-name

 which specifies a host willing                 to act as a mail exchange for the owner name.

A.1.2.11 NS name server

(From RFC 1035, page 18)

Textual Representation:



owner

 

class

 

ttl

 NS 

name-server-dname

Example:

movie.edu.     IN NS terminator.movie.edu

Binary Representation:

NS type code: 1     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   NSDNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: NSDNAME         A 

domain-name

 which specifies a host which                 should be authoritative for the specified                 class and domain.

A.1.2.12 NULL null - experimental

(From RFC 1035, page 17)

Binary Representation:

NULL type code: 10     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                  

anything

               /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ Anything at all may be in the RDATA field so long as it is 65535 octets or less.

NULL is not implemented by BIND.

A.1.2.13 PTR pointer

(From RFC 1035, page 18)

Textual Representation:



owner

 

class

 

ttl

 PTR 

dname

Example:

1.249.249.192.in-addr.arpa.  IN PTR wormhole.movie.edu.

Binary Representation:

PTR type code: 12     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   PTRDNAME                    /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: PTRDNAME        A 

domain-name

 which points to some location in                 the domain name space.

A.1.2.14 SOA start of authority

(From RFC 1035, pages 19-20)

Textual Representation:



owner

 

class

 

ttl

 SOA 

source-dname

 

mbox

 (         

serial

 

refresh

 

retry

 

expire

 

minimum

 )

Example:

movie.edu. IN SOA terminator.movie.edu. al.robocop.movie.edu. (                       1        ; Serial                       10800    ; Refresh after 3 hours                       3600     ; Retry after 1 hour                       604800   ; Expire after 1 week                       86400 )  ; Minimum TTL of 1 day

Binary Representation:

SOA type code: 6     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                     MNAME                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                     RNAME                     /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    SERIAL                     |     |                                               |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    REFRESH                    |     |                                               |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                     RETRY                     |     |                                               |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    EXPIRE                     |     |                                               |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    MINIMUM                    |     |                                               |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: MNAME           The 

domain-name

 of the name server that was the                 original or primary source of data for this zone. RNAME           A 

domain-name

 which specifies the mailbox of the                 person responsible for this zone. SERIAL          The unsigned 32 bit version number of the original                 copy of the zone.  Zone transfers preserve this                 value.  This value wraps and should be compared                 using sequence space arithmetic. REFRESH         A 32 bit time interval before the zone should be                 refreshed. RETRY           A 32 bit time interval that should elapse before                 a failed refresh should be retried. EXPIRE          A 32 bit time value that specifies the upper limit                 on the time interval that can elapse before the                 zone is no longer authoritative. MINIMUM         The unsigned 32 bit minimum TTL field that should                 be exported with any RR from this zone.

A.1.2.15 TXT text

(From RFC 1035, page 20)

Textual Representation:



owner

 

class

 

ttl

 TXT 

txt-strings

Example:

cujo.movie.edu.  IN  TXT  "Location: machine room dog house"

Binary Representation:

TXT type code: 16     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   TXT-DATA                    /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: TXT-DATA        One or more 

character-string

s.

A.1.2.16 WKS well-known services

(From RFC 1035, page 21)

Textual Representation:



owner

 

class

 

ttl

 WKS 

address

 

protocol

 

service-list

Example:

terminator.movie.edu.  IN  WKS 192.249.249.3  TCP ( telnet smtp                                               ftp shell domain )

Binary Representation:

WKS type code: 11     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                    ADDRESS                    |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |       PROTOCOL        |                       |     +--+--+--+--+--+--+--+--+                       |     |                                               |     /                   

BIT MAP

               /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: ADDRESS         An 32 bit Internet address PROTOCOL        An 8 bit IP protocol number 

BIT MAP

       A variable length bit map.  The bit map must                 be a multiple of 8 bits long.

A.1.3 New Types from RFC 1183

A.1.3.1 AFSDB Andrew File System Data Base - experimental

Textual Representation:



owner

 

ttl

 

class

 AFSDB 

subtype

 

hostname

Example:

fx.movie.edu.  IN  AFSDB  1 bladerunner.fx.movie.edu.                IN  AFSDB  2 bladerunner.fx.movie.edu.                IN  AFSDB  1 empire.fx.movie.edu.                IN  AFSDB  2 aliens.fx.movie.edu.

Binary Representation:

AFSDB type code: 18     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                   SUBTYPE                     |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                   HOSTNAME                    /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: SUBTYPE         Subtype 1 is an AFS cell database server. Subtype 2                 is a DCE authenticated name server. HOSTNAME        A 

domain-name

 which specifies a host that has a                 server for the cell named by the owner of the RR.

A.1.3.2 ISDN Integrated Services Digital Network address - experimental

Textual Representation:



owner

 

ttl

 

class

 ISDN 

ISDN-address

 

sa

Example:

delay.hp.com.    IN  ISDN  141555514539488 hep.hp.com.      IN  ISDN  141555514539488 004

Binary Representation:

ISDN type code: 20     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                 ISDN ADDRESS                  /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                  SUBADDRESS                   /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: ISDN ADDRESS    A 

character-string

 which identifies the ISDN number                 of 

owner

 and DDI (Direct Dial In) if any. SUBADDRESS      An optional 

character-string

 specifying the                 subaddress.

A.1.3.3 RP Responsible Person - experimental

Textual Representation:



owner

 

ttl

 

class

 RP 

mbox-dname

 

txt-dname

Example:

; The current origin is fx.movie.edu @            IN  RP   ajs.fx.movie.edu.   ajs.fx.movie.edu. bladerunner  IN  RP   root.fx.movie.edu.  hotline.fx.movie.edu.              IN  RP   richard.fx.movie.edu.  rb.fx.movie.edu. ajs          IN  TXT  "Arty Segue, (415) 555-3610" hotline      IN  TXT  "Movie U. Network Hotline, (415) 555-4111" rb           IN  TXT  "Richard Boisclair, (415) 555-9612"

Binary Representation:

RP type code: 17     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    MAILBOX                    /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    TXTDNAME                   /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: MAILBOX         A 

domain-name

 that specifies the mailbox for                 the responsible person. TXTDNAME        A 

domain-name

 for which TXT RR's exist.  A                 subsequent query can be performed to retrieve                 the associated TXT resource records at                 

txt-dname

A.1.3.4 RT Route Through - experimental

Textual Representation:



owner

 

ttl

 

class

 RT 

preference

 

intermediate-host

Example:

sh.prime.com.  IN  RT  2   Relay.Prime.COM.                IN  RT  10  NET.Prime.COM.

Binary Representation:

RT type code: 21     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                  PREFERENCE                   |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                 INTERMEDIATE                  /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: PREFERENCE      A 16 bit integer which specifies the preference                 given to this RR among others at the same owner.                 Lower values are preferred. EXCHANGE        A 

domain-name

 which specifies a host which will                 serve as an intermediate in reaching the host                 specified by 

owner

.

A.1.3.5 X25 X.25 address - experimental

Textual Representation:



owner

 

ttl

 

class

 X25 

PSDN-address

Example:

relay.pink.com.  IN  X25   31105060845

Binary Representation:

X25 type code: 19     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                 PSDN ADDRESS                  /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: PSDN ADDRESS    A 

character-string

 which identifies the PSDN                 (Public Switched Data Network) address in the                 X.121 numbering plan associated with 

owner

.

A.1.4 New Types from RFC 1664

A.1.4.1 PX pointer to X.400/RFC 822 mapping information

Textual Representation:



owner

 

ttl

 

class

 PX 

preference

 

RFC822 address

 

X.400 address

Example:

ab.net2.it.  IN  PX  10   ab.net2.it.  O-ab.PRMD-net2.ADMDb.C-it.

Binary Representation:

 PX type code: 26     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     |                  PREFERENCE                   |     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    MAP822                     /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+     /                    MAPX400                    /     /                                               /     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ where: PREFERENCE   A 16 bit integer which specifies the preference given to              this RR among others at the same owner.  Lower values              are preferred. MAP822       A 

domain-name

 element containing 

rfc822-domain

, the              RFC 822 part of the RFC 1327 mapping information. MAPX400      A 

domain-name

 element containing the value of              

x400-in-domain-syntax

 derived from the X.400 part of              the RFC 1327 mapping information.

A.1.5 Classes

(From RFC 1035, page 13)

CLASS fields appear in resource records. The following CLASS mnemonics and values are defined:

IN: 1 the Internet
CS: 2 the CSNET class (obsolete - used only for examples in some obsolete RFCs)
CH: 3 the CHAOS class
HS: 4 the Hesiod class