[Appendix A] DNS Message Format and Resource Records
Author: Cricket Liu & Paul Albitz
Date: 1999-01-06T18:45:10Z

#

| Appendix A |

# A. DNS Message Format and Resource Records

Contents:
Master File Format
DNS Message
Header Section Format
Resource Record Data

This appendix outlines the format of DNS messages and enumerates all the resource record types. The resource records are shown in their textual format, as you would specify them in a DNS database file, and in their binary format, as they appear in DNS messages. You'll find a few resource records here that we didn't cover in the book because they are experimental or obsolete.

We've included here the portions of RFC 1035, written by Paul Mockapetris, that deal with the textual format of master files (what we called db files or DNS database files in the book) or with the DNS message format (for those of you who need to parse DNS packets).

## A.1 Master File Format

(From RFC 1035, pages 33-35)

The format of these files is a sequence of entries. Entries are predominantly line-oriented, though parentheses can be used to continue a list of items across a line boundary, and text literals can contain CRLF within the text. Any combination of tabs and spaces acts as a delimiter between the separate items that make up an entry. The end of any line in the master file can end with a comment. The comment starts with a ";".

The following entries are defined:

>     blank[comment]

>     $ORIGIN domain-name [comment]

>     $INCLUDE file-name [domain-name] [comment]

>     domain-namerr [comment]

>     blankrr [comment]

Blank lines, with or without comments, are allowed anywhere in the file.

Two control entries are defined: `$ORIGIN` and `$INCLUDE`. `$ORIGIN` is followed by a domain name, and resets the current origin for relative domain names to the stated name. `$INCLUDE` inserts the named file into the current file, and may optionally specify a domain name that sets the relative domain name origin for the included file. `$INCLUDE` may also have a comment. Note that an `$INCLUDE` entry never changes the relative origin of the parent file, regardless of changes to the relative origin made within the included file.

The last two forms represent RRs. If an entry for an RR begins with a blank, then the RR is assumed to be owned by the last stated owner. If an RR entry begins with a `domain-name`, then the owner name is reset.

`rr` contents take one of the following forms:

>     [TTL] [class] type RDATA
>     [class] [TTL] type RDATA

The RR begins with optional TTL and class fields, followed by a type and RDATA field appropriate to the type and class. Class and type use the standard mnemonics; TTL is a decimal integer. Omitted class and TTL values are default to the last explicitly stated values. Since type and class mnemonics are disjoint, the parse is unique.

`domain-name`s make up a large share of the data in the master file. The labels in the domain name are expressed as character strings and separated by dots. Quoting conventions allow arbitrary characters to be stored in domain names. Domain names that end in a dot are called absolute, and are taken as complete. Domain names which do not end in a dot are called relative; the actual domain name is the concatenation of the relative part with an origin specified in an `$ORIGIN`, `$INCLUDE`, or as an argument to the master file-loading routine. A relative name is an error when no origin is available.

`character-string` is expressed in one of two ways: as a contiguous set of characters without interior spaces, or as a string beginning with a " and ending with a ". Inside a "-delimited string any character can occur, except for a " itself, which must be quoted using a backslash ("\").

Because these files are text files, several special encodings are necessary to allow arbitrary data to be loaded. In particular:

.

  Of the root.

@

  A free-standing @ is used to denote the current origin.

\X

  Where X is any character other than a digit (0-9), is used to quote that character so that its special meaning does not apply. For example, "\." can be used to place a dot character in a label.[1]

  > [1] Not implemented by BIND 4.8.3.

\DDD

  Where each D is a digit is the octet corresponding to the decimal number described by DDD. The resulting octet is assumed to be text and is not checked for special meaning.[2]

  > [2] Not implemented by BIND 4.8.3.

( )

  Parentheses are used to group data that crosses a line boundary. In effect, line terminations are not recognized within parentheses.[3]

  > [3] BIND 4.8.3 allows parentheses only on SOA and WKS resource records.

;

  Semicolon is used to start a comment; the remainder of the line is ignored.

### A.1.1 Character Case

(From RFC 1035, page 9)

For all parts of the DNS that are part of the official protocol, all comparisons between character strings (e.g., labels, domain names, etc.) are done in a case-insensitive manner. At present, this rule is in force throughout the domain system without exception. However, future additions beyond current usage may need to use the full binary octet capabilities in names, so attempts to store domain names in 7-bit ASCII or use of special bytes to terminate labels, etc., should be avoided.

### A.1.2 Types

Here is a complete list of resource record types. The textual representation is used in master files. The binary representation is used in DNS queries and responses. These resource records are described on pages 13-21 of RFC 1035.

#### A.1.2.1 A address

(From RFC 1035, page 20)

Textual Representation:

>     owner class ttl A address

Example:

>     localhost.movie.edu.   IN A 127.0.0.1

Binary Representation:

>     Address type code: 1
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    ADDRESS                    |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     ADDRESS         A 32 bit Internet address.

#### A.1.2.2 CNAME canonical name

(From RFC 1035, page 14)

Textual Representation:

>     owner class ttl CNAME canonical-dname

Example:

>     wh.movie.edu.  IN  CNAME  wormhole.movie.edu.

Binary Representation:

>     CNAME type code: 5
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                     CNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     CNAME           A domain-name which specifies the canonical
>                     or primary name for the owner.  The owner name is
>                     an alias.

#### A.1.2.3 HINFO host information

(From RFC 1035, page 14)

Textual Representation:

>     owner class ttl HINFO cpu os

Example:

>     grizzly.movie.edu.  IN  HINFO  VAX-11/780 UNIX

Binary Representation:

>     HINFO type code: 13
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                      CPU                      /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                       OS                      /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     CPU             A character-string which specifies the CPU type.
>     OS              A character-string which specifies the
>                     operating system type.

#### A.1.2.4 MB mailbox domain name - experimental

(From RFC 1035, page 14)

Textual Representation:

>     owner class ttl MB mbox-dname

Example:

>     al.movie.edu.  IN  MB  robocop.movie.edu.

Binary Representation:

>     MB type code: 7
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   MADNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     MADNAME         A domain-name which specifies a host which has
>                     the specified mailbox.

#### A.1.2.5 MD mail destination - obsolete

MD has been replaced with MX.

#### A.1.2.6 MF mail forwarder - obsolete

MF has been replaced with MX.

#### A.1.2.7 MG mail group member - experimental

(From RFC 1035, page 16)

Textual Representation:

>     owner class ttl MG mgroup-dname

Example:

>     admin.movie.edu.  IN  MG  al.movie.edu.
>                           IN  MG  ed.movie.edu.
>                           IN  MG  jc.movie.edu.

Binary Representation:

>     MG type code: 8
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   MGMNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     MGMNAME         A domain-name which specifies a mailbox which
>                     is a member of the mail group specified by the
>                     domain name.

#### A.1.2.8 MINFO mailbox or mail list information - experimental

(From RFC 1035, page 16)

Textual Representation:

>     owner class ttl MINFO resp-mbox error-mbox

Example:

>     admin.movie.edu.  IN  MINFO  al.movie.edu. al.movie.edu.

Binary Representation:

>     MINFO type code: 14
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    RMAILBX                    /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    EMAILBX                    /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     RMAILBX         A domain-name which specifies a mailbox which
>                     is responsible for the mailing list or mailbox.
>                     If this domain name names the root, the owner of
>                     the MINFO RR is responsible for itself.  Note
>                     that many existing mailing lists use a mailbox
>                     X-request for the RMAILBX field of mailing list
>                     X, e.g., Msgroup-request for Msgroup.  This field
>                     provides a more general mechanism.
>     EMAILBX         A domain-name which specifies a mailbox which is
>                     to receive error messages related to the mailing
>                     list or mailbox specified by the owner of the
>                     MINFO RR (similar to the ERRORS-TO: field which has
>                     been proposed). If this domain name names the root,
>                     errors should be returned to the sender of the
>                     message.

#### A.1.2.9 MR mail rename - experimental

(From RFC 1035, page 17)

Textual Representation:

>     owner class ttl MR new-mbox

Example:

>     eddie.movie.edu.  IN  MR  eddie.bornagain.edu.

Binary Representation:

>     MR type code: 9
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   NEWNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     NEWNAME         A domain-name which specifies a mailbox which
>                     is the proper rename of the specified mailbox.

#### A.1.2.10 MX mail exchanger

(From RFC 1035, page 17)

Textual Representation:

>     owner class ttl MX preference exchange-dname

Example:

>     ora.com.  IN  MX  0  ora.ora.com.
>               IN  MX  10 ruby.ora.com.
>               IN  MX  10 opal.ora.com.

Binary Representation:

>     MX type code: 15
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                  PREFERENCE                   |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   EXCHANGE                    /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     PREFERENCE      A 16 bit integer which specifies the preference
>                     given to this RR among others at the same owner.
>                     Lower values are preferred.
>     EXCHANGE        A domain-name which specifies a host willing
>                     to act as a mail exchange for the owner name.

#### A.1.2.11 NS name server

(From RFC 1035, page 18)

Textual Representation:

>     owner class ttl NS name-server-dname

Example:

>     movie.edu.     IN NS terminator.movie.edu

Binary Representation:

>     NS type code: 1
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   NSDNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     NSDNAME         A domain-name which specifies a host which
>                     should be authoritative for the specified
>                     class and domain.

#### A.1.2.12 NULL null - experimental

(From RFC 1035, page 17)

Binary Representation:

>     NULL type code: 10
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                  anything               /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     Anything at all may be in the RDATA field so long as it is 65535
>     octets or less.

NULL is not implemented by BIND.

#### A.1.2.13 PTR pointer

(From RFC 1035, page 18)

Textual Representation:

>     owner class ttl PTR dname

Example:

>     1.249.249.192.in-addr.arpa.  IN PTR wormhole.movie.edu.

Binary Representation:

>     PTR type code: 12
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   PTRDNAME                    /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     PTRDNAME        A domain-name which points to some location in
>                     the domain name space.

#### A.1.2.14 SOA start of authority

(From RFC 1035, pages 19-20)

Textual Representation:

>     owner class ttl SOA source-dname mbox (
>             serial refresh retry expire minimum )

Example:

>     movie.edu. IN SOA terminator.movie.edu. al.robocop.movie.edu. (
>                           1        ; Serial
>                           10800    ; Refresh after 3 hours
>                           3600     ; Retry after 1 hour
>                           604800   ; Expire after 1 week
>                           86400 )  ; Minimum TTL of 1 day

Binary Representation:

>     SOA type code: 6
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                     MNAME                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                     RNAME                     /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    SERIAL                     |
>         |                                               |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    REFRESH                    |
>         |                                               |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                     RETRY                     |
>         |                                               |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    EXPIRE                     |
>         |                                               |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    MINIMUM                    |
>         |                                               |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     MNAME           The domain-name of the name server that was the
>                     original or primary source of data for this zone.
>     RNAME           A domain-name which specifies the mailbox of the
>                     person responsible for this zone.
>     SERIAL          The unsigned 32 bit version number of the original
>                     copy of the zone.  Zone transfers preserve this
>                     value.  This value wraps and should be compared
>                     using sequence space arithmetic.
>     REFRESH         A 32 bit time interval before the zone should be
>                     refreshed.
>     RETRY           A 32 bit time interval that should elapse before
>                     a failed refresh should be retried.
>     EXPIRE          A 32 bit time value that specifies the upper limit
>                     on the time interval that can elapse before the
>                     zone is no longer authoritative.
>     MINIMUM         The unsigned 32 bit minimum TTL field that should
>                     be exported with any RR from this zone.

#### A.1.2.15 TXT text

(From RFC 1035, page 20)

Textual Representation:

>     owner class ttl TXT txt-strings

Example:

>     cujo.movie.edu.  IN  TXT  "Location: machine room dog house"

Binary Representation:

>     TXT type code: 16
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   TXT-DATA                    /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     TXT-DATA        One or more character-strings.

#### A.1.2.16 WKS well-known services

(From RFC 1035, page 21)

Textual Representation:

>     owner class ttl WKS address protocol service-list

Example:

>     terminator.movie.edu.  IN  WKS 192.249.249.3  TCP ( telnet smtp
>                                                   ftp shell domain )

Binary Representation:

>     WKS type code: 11
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                    ADDRESS                    |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |       PROTOCOL        |                       |
>         +--+--+--+--+--+--+--+--+                       |
>         |                                               |
>         /                   BIT MAP               /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     ADDRESS         An 32 bit Internet address
>     PROTOCOL        An 8 bit IP protocol number
>     BIT MAP       A variable length bit map.  The bit map must
>                     be a multiple of 8 bits long.

### A.1.3 New Types from RFC 1183

#### A.1.3.1 AFSDB Andrew File System Data Base - experimental

Textual Representation:

>     owner ttl class AFSDB subtype hostname

Example:

>     fx.movie.edu.  IN  AFSDB  1 bladerunner.fx.movie.edu.
>                    IN  AFSDB  2 bladerunner.fx.movie.edu.
>                    IN  AFSDB  1 empire.fx.movie.edu.
>                    IN  AFSDB  2 aliens.fx.movie.edu.

Binary Representation:

>     AFSDB type code: 18
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                   SUBTYPE                     |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                   HOSTNAME                    /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     SUBTYPE         Subtype 1 is an AFS cell database server. Subtype 2
>                     is a DCE authenticated name server.
>     HOSTNAME        A domain-name which specifies a host that has a
>                     server for the cell named by the owner of the RR.

#### A.1.3.2 ISDN Integrated Services Digital Network address - experimental

Textual Representation:

>     owner ttl class ISDN ISDN-address sa

Example:

>     delay.hp.com.    IN  ISDN  141555514539488
>     hep.hp.com.      IN  ISDN  141555514539488 004

Binary Representation:

>     ISDN type code: 20
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                 ISDN ADDRESS                  /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                  SUBADDRESS                   /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     ISDN ADDRESS    A character-string which identifies the ISDN number
>                     of owner and DDI (Direct Dial In) if any.
>     SUBADDRESS      An optional character-string specifying the
>                     subaddress.

#### A.1.3.3 RP Responsible Person - experimental

Textual Representation:

>     owner ttl class RP mbox-dname txt-dname

Example:

>     ; The current origin is fx.movie.edu
>     @            IN  RP   ajs.fx.movie.edu.   ajs.fx.movie.edu.
>     bladerunner  IN  RP   root.fx.movie.edu.  hotline.fx.movie.edu.
>                  IN  RP   richard.fx.movie.edu.  rb.fx.movie.edu.
>     ajs          IN  TXT  "Arty Segue, (415) 555-3610"
>     hotline      IN  TXT  "Movie U. Network Hotline, (415) 555-4111"
>     rb           IN  TXT  "Richard Boisclair, (415) 555-9612"

Binary Representation:

>     RP type code: 17
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    MAILBOX                    /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    TXTDNAME                   /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     MAILBOX         A domain-name that specifies the mailbox for
>                     the responsible person.
>     TXTDNAME        A domain-name for which TXT RR's exist.  A
>                     subsequent query can be performed to retrieve
>                     the associated TXT resource records at
>                     txt-dname

#### A.1.3.4 RT Route Through - experimental

Textual Representation:

>     owner ttl class RT preference intermediate-host

Example:

>     sh.prime.com.  IN  RT  2   Relay.Prime.COM.
>                    IN  RT  10  NET.Prime.COM.

Binary Representation:

>     RT type code: 21
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                  PREFERENCE                   |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                 INTERMEDIATE                  /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     PREFERENCE      A 16 bit integer which specifies the preference
>                     given to this RR among others at the same owner.
>                     Lower values are preferred.
>     EXCHANGE        A domain-name which specifies a host which will
>                     serve as an intermediate in reaching the host
>                     specified by owner.

#### A.1.3.5 X25 X.25 address - experimental

Textual Representation:

>     owner ttl class X25 PSDN-address

Example:

>     relay.pink.com.  IN  X25   31105060845

Binary Representation:

>     X25 type code: 19
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                 PSDN ADDRESS                  /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     PSDN ADDRESS    A character-string which identifies the PSDN
>                     (Public Switched Data Network) address in the
>                     X.121 numbering plan associated with owner.

### A.1.4 New Types from RFC 1664

#### A.1.4.1 PX pointer to X.400/RFC 822 mapping information

Textual Representation:

>     owner ttl class PX preference RFC822 address X.400 address

Example:

>     ab.net2.it.  IN  PX  10   ab.net2.it.  O-ab.PRMD-net2.ADMDb.C-it.

Binary Representation:

>      PX type code: 26
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         |                  PREFERENCE                   |
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    MAP822                     /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>         /                    MAPX400                    /
>         /                                               /
>         +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>     where:
>     PREFERENCE   A 16 bit integer which specifies the preference given to
>                  this RR among others at the same owner.  Lower values
>                  are preferred.
>     MAP822       A domain-name element containing rfc822-domain, the
>                  RFC 822 part of the RFC 1327 mapping information.
>     MAPX400      A domain-name element containing the value of
>                  x400-in-domain-syntax derived from the X.400 part of
>                  the RFC 1327 mapping information.

### A.1.5 Classes

(From RFC 1035, page 13)

CLASS fields appear in resource records. The following CLASS mnemonics and values are defined:

IN

  1 the Internet

CS

  2 the CSNET class (obsolete - used only for examples in some obsolete RFCs)

CH

  3 the CHAOS class

HS

  4 the Hesiod class

15.9 DNS and WINS |  | A.2 DNS Message