Skip to Content

A stick figure smiling

Here's a preview from my zine, How DNS Works! If you want to see more comics like this, sign up for my saturday comics newsletter or browse more comics!

Image of a comic. To read the full HTML alt text, click "read the transcript".

browse more comics! get the zine!
read the transcript!

I literally mean everything, I copied this verbatim from a real DNS request using Wireshark. (DNS packets are binary but we’re showing a human-readable representation here)

Let’s look at the actual data being sent during a DNS query:

Illustration of a browser, represented by the Firefox logo of a fox wrapped around a globe, talking to a resolver, represented by a box with a smiley face holding a magnifying glass.

browser: what’s the IP for


Query ID: 0x05a8
(randomly generated)
Flags: 0x1000
(these flags just mean “this is a request”)
Questions: 1 Answer records: 0
Authority records: 0
Additional records: 0
Type: A (A is for IPv4 address. other types: MX, CNAME, AAAA, etc) Class: IN`
(IN stands for “INternet”)


Query ID: 0x05a8
(matches request ID)

Flags: 0x8580
the response code is encoded in the last 4 bits of these flags. The 3 main response codes are: - NOERROR (success!) - NXDOMAIN (doesn’t exist!) - SERVFAIL (error!)

Questions: 1   
Answer records: 1   
Authority records: 0    
Additional records: 0  

(copied from request)


(domain names aren’t case sensitive)

Type: A   
Class: IN   
Answer records:   
Type: A   
Class: IN   
TTL: 86400   

(the IP we asked for)

Authority records:   
Additional records:   

page 12 (“NS records”) talks more about these 2 sections

Illustration of a smiling stick figure with curly hair.

Person: I’m always surprised by how little is actually in a DNS packet!

Saturday Morning Comics!

Want another comic like this in your email every Saturday? Sign up here!

I'll send you one of my favourite comics from my archives every Saturday.
© Julia Evans 2024 | All rights reserved (see the FAQ for notes about licensing)