DNS header flags

The one-bit fields of a DNS message header, qr, aa, tc, rd, ra, ad and cd, that dig prints on its flags line.

Together they say what kind of message it is and how it was handled: question or response, from an authority or not, cut short or complete, resolved recursively or not, validated or not. Most diagnoses of a dig answer start by reading them.

The second 16-bit word of the 12-byte header holds QR (0 for a query, 1 for a response), a four-bit opcode, AA, TC, RD, RA, a reserved Z bit, AD, CD and the four-bit RCODE. AD and CD were taken from the old three-bit Z field for DNSSEC; the one reserved bit left must be zero, and dig reports it apart as MBZ.

RD is the client's request for recursion and is copied into the response; RA is the server's offer, set or cleared in every response, and RFC 1034 says rd and ra together show recursion was used. A reply with rd but no ra means this server will not recurse for you, and dig prints a warning. TC means a required record set did not fit: RFC 2181 says to ignore the answer and ask again over a transport such as TCP.

AD claims the answer was validated; CD asks the resolver not to validate. RFC 4035 tells a resolver to disregard both in a response unless it came over a secure channel or the resolver is configured to trust them, so ad is worth as much as the resolver and the path to it. A SERVFAIL that turns into data when the query sets cd points at a DNSSEC validation failure.

Also known as: dns flags, dig flags, rd bit, ra bit, tc bit, ad bit

Sources

← All glossary entries