DNS Header Bit Decoder

DNS Flags Decoder

Use this DNS Flags Decoder to inspect the 16-bit DNS header flags field. Decode QR, Opcode, AA, TC, RD, RA, the reserved Z bit, AD, CD and the four-bit response code from hexadecimal, decimal or binary input.

✓ QR Query / Response ✓ Opcode ✓ AA / TC ✓ RD / RA ✓ AD / CD / RCODE

16 BIT

Decode DNS Header Flags

● Ready

DNS Flags Value Enter the complete 16-bit DNS flags field.

Input Format Hexadecimal values may use an optional 0x prefix.

DNS flags layout: bit 15 is QR; bits 14–11 are Opcode; bit 10 is AA; bit 9 is TC; bit 8 is RD; bit 7 is RA; bit 6 is reserved Z; bit 5 is AD; bit 4 is CD; and bits 3–0 are the base DNS RCODE.

DNS Flags Decode Result Decoded

Decoded DNS Header Flags –

Hex Flags –

Decimal –

Binary –

Message Type –

Opcode –

RCODE –

Recursion –

DNSSEC Bits –

16-Bit DNS Flags Layout

QR –

Opcode —-

AA –

TC –

RD –

RA –

Z –

AD –

CD –

RCODE —-

Field	Bits	Value	Decimal	Status / Meaning

Bit-Level DNS Flags Breakdown

What Is a DNS Flags Decoder?

A DNS Flags Decoder interprets the 16-bit flags field found near the beginning of a DNS message header. These bits describe whether the message is a query or response, which operation is being performed, whether the answer is authoritative, whether the packet was truncated, recursion behavior and the base response code.

The field is easier to understand when separated into its individual bit ranges rather than treated only as a hexadecimal number such as 0x8180.

DNS Flags Bit Layout

Bit 15      QR
Bits 14–11  Opcode
Bit 10      AA
Bit 9       TC
Bit 8       RD
Bit 7       RA
Bit 6       Z
Bit 5       AD
Bit 4       CD
Bits 3–0    RCODE

QR — Query or Response

The QR bit is the highest bit in the DNS flags field.

QR = 0
→ Query

QR = 1
→ Response

It can be extracted with:

QR = (Flags >> 15) & 1

DNS Opcode

Opcode occupies four bits and identifies the kind of DNS operation represented by the message.

Opcode = (Flags >> 11) & 0x0F

Opcode	Name
0	QUERY — Standard query
1	IQUERY — Inverse query, obsolete
2	STATUS — Server status request
4	NOTIFY
5	UPDATE
6	DSO

Other numerical opcode values are reserved or depend on later DNS protocol extensions.

AA — Authoritative Answer

AA stands for Authoritative Answer. In a response, AA set to 1 indicates that the responding server is authoritative for the relevant answer.

AA = (Flags >> 10) & 1

TC — Truncated

TC indicates that the DNS message was truncated.

TC = 1
→ Message truncated

A resolver may retry using a transport or mechanism capable of retrieving the complete response.

RD — Recursion Desired

RD is normally set by a client when it wants the receiving DNS server to perform recursive resolution if that service is available.

RD = 1
→ Recursion desired

A common standard DNS query therefore has flags:

0x0100

RA — Recursion Available

RA is normally used in DNS responses to indicate that the responding server supports recursive query service.

RA = 1
→ Recursion available

A common recursive response has both RD and RA set.

DNS Z Bit

The single Z bit in the modern DNS header flags layout is reserved and is normally zero.

Z = 0
→ Normal reserved-bit value

This decoder shows the bit explicitly so unusual packets are easier to inspect.

AD — Authentic Data

AD stands for Authentic Data and is associated with DNSSEC validation signaling.

AD = 1
→ Authentic Data flag set

The exact security conclusion that should be drawn from AD depends on the resolver context and trust relationship, so the flag should not be interpreted in isolation.

CD — Checking Disabled

CD stands for Checking Disabled. A DNS client can set this bit when requesting that a security-aware resolver not perform its normal DNSSEC checking for the query.

CD = 1
→ Checking Disabled requested

DNS RCODE

The lowest four bits of the traditional DNS flags field form the base response code.

RCODE = Flags & 0x0F

RCODE	Name	Meaning
0	NOERROR	No error condition
1	FORMERR	Format error
2	SERVFAIL	Server failure
3	NXDOMAIN	Name error / nonexistent domain
4	NOTIMP	Not implemented
5	REFUSED	Query refused

Example: DNS Query Flags 0x0100

0x0100
= 0000000100000000

QR     = 0 → Query
Opcode = 0 → QUERY
AA     = 0
TC     = 0
RD     = 1
RA     = 0
Z      = 0
AD     = 0
CD     = 0
RCODE  = 0

This is the familiar standard recursive query flags value.

Example: DNS Response Flags 0x8180

0x8180
= 1000000110000000

QR = 1 → Response
Opcode = 0 → QUERY
AA = 0
TC = 0
RD = 1
RA = 1
Z = 0
AD = 0
CD = 0
RCODE = 0 → NOERROR

This is a common successful recursive DNS response pattern.

Example: Authoritative Response 0x8400

0x8400

QR = 1
AA = 1

Opcode = QUERY
RCODE = NOERROR

The AA bit indicates an authoritative response.

Example: NXDOMAIN 0x8183

0x8183

QR = 1
RD = 1
RA = 1

RCODE = 3
→ NXDOMAIN

The response code indicates that the queried domain name does not exist in the applicable DNS namespace.

Example: Truncated DNS Response

0x8200

QR = 1
TC = 1

The TC bit indicates that the response was truncated.

DNS Flags Hex to Binary

A DNS flags field is exactly 16 bits wide, so each four-digit hexadecimal value maps naturally to sixteen binary bits.

0x8180

Hex:
8    1    8    0

Binary:
1000 0001 1000 0000

DNS Header Structure Around the Flags

The flags field is only one part of the fixed DNS header.

Transaction ID   16 bits
Flags            16 bits
QDCOUNT          16 bits
ANCOUNT          16 bits
NSCOUNT          16 bits
ARCOUNT          16 bits

This tool deliberately decodes only the flags word so it remains focused and does not guess section counts or resource records that were not provided.

Base RCODE vs Extended RCODE

The ordinary DNS header contributes four RCODE bits. Modern DNS extensions can carry additional response-code bits outside this original 16-bit header field.

This calculator reports the four-bit base RCODE proven by the supplied DNS flags field. A complete extended DNS response code may require information from an EDNS OPT record, which is outside this standalone flags decoder.

Common DNS Flags Patterns

0x0100

Standard query with Recursion Desired set.

0x8180

Common successful recursive response with RD and RA set.

0x8400

Authoritative response with AA set.

0x8183

Recursive-style response with base RCODE 3, NXDOMAIN.

DNS Flags Decoder FAQs

How many bits are in the DNS flags field?

The standard DNS header flags field is 16 bits wide.

What does QR mean in DNS?

QR distinguishes a query from a response. Zero means query and one means response.

What does DNS flag 0x0100 mean?

It represents a standard query with the Recursion Desired bit set.

What does DNS flags 0x8180 mean?

It commonly represents a standard response with Recursion Desired and Recursion Available set and RCODE 0.

What does AA mean in DNS?

AA means Authoritative Answer.

What does TC mean in DNS?

TC means the DNS message is truncated.

What does RD mean in DNS?

RD means Recursion Desired.

What does RA mean in DNS?

RA means Recursion Available.

What does AD mean in DNS?

AD stands for Authentic Data and is associated with DNSSEC validation signaling.

What does CD mean in DNS?

CD stands for Checking Disabled.

What is DNS RCODE 0?

RCODE 0 is NOERROR.

What is DNS RCODE 2?

RCODE 2 is SERVFAIL, or server failure.

What is DNS RCODE 3?

RCODE 3 is NXDOMAIN, indicating a name error / nonexistent domain.

What is DNS RCODE 5?

RCODE 5 is REFUSED.

What does 0x8183 mean?

It is a response with RD and RA set and base RCODE 3, NXDOMAIN.

How is the DNS opcode extracted?

Shift the 16-bit flags field right by 11 bits and mask with 0x0F.

How is the DNS response code extracted?

The four base RCODE bits are extracted using Flags & 0x000F.

Can EDNS extend the DNS response code?

Yes. Extended response-code information can be carried outside the original four-bit header RCODE, so a complete extended code can require the EDNS OPT record.

Decode 16-Bit DNS Header Flags

Enter hexadecimal, decimal or binary DNS flags to inspect query/response state, opcode, authoritative and truncation flags, recursion behavior, DNSSEC-related bits and the four-bit base DNS response code.