DNS names are encoded as length-prefixed labels, not dotted text. This flagship strip follows the QNAME bytes and the question tail byte for byte.
Why names are length-prefixed
The DNS name is not sent with dots. Each label starts with a length byte, then the label bytes follow.
QNAME bytes = 17 \text{QNAME bytes}=17 QNAME bytes = 17 QNAME bytes The DNS name is decoded from length-prefixed labels. QNAME bytes 136 bits / 17 bytes 0x03777777076578616d706c6503636f6d00 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 byte 4 byte 5 byte 6 byte 7 0 0 0 0 0 1 1 1 0 1 1 0 0 1 0 1 0 1 1 1 1 0 0 0 0 1 1 0 0 0 0 1 byte 8 byte 9 byte 10 byte 11 0 1 1 0 1 1 0 1 0 1 1 1 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 0 1 0 1 byte 12 byte 13 byte 14 byte 15 0 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1 0 1 byte 16 0 0 0 0 0 0 0 0 len-www 3 www 0x777777 len-example 7 (cont.) example 0x6578616d706c65 len-com 3 com 0x636f6d terminator 0x00 Question tail 32 bits / 4 bytes 0x00010001 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 qtype 0x0001 qclass 0x0001
Decode the labels
The length bytes are 3, 7, and 3, followed by a zero terminator.
QNAME bytes The DNS name is decoded from length-prefixed labels. QNAME bytes 136 bits / 17 bytes 0x03777777076578616d706c6503636f6d00 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 byte 4 byte 5 byte 6 byte 7 0 0 0 0 0 1 1 1 0 1 1 0 0 1 0 1 0 1 1 1 1 0 0 0 0 1 1 0 0 0 0 1 byte 8 byte 9 byte 10 byte 11 0 1 1 0 1 1 0 1 0 1 1 1 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 0 1 0 1 byte 12 byte 13 byte 14 byte 15 0 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1 0 1 byte 16 0 0 0 0 0 0 0 0 len-www 3 www 0x777777 len-example 7 (cont.) example 0x6578616d706c65 len-com 3 com 0x636f6d terminator 0x00 Question tail 32 bits / 4 bytes 0x00010001 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 qtype 0x0001 qclass 0x0001
Question type and class
The tail asks for type A as 1 and class IN as 1.
QTYPE = 1 , QCLASS = 1 \text{QTYPE}=1,\quad\text{QCLASS}=1 QTYPE = 1 , QCLASS = 1 QNAME bytes The DNS name is decoded from length-prefixed labels. QNAME bytes 136 bits / 17 bytes 0x03777777076578616d706c6503636f6d00 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 byte 4 byte 5 byte 6 byte 7 0 0 0 0 0 1 1 1 0 1 1 0 0 1 0 1 0 1 1 1 1 0 0 0 0 1 1 0 0 0 0 1 byte 8 byte 9 byte 10 byte 11 0 1 1 0 1 1 0 1 0 1 1 1 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 0 1 0 1 byte 12 byte 13 byte 14 byte 15 0 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1 0 1 byte 16 0 0 0 0 0 0 0 0 len-www 3 www 0x777777 len-example 7 (cont.) example 0x6578616d706c65 len-com 3 com 0x636f6d terminator 0x00 Question tail 32 bits / 4 bytes 0x00010001 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 qtype 0x0001 qclass 0x0001
Summary
The question name is a sequence of length-prefixed labels followed by type and class. Message structure and exact bytes only; resolution timing, caching, and UDP/TCP transport are not modeled here.
QTYPE = 1 \text{QTYPE}=1 QTYPE = 1 QNAME bytes The DNS name is decoded from length-prefixed labels. QNAME bytes 136 bits / 17 bytes 0x03777777076578616d706c6503636f6d00 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 byte 4 byte 5 byte 6 byte 7 0 0 0 0 0 1 1 1 0 1 1 0 0 1 0 1 0 1 1 1 1 0 0 0 0 1 1 0 0 0 0 1 byte 8 byte 9 byte 10 byte 11 0 1 1 0 1 1 0 1 0 1 1 1 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 0 1 0 1 byte 12 byte 13 byte 14 byte 15 0 0 0 0 0 0 1 1 0 1 1 0 0 0 1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1 0 1 byte 16 0 0 0 0 0 0 0 0 len-www 3 www 0x777777 len-example 7 (cont.) example 0x6578616d706c65 len-com 3 com 0x636f6d terminator 0x00 Question tail 32 bits / 4 bytes 0x00010001 byte 0 byte 1 byte 2 byte 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 qtype 0x0001 qclass 0x0001