Out-of-date Z-Flag in DNS headers (AD, CD are missing)
Author: cochavizCreated Apr 3, 2026Updated Apr 3, 2026
Currently, the Z flag in the DNS struct spans 3 bits. In the most recent IANA definition, however, the Z flag only uses 1 bit, the last three being used for DNSSEC-related purposes (I think):
| Bit | Flag | Description | Reference |
|---|---|---|---|
| bit 5 | AA | Authoritative Answer | [RFC1035] |
| bit 6 | TC | Truncated Response | [RFC1035] |
| bit 7 | RD | Recursion Desired | [RFC1035] |
| bit 8 | RA | Recursion Available | [RFC1035] |
| bit 9 | Reserved | ||
| bit 10 | AD | Authentic Data | [RFC4035][RFC6840][RFC Errata 4924] |
| bit 11 | CD | Checking Disabled | [RFC4035][RFC6840][RFC Errata 4927] |
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6 https://www.freesoft.org/CIE/RFC/2065/40.htm
Even though this means a breaking change, I believe is semantically important. Beyond the fact that we're not up-to-date with IANA spec, the implication of the Z flag is that it's assumed to be 'zero', which currently doesn't hold anymore.
I'd be happy to implement this change, but I'm curious to see what people think about it!
Source: google/gopacket