I read that the additional secition part of a DNS packet is just used for the response. That means it should be empty in the query. But when I run a normal dig command (dig google.com) and then have a look at the packet that was sent (with wireshark) I recognize that the additional information section isn't empty (I'm sure I looked up the query not the response).

Here you can see the content of the query

When I run the same with drill (drill google.com) the additional information section is empty as I thiught it should be.

Can you explain me the meaning of this additional information in the section?

Thanks in advance!


The information you're reading is slightly dated. The Additional section is also used to wrap the EDNS0 pseudo-section, and you can see in your packet capture where it specifies EDNS0 version: 0. Option: Cookie specifies that this is a DNS cookie. The Additional section was used for this purpose because it was possible to make older clients ignore this data without rejecting the datagram. It uses a pseudo record type called OPT that will be ignored per when not recognized.

The difference you are observing is that your version of the dig command populates that option field, but drill does not.

| improve this answer | |
  • That means modern DNS servers can ignore this additional information? – Deep Thought Jun 19 at 16:09
  • 1
    All DNS servers can ignore this information, modern or otherwise. Modern ones are of course more likely to implement the EDNS0 features being requested by the client. – Andrew B Jun 19 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.