That's exactly correct. Looking at the output: write(3, "\3048\1\0\0\1\0\0\0\0\0\0\7example\3com\0\0\34\0\1", 29 write(4, ";\251\1\0\0\1\0\0\0\0\0\0\7exa

That's exactly correct. Looking at the output: write(3, "\3048\1\0\0\1\0\0\0\0\0\0\7example\3com\0\0\34\0\1", 29 write(4, ";\251\1\0\0\1\0\0\0\0\0\0\7example\3com\0\0\1\0\1", 29 We can make these a little more legible like this: $ printf "%b" '\3048\1\0\0\1\0\0\0\0\0\0\7example\3com\0\0\34\0\1' | xxd 00000000: c438 0100 0001 0000 0000 0000 0765 7861 .8...........exa 00000010: 6d70 6c65 0363 6f6d 0000 1c00 01 mple.com..... $ printf "%b" ';\251\1\0\0\1\0\0\0\0\0\0\7example\3com\0\0\1\0\1' | xxd -a 00000000: 3ba9 0100 0001 0000 0000 0000 0765 7861 ;............exa 00000010: 6d70 6c65 0363 6f6d 0000 0100 01 mple.com..... RFC1035 and later explain how to decode. We only care about decoding the "question section" which follows the format of QNAME/QTYPE/QCLASS. The QNAME is sequence of labels ("example", "com", "") preceded by their length. So we see "example" (preceded by its length of 7), "com" (preceded by its length of 3, and the null label (empty string with a length of 0) representing the root. Each QNAME is then followed by the QTYPE (two bytes) and QCLASS (two bytes). The first QTYPE is 0x1c, or 28 decimal, which is indeed a AAAA query. The second QTYPE is 1, which is an A query.