One thing that always drives me crazy about these is that it's not really a great example of how to actually write a query. "Copy values from wireshark" makes a

One thing that always drives me crazy about these is that it's not really a great example of how to actually write a query. "Copy values from wireshark" makes a bunch of assumptions, the main one being "the query you saw is the kind of query you want." Just blindly copying flags off of a packet isn't really a good practice for software development. What if the packet was not recursive? I'm sure 99.99% of the people reading that have no idea that non-recursive packets were possible, or even what it means. Instead, read RFC 4.1.1 and figure out what the flags mean and why you'd use one or the other. https://www.rfc-editor.org/rfc/rfc1035 https://www.rfc-editor.org/rfc/rfc1035 And by reading the actual format document you can start looking for vulnerabilities. For example, what happens when the various COUNT numbers aren't correct in a response? What if you get an error response code but there is response data? What if the implementor used signed instead of unsigned numbers for COUNT? This is a bit better than SO, but not by much. You're not writing a DNS query, you're hacking someone else's DNS query and sending it over the wire.