EDNS Options Inspector

Modern DNS replies often need more room and more signalling than the original protocol could provide. Extension Mechanisms for DNS (EDNS) adds that capacity through an OPT pseudo-record in the packet's Additional section. The OPT record is not an ordinary DNS answer. It carries the sender's UDP response-size limit, the EDNS version, flags, and optional data.

Several EDNS fields look like promises but are better read as observations. A client can request an option, yet a recursive resolver may omit it, replace its value, or answer without an OPT record. A single reply therefore describes one name, record type, resolver path, request shape, and moment in time.

UDP payload size

The largest DNS response size the sender says it can accept over UDP. A larger value reduces some truncation, but it does not guarantee that every network path can carry a packet of that size.

DO bit

DNSSEC OK asks for DNSSEC records when they are relevant. It does not prove that the resolver validated those records.

CD flag

Checking Disabled is a DNS header flag used to compare resolver-validation behavior. It is separate from the EDNS option list.

EDNS options

Numbered fields such as Name Server Identifier (NSID), EDNS Client Subnet (ECS), Padding, and Extended DNS Error. Each option has its own privacy and response rules.

Resolver policy matters as much as protocol support. An absent NSID can mean the resolver chose not to identify its answering node. Missing response padding does not show that request padding failed. An ECS reply may use a shorter scope than the prefix sent. Compare like with like by changing one variable at a time.

EDNS inspection can also reveal data you intentionally placed in the query. In particular, an ECS prefix is sent to the selected public resolver and may influence cache selection or answer location. Use documentation prefixes for experiments and avoid sending a real client subnet unless that disclosure is necessary.

How to Use This Tool:

Choose the resolver path and request shape that match the question you are investigating. Keep the rest unchanged when comparing two observations.

1. Enter one hostname or URL and select the DNS Record type. A pasted HTTP or HTTPS URL is reduced to its hostname.
2. Choose a Resolver path and an EDNS request preset. Baseline sends only the OPT envelope; the DNSSEC, resolver-ID, privacy, and ECS presets add their named behavior.
3. Open Advanced only when you need to change the 512–4096 byte UDP payload, 2–12 second timeout, DO or CD flag, NSID request, 0–512 bytes of padding, or ECS prefix.
4. Select Inspect OPT, then read the Negotiation brief before comparing the request and response in the OPT ledger. Use Packet sections and the replay commands when the summary needs verification.

Interpreting Results:

The headline describes how much of the requested EDNS shape was visible in this reply. Option echo means every requested option code appeared, while Partial echo means only some appeared. Header-only EDNS means the OPT envelope returned without any requested option code. None of these labels alone proves end-to-end feature support.

• Read the DNS response code separately from the HTTP request. A successful HTTPS exchange can still carry NXDOMAIN, SERVFAIL, or another DNS result.
• Compare the requested and returned UDP sizes rather than assuming the resolver accepted the advertised ceiling unchanged.
• Treat returned option values as resolver-specific evidence. Missing values may reflect policy, name-specific behavior, or an intermediary.
• Repeat the same request through another resolver or at another time before drawing a general conclusion.

Technical Details:

EDNS version 0 encodes its control information in an OPT pseudo-record. The OPT CLASS field carries the requestor's UDP payload size, while the OPT TTL field carries the extended response code, version, and flags. Individual options are identified by numeric codes registered by IANA.

Mechanism Core:

The inspection builds one wire-format DNS query, sends that message to the selected DNS-over-HTTPS resolver, decodes the returned wire packet, and compares requested option codes with observed option codes. Packet answers, authority records, and additional records remain separate from the OPT comparison.

The observation label follows an ordered rule set. A DNS error code takes precedence once an OPT record exists, and option comparison applies only to NOERROR or NXDOMAIN replies.

Formula Core:

For requests containing optional EDNS data, the echo percentage is the share of distinct requested option codes also found in the response. A request with no optional codes is assigned 100% because there is no missing requested option.

e is the number of requested codes observed in the reply, and r is the number of distinct requested codes. Counts, packet sizes, and elapsed milliseconds are reported without averaging across runs.

Limitations and Privacy Notes:

The selected public resolver receives the queried hostname, record type, EDNS flags, and any NSID, padding, or ECS option sent. Its operator may log the request according to its own policy.

• One response cannot prove how every resolver, edge location, transport, or future request will behave.
• Option echo is not a pass/fail test. Some options are deliberately one-way or policy-controlled.
• The DO bit requests DNSSEC material; use validation evidence such as the AD flag and controlled signed/broken tests to assess resolver validation.
• Timeouts and HTTP failures can come from the browser, network path, resolver, or policy rather than from EDNS parsing.

Worked Examples:

References:

• RFC 6891: Extension Mechanisms for DNS (EDNS(0)), RFC Editor, April 2013.
• RFC 8484: DNS Queries over HTTPS, RFC Editor, October 2018.
• Domain Name System (DNS) Parameters, Internet Assigned Numbers Authority.
• How to check DNSSEC validation with dig, Simplified Guide.