WireShark.Com is not affiliated with Ethereal Wireshark

DNS Queries Explained

DNS queries are the requests your device sends to translate a domain name—such as example.com—into an IP address. Without DNS queries, your browser, apps, or services would not know where to connect.

This guide explains what DNS queries are, how they work, the different types, real examples, and how to analyze DNS traffic using Wireshark.

What Is a DNS Query?

A DNS query is a request sent from a client device to a DNS resolver to look up the IP address behind a domain name. DNS works as the internet’s phonebook, allowing devices to reach the correct server.

A DNS query may return:

an IPv4 or IPv6 address
mail server information
alias domains
verification or security records

How DNS Queries Work (Step-by-Step)

When you type a domain into your browser, this is the full DNS resolution process:

You enter a domain name (example.com).
Your device checks its local DNS cache for a saved result.
If not found, the DNS resolver (ISP or public DNS) receives the query.
The resolver contacts the Root Servers.
Root servers point to the appropriate Top-Level Domain (TLD) servers.
TLD servers point to the Authoritative Name Server.
The authoritative server provides the final IP address.
Your device receives the response and loads the website.

This process usually takes only a few milliseconds.

TYPES OF DNS QUERIES

There are three main types of DNS queries. Each serves a different purpose depending on what information the resolver already has.

Recursive Query – The resolver must return a final, complete answer.
Iterative Query – The resolver returns the best answer it has, even if incomplete.
Non-Recursive Query – The resolver already knows the answer (cached) and responds instantly.

DNS RECORD TYPES

DNS queries return different record types depending on what information is requested.

Record	Purpose	Example
A	IPv4 address	example.com → 93.184.216.34
AAAA	IPv6 address	example.com → 2606:2800:220:1::248
CNAME	Alias domain	www.example.com → example.com
MX	Mail servers	Google mail exchangers
NS	Nameserver	ns1.example.com
TXT	Verification / SPF	"v=spf1 include:google.com"

Wireshark displays captured packets using a simple and powerful three-panel layout. Each panel shows a different level of detail, helping you move from a high-level overview to a deep packet analysis.

Top Panel: Packet List

The top section shows all packets captured during your session. Each row represents a single packet and includes useful information such as:

No. – The packet’s sequence number.
Time – Timestamp of when the packet was captured.
Source – The device that sent the packet.
Destination – The device that received the packet.
Protocol – The protocol used (TCP, UDP, DNS, HTTP, etc.).
Length – Size of the packet.
Info – A quick summary of what the packet contains.

Clicking a packet in this panel loads more detail in the two panels below.

Middle Panel: Packet Details

This section breaks down the selected packet into layers, following the OSI or TCP/IP model:

Ethernet II
Internet Protocol (IP)
Transmission Control Protocol (TCP) or UDP
Application layer protocols like DNS, HTTP, TLS, etc.

You can expand each layer to view detailed fields such as ports, flags, sequence numbers, TTL values, and more.

Bottom Panel: Packet Bytes

The bottom panel shows the raw data of the packet in hexadecimal and ASCII format. This view is useful when you need to inspect the exact bytes being sent across the network.

Together, these three panels give you a complete view of every packet, from a high-level summary down to its raw data.

DNS QUERY EXAMPLES

DNS Query Examples

Simple Domain Lookup

example.com → 93.184.216.34

MX Record Lookup

Used by mail servers to find where to deliver email.

Command Line Lookup Examples

nslookup google.com

dig example.com

host cloudflare.com

HOW TO ANALYZE DNS QUERIES IN WIRESHARK

Wireshark is one of the best tools for inspecting DNS traffic and troubleshooting network issues.

Step 1 — Start a Capture

Select your network interface and begin capturing packets.

If no network interfaces appear when starting a capture, the issue may be related to the installed packet capture driver .

Step 2 — Apply a DNS Filter

dns

For a full walkthrough of capturing and filtering traffic, see our step-by-step guide to using the Wireshark network analyzer .

Step 3 — Examine Key Fields

Transaction ID
Query Name (QNAME)
Query Type (A, AAAA, MX, CNAME)
Response Codes (NOERROR, NXDOMAIN)
Answers (IP addresses returned)

Step 4 — What to Look For

Slow DNS response times
Repeated failed lookups
Unknown or suspicious hostnames
Malware-generated DNS queries
DNS leakage to unintended servers

COMMON DNS PROBLEMS & FIXES

Slow DNS Resolution

Cause: Overloaded or slow resolver.
Fix: Use a faster resolver like Cloudflare (1.1.1.1).

DNS_PROBE_FINISHED_NXDOMAIN

Cause: Invalid or unreachable domain.
Fix: Clear DNS cache, restart router, verify spelling.

DNS Leaks

Cause: VPN or browser leaking DNS traffic.
Fix: Use encrypted DNS (DoH or DoT).

ISP Blocking Domains

Fix: Switch to a neutral resolver such as Google DNS or Cloudflare.

DNS TOOLS

Wireshark
Google Public DNS (8.8.8.8)
Cloudflare DNS (1.1.1.1)
nslookup
dig
host
DNSChecker.org
IntoDNS.com

FAQS SECTION

What is the purpose of a DNS query?

A DNS query retrieves the IP address of a domain so your device can connect to it.

What are the types of DNS queries?

Recursive, iterative, and non-recursive queries.

Are DNS queries encrypted?

Standard DNS is not encrypted. DoH (DNS over HTTPS) and DoT (DNS over TLS) provide encrypted DNS.

Why do DNS queries fail?

Common causes include resolver outages, incorrect domain names, and cache corruption.

How can I speed up DNS lookups?

Switch to a faster DNS provider such as Cloudflare (1.1.1.1) or Google DNS (8.8.8.8).

RELATED GUIDES

Related Guides

WireShark.Com

is not affiliated with Ethereal Wireshark

We write reviews about the best packet sniffers. Let’s learn, inspire and unite.