RFC 10029
DNS Multiple QTYPEs
RFC 10029: DNS Multiple QTYPEs 🎀
Author: R. Bellis (ISC) 💁♀️ Category: Standards Track Date: July 2026 ISSN: 2070-1721 Stream: IETF Obsoletes / Updates: nothing is listed in this document's header, so it doesn't mark anything as obsoleted or updated 🦋
Abstract ✨
okay so this doc is all about letting a DNS client ask for more record types in one go 🧚 instead of sending a bunch of separate queries. The extra types ride along with the main type from the Question section of a DNS QUERY (OpCode=0) 💅
Status of This Memo 📜
this is an Internet Standards Track document 🔥 it's a product of the Internet Engineering Task Force (IETF), it has the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 🫶 for more on how Internet Standards work, check Section 2 of RFC 7841 📚
for the current status, any errata, or to send feedback, go to https://www.rfc-editor.org/info/rfc10029 🌸
Copyright Notice 🌈
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. 🦋
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date 📜 please actually read these, because they spell out what you're allowed to do with it 🙈 any Code Components pulled out of this document need to include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as the Revised BSD License says 💀
Table of Contents 🗺️
1. Introduction
2. Terminology
3. Specification
3.1. Multiple QTYPE EDNS Options Format
3.2. Client Request Generation
3.3. Server Request Parsing
3.4. Server Response Generation
3.5. Client Response Processing
4. Security Considerations
5. IANA Considerations
6. References
6.1. Normative References
6.2. Informative References
Appendix A. Examples
A.1. Stub Query for A with MQTYPE-Query for AAAA and HTTPS
A.2. Stub Query for DS with MQTYPE-Query for DNSKEY
A.3. Recursive Query for DS with MQTYPE-Query for NS
Acknowledgements
Author's Address1. Introduction 🍓
okay bestie, so a super commonly requested thing for DNS [STD13] is getting several related resource records (RRs) back in a single response 😭
like, you might want the A, AAAA, and HTTPS RRs for one domain name all at once instead of firing off multiple queries 🧚
so the DNS wire protocol technically had support for multiple questions in one packet, but in reality it didn't work 💀 [RFC9619] updates RFC 1035 [STD13] so that a QUERY (OpCode=0) request only allows a single question 🙃
also, sending QTYPE=ANY doesn't guarantee you get every resource record set (RRsets) back. Section 4.1 of [RFC8482] says responders may return a single RRset of their choosing 😤
this document covers the case where only the QTYPE changes 👑 it defines a new option for the Extension Mechanisms for DNS (EDNS) [RFC6891] that holds a list of extra QTYPE values the client wants, on top of the one in the Question section ✨ responses use a different EDNS option on purpose, as protection against DNS middleboxes that echo EDNS options back verbatim 🛡️ iconic behavior tbh 💅
this spec works both for queries from a stub resolver to recursive servers, and for queries from recursive resolvers to authoritative servers 🦋 it does not apply to Multicast DNS queries [RFC6762], since those already let you ask for multiple records in one query 🙈 it does apply to DNS-Based Service Discovery (DNS-SD) [RFC6763] though ✨
2. Terminology 📖
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are only BCP 14 key words when they show up in ALL CAPS, exactly like that, and then they get read as described in BCP 14 [RFC2119] [RFC8174] 🔑 when they're in lowercase they're just regular words, so no stress 💕
this document also uses DNS terminology defined in [RFC9499] 🧚
3. Specification 🔥
3.1. Multiple QTYPE EDNS Options Format 🎀
this is the general shape of an EDNS option, from [RFC6891], followed by the option-specific data 📐
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
0: | OPTION-CODE |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
2: | OPTION-LENGTH |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
4: | |
: OPTION-DATA :
| |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+Figure 1: EDNS Option Format
OPTION-CODE: MQTYPE-Query (20) in queries and MQTYPE-Response (21) in responses 🍓OPTION-LENGTH: the size (in octets) ofOPTION-DATA📏OPTION-DATA: option specific, as shown in Figure 2 🌸
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
0: | QT1 |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
2: | |
: ... :
| |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
| QTn |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+Figure 2: MQTYPE OPTION-DATA Format
so OPTION-DATA is a list of 2-octet values in network order, most significant bit (MSB) first 🧠 each one names a DNS RRTYPE, and that RRTYPE must be a data RRTYPE as described in Section 3.1 of [RFC6895] 📚 the individual values (with unspecified index "x") get called "QTx" in the sections after this 💅
3.2. Client Request Generation 🚀
DNS clients that implement this specification MUST generate packets that follow the server request parsing rules in Section 3.3 🫶
when a client decides to bundle up queries for multiple QTYPEs with this method is up to the implementation, and this doc won't go into it 🤷♀️ but careful considerations should be taken if you're coalescing queries on an application's behalf and the application didn't ask for it 👀 how an app talks to the underlying name resolution library is internal to the implementation, so it's out of scope 🙃
3.3. Server Request Parsing 🧐
on top of the error cases in Section 7 of [RFC6891], the server MUST return a FORMERR response if it gets any of these:
- An MQTYPE-Query option in any inbound DNS message whose
OpCodeis anything other than QUERY (0) 🙅♀️ - An MQTYPE-Response option in any inbound DNS message 🙅♀️
- More than one MQTYPE-Query option in a query 🙅♀️
- An MQTYPE-Query in a query that has no primary question (i.e.,
QDCOUNT=0) 🙅♀️ - An MQTYPE-Query option in a query where the primary question is a non-data RRTYPE (e.g.,
ANY,AXFR) 🙅♀️ - An MQTYPE-Query option with an empty QT list 🙅♀️
- An invalid
QTx(e.g., one that corresponds to a Meta RRTYPE) 🙅♀️ - A duplicate
QTx(or one that duplicates the primary QTYPE field) in a query 🙅♀️
3.4. Server Response Generation 🎁
a conforming server that gets an MQTYPE-Query option in a valid query MUST send back an MQTYPE-Response option in its response, even if that response is truncated (TC=1) ✨ this is how the server shows that it actually supports this extension 🦋 for invalid queries, go back to Section 3.3 🔁
the server MUST first start building the response for the primary (QNAME, QCLASS, QTYPE) tuple from the Question section, using the existing DNS sections 📦 the RCODE and every other flag (like AA or AD) MUST be figured out at this point 🧮
if this initial response ends up truncated (TC=1), then the extra queries from the MQTYPE-Query option MUST NOT be processed 🛑
once the initial response is ready, the server MUST try to merge the responses for each individual (QNAME, QCLASS, QTx) combination into the response for the first query 🧩 if a recursive server doesn't have those responses yet, it MAY first send out outbound queries to fill up its caches 🌊
for each individual combination, the server MUST check the resulting RCODE and other flags against the values from the primary query, and make sure they all match 🔍
if any mismatch shows up, that mismatching additional response MUST NOT be put in the final combined response, and its QTx value MUST NOT be listed in the MQTYPE-Response option's list 🙅♀️ for example, this could happen if the primary query came back NOERROR but a QTx query came back SERVFAIL 💀 it could also happen if the primary response has AA=0 but a QTx response has AA=1, which could happen if the NS and DS records were both asked for at the parent side of a zone cut 🙈
the server MUST try to combine the remaining individual RRs into the same sections they'd have landed in for a standalone query (i.e., as if each combination had been "the question" per Section 4.1 of RFC 1035 [STD13]) 🧃
the server MUST detect duplicate RRs and keep only one copy of each RR in its section 🧹 duplicates can pop up in the Answer section if a CNAME chain is involved, or in the Authority section if several QTYPEs don't exist, etc. 🙃 heads up though: RRs can legitimately appear in more than one section, like the (SOA, TYPE12345) combination at a zone apex where TYPE12345 isn't present 🫠
Important: handling an MQTYPE-Query option MUST NOT itself trigger a truncated response 🚨 if the response size (or other) limits don't let all the data from an extraQTxquery fit in the final response in its entirety (i.e., as complete RRsets), then the server MUST NOT include thatQTxin the MQTYPE-Response option's list, and it MAY stop processing furtherQTxcombinations 🛑
if all the RRs for a single QTx combination fit in the message, then the server MUST include that QTx in the MQTYPE-Response option's list, to show that this query type was completely processed 🎉
it's possible for the resulting MQTYPE-Response option to have an empty list 🥺 but like we said above, the option must still be returned 💜
3.5. Client Response Processing ✨
okay bestie, this is where the client gets its response back and has to figure out what the server actually said 🕵️ If a query had an MQTYPE-Query option but the response doesn't have an MQTYPE-Response option, or it messily includes an MQTYPE-Query option anyway, the client MUST treat the response as if this option is unsupported by the server 🙃 It also MUST process the primary response as if the MQTYPE-Query option had not been used. no drama, just vibes.
In that case, or if the server sends back a FORMERR response, the client MUST issue additional standalone queries (that is, without using the MQTYPE-Query option) for all QTYPEs that still need an answer 📬
If the MQTYPE-Response option shows up more than once, or if a QTx value is duplicated (or copies the primary QTYPE field), the client MUST treat the answer as invalid (equivalent to FORMERR). not it 💀
The Question section and the list of types in the MQTYPE-Response option tell you which (QNAME, QCLASS, QTYPEs) combinations are fully answered and sitting inside the response you got. All of the answers to those query combinations share the same RCODE and all the other flags, so they're a little squad 🫶
All RRs that existing DNS specifications require are expected to be in the right sections of the DNS message, including proofs of nonexistence where required. The client MUST NOT rely on any particular order of RRs in the message sections. don't get attached to the order, babe 🌈
For the purposes of Section 5.4.1 of [RFC2181], any authoritative answers received MUST be ranked the same as the answer for the primary question. 👑
Clients MUST take into account that individual RRs might come from different DNS zones, and that proofs of nonexistence might have been produced by different signers. the plot thickens 🧚
If a QTx value the client asked for is missing from the MQTYPE-Response option, that absence can mean a few things:
- (for responses from recursive servers) the server does not have any records for that QTx value in cache, and/or
- the individual responses could not be combined into one message because of RCODE or other flag mismatches, and/or
- the server was unwilling to process the request (for example, because a limit was exceeded), and/or
- the response size limit would be exceeded.
Whatever the reason, the client MUST subsequently initiate separate standalone queries for all QTx values that still need an answer. go get your answers, queen 👸
4. Security Considerations 🚨
okay, serious moment incoming 😤 The method documented here does not change any of the security properties of the DNS protocol itself. phew, the core stays safe 🫶
However, it should be noted that this method does increase the potential amplification factor when the DNS protocol is used as a vector for a denial-of-service attack. A further risk is being able to maliciously cause recursive servers to perform large amounts of additional work. the attacker would LOVE that 😭
Implementors SHOULD therefore allow operators to configure limits on the number of QTx values specified and/or the resulting response size. The recommended values of those limits will depend on the environment in which this specification is used. In public DNS, it is expected that a limit of four QTx values would be appropriate, but when used with DNS-SD or within private networks, higher limits would be acceptable. so set your limits, friend 🛡️
5. IANA Considerations 🦋
IANA has assigned the following values in the "DNS EDNS0 Option Codes (OPT)" registry within the "Domain Name System (DNS) Parameters" registry group:
+=======+=================+==========+===========+
| Value | Name | Status | Reference |
+=======+=================+==========+===========+
| 20 | MQTYPE-Query | Optional | RFC 10029 |
+-------+-----------------+----------+-----------+
| 21 | MQTYPE-Response | Optional | RFC 10029 |
+-------+-----------------+----------+-----------+Table 1: MQTYPE EDNS Option Numbers
6. References 📚
6.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS
Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997,
<https://www.rfc-editor.org/info/rfc2181>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<https://www.rfc-editor.org/info/rfc6891>.
[RFC6895] Eastlake 3rd, D., "Domain Name System (DNS) IANA
Considerations", BCP 42, RFC 6895, DOI 10.17487/RFC6895,
April 2013, <https://www.rfc-editor.org/info/rfc6895>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC9619] Bellis, R. and J. Abley, "In the DNS, QDCOUNT Is (Usually)
One", RFC 9619, DOI 10.17487/RFC9619, July 2024,
<https://www.rfc-editor.org/info/rfc9619>.
[STD13] Internet Standard 13,
<https://www.rfc-editor.org/info/std13>.
At the time of writing, this STD comprises the following:
Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
<https://www.rfc-editor.org/info/rfc1034>.
Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <https://www.rfc-editor.org/info/rfc1035>.6.2. Informative References
[RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762,
DOI 10.17487/RFC6762, February 2013,
<https://www.rfc-editor.org/info/rfc6762>.
[RFC6763] Cheshire, S. and M. Krochmal, "DNS-Based Service
Discovery", RFC 6763, DOI 10.17487/RFC6763, February 2013,
<https://www.rfc-editor.org/info/rfc6763>.
[RFC8482] Abley, J., Gudmundsson, O., Majkowski, M., and E. Hunt,
"Providing Minimal-Sized Responses to DNS Queries That
Have QTYPE=ANY", RFC 8482, DOI 10.17487/RFC8482, January
2019, <https://www.rfc-editor.org/info/rfc8482>.
[RFC9499] Hoffman, P. and K. Fujiwara, "DNS Terminology", BCP 219,
RFC 9499, DOI 10.17487/RFC9499, March 2024,
<https://www.rfc-editor.org/info/rfc9499>.Appendix A. Examples 🧁
The examples below are shown as what might be reported by the Internet Systems Consortium (ISC) Dig utility. For the purposes of brevity, irrelevant content is omitted.
A.1. Stub Query for A with MQTYPE-Query for AAAA and HTTPS
In this example, a stub resolver has requested the A record for www.example.com, along with an MQTYPE-Query option requesting AAAA and HTTPS records. The stub resolver has also set the DO bit, indicating DNSSEC support 🔐
The presence of the HTTPS QTYPE in the MQTYPE-Response option of the response, coupled with its absence from the Answer section, indicates that the recursive server currently holds no data for this QTYPE. The corresponding type fields in the NSEC3 record further provide a cryptographic proof of nonexistence for the HTTPS QTYPE, and the SOA record also indicates a "negative answer" 🙈
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11111
;; flags: qr rd ra ad
;; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; MQTYPE-Response: AAAA HTTPS
;; QUESTION SECTION:
;www.example.com. IN A
;; ANSWER SECTION:
www.example.com. 2849 IN A 192.0.2.1
www.example.com. 2849 IN RRSIG A [...]
www.example.com. 3552 IN AAAA 3fff::1234
www.example.com. 3552 IN RRSIG AAAA [...]
;; AUTHORITY SECTION:
example.com. 2830 IN SOA ns.example.com. [...]
example.com. 2830 IN RRSIG SOA 13 2 [...]
[...].example.com. 2830 IN NSEC3 [...] A TXT AAAA RRSIG
[...].example.com. 2830 IN RRSIG NSEC3 [...]Figure 3: A, AAAA, and HTTPS
A.2. Stub Query for DS with MQTYPE-Query for DNSKEY
In this similar example, the primary QTYPE is for DS, and the MQTYPE-Query field only contains DNSKEY.
Both the DS and DNSKEY records are returned, along with their corresponding RRSIG records 🔑
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33333
;; flags: qr rd ra ad
;; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; MQTYPE-Response: DNSKEY
;; QUESTION SECTION:
;example.com. IN DS
;; ANSWER SECTION:
example.com. 625 IN DNSKEY 256 3 13 [...]
example.com. 625 IN DNSKEY 257 3 13 [...]
example.com. 625 IN RRSIG DNSKEY [...] example.com. [...]
example.com. 86185 IN DS 370 13 2 [...]
example.com. 86185 IN RRSIG DS [...] com. [...]Figure 4: Stub DS and DNSKEY
A.3. Recursive Query for DS with MQTYPE-Query for NS
In this instance, a recursive resolver is sending a DS record query to the parent zone's authoritative server and simultaneously requesting the NS records for the zone 🧩
Since the DS record response is marked as authoritative (AA = 1), but the NS record data on the parent side of a zone cut is not authoritative (AA = 0), the server is unable to merge the responses, and the NS QTYPE is omitted from the MQTYPE-Response field. the parent-side NS drama is real 🎭
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33333
;; flags: qr aa
;; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; MQTYPE-Response: [empty]
;; QUESTION SECTION:
;example.com. IN DS
;; ANSWER SECTION:
example.com. 86185 IN DS 370 13 2 [...]
example.com. 86185 IN RRSIG DS [...] com. [...]Figure 5: Recursive DS and NS
Acknowledgements 💜
The author wishes to thank the following for their feedback and reviews during the initial development of this document: Michael Graff, Olafur Gudmundsson, Matthijs Mekking, and Paul Vixie.
In addition, the author wishes to thank the following for subsequent reviews during discussion in the DNSSD Working Group: Chris Box, Stuart Cheshire, Esko Dijk, Ted Lemon, David Schinazi, and Petr Spacek. thank you, legends 🫶
Author's Address
Ray Bellis
Internet Systems Consortium, Inc.
PO Box 360
Newmarket, NH 03857
United States of America
Phone: +1 650 423 1300
Email: ray@isc.org📦 where this page comes from
- ietf: rfc10029 2026-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms