This entry type encodes the complete passive DNS payload. The RRset owner name is encoded at the beginning of the key so that “forward” lookups can be performed on the owner name. The owner name is encoded with labels reversed from the usual DNS order to increase locality and allow for wildcard matches. (For example, "*.example.com".)

The key is a packed tuple consisting of the following fields, in order:

The value consists of the following fields, in order:

This entry type encodes only the RRset owner name in the usual “forward” direction. This entry type provides an “index” into the ENTRY_TYPE_RRSET “table” so that RRsets whose owner names start with a particular subsequence of labels can be found. (For example, looking up the label subsequence "www.example.*" using this index would reveal the existence of the domain names "www.example.com", "www.example.net", etc.)

The key consists of the following fields, in order:

In versions before 0.12.0, there was no value associated with this entry type. As of that version, the value is an RRtype union described above.

This entry type encodes individual Resource Record data values; that is, an RRset containing multiple Resource Records will be encoded as multiple entries in this “table”.

The key consists of the following fields, in order:

The Rdata length field is encoded at the end of the key so that searches can be performed over the Rdata field without needing to know the length of the record data value in advance (or worse, needing to iterate over all possible length values).

An additional ENTRY_TYPE_RDATA entry is produced for DNS records which encode a domain name but do not begin with one (i.e. DNS records which contain a DNS domain name offset into the latter part of the record data):

If those record types had been laid out in the applicable DNS RFCs with the domain name at the beginning of the record data the following hack would not be necessary in order to make these record types easily searchable by domain, or for records of different rrtypes that reference the same domains to cluster together. This sub-type “slices” the record data so that the domain name in the latter part of the record appears at the beginning of the key and the initial bytes of the record appear just before the Rdata length field at the end of the key. That is, the key consists of the following fields, in order:

The number of bytes in the initial data slice is implicit (the difference between the dnstable entry value length and the sum of the sizes of all previously described mandatory fields, once decoded.) An entry can be determined to be either a sliced or un-sliced record by whether or not this implicit initial data slice length is non-zero or zero, respectively.

The value consists of the following fields, in order:

This is the same encoding as the values for ENTRY_TYPE_RRSET entries.

This entry type encodes label-reversed domain names from the record data value for certain DNS record types that contain a domain name in the record data, specifically the SOA, NS, CNAME, DNAME, PTR, MX, SRV, SVCB, and HTTPS DNS record types. The "slicing" logic described above in ENTRY_TYPE_RDATA encompasses the extraction of these domain names.

The key consists of the following fields, in order:

In versions before 0.12.0, there was no value associated with this entry type. As of that version, the value is an RRtype union described above.

This entry type encodes the overall time range of all ENTRY_TYPE_RRSET and ENTRY_TYPE_RDATA entries in a dnstable data set, i.e. the earliest first timestamp and latest last timestamp of all such entries.

The key consists of:

The value consists of the following fields, in order:

This entry encodes a version number for the format of another entry type. Each of the above entry types, with the exception of ENTRY_TYPE_TIME_RANGE may have an associated version number entry.

The key consists of the following fields, in order:

The value consists of:

Key:

Value:

Final key:

"\x00\x03com\x07example\x00\x02\x03com\x00\x11\x03ns1\x07example\x03com\x00\x11\x03ns2\x07example\x03com\x00"

Final value:

"\x90\xb9\xe6\xfb\x04\xa0\x87\xe7\xfb\x04\x17"

Key:

Value:

Final key:

"\x01\x07example\x03com\x00"

Final value:

"\x02"

Key:

Value:

Final key:

"\x02\x03ns1\x07example\x03com\x00\x02\x03com\x07example\x00\x00\x11"

Final value:

"\x90\xb9\xe6\xfb\x04\xa0\x87\xe7\xfb\x04\x17"

Key:

Value:

Final key:

"\x02\x03ns2\x07example\x03com\x00\x02\x03com\x07example\x00\x00\x11"

Final value:

"\x90\xb9\xe6\xfb\x04\xa0\x87\xe7\xfb\x04\x17"

Key:

Value:

Final key:

"\x03\x03com\x07example\x03ns1\x00"

Final value:

"\x02"

Key:

Value:

Final key:

"\x03\x03com\x07example\x03ns2\x00"

Final value:

"\x02"

Key:

Value:

Final key:

"\x00\x03org\x03isc\x03www\x01\x03org\x03isc\x00\x04\x95\x14\x40\x2a"

Final value:

"\x90\xb9\xe6\xfb\x04\xa0\x87\xe7\xfb\x04\x01"

Key:

Value:

Final key:

"\x01\x03www\x03isc\x03org\x00"

Final value:

"\x01"

Key:

Value:

Final key:

"\x02\x95\x14\x40\x2a\x01\x03osc\x03isc\x03www\x00\x00\x04"

Final value:

"\x90\xb9\xe6\xfb\x04\xa0\x87\xe7\xfb\x04\x01"