Input / 04
Read what dig actually reported.
Text output is useful evidence, but it cannot reconstruct compression or every byte of the wire message.
Reviewed October 15, 2026
Keep one complete response
Paste the header, flag line, OPT section, record sections and received-size footer. The parser accepts one response at a time. Split a multi-query or +trace transcript before importing it. The public fallback sample is available as plain text.
dig @1.1.1.1 valid.mldsa44.dnstest.dev A +dnssec +bufsize=1232That command addresses a public test name. It does not modify DNS records. Run it from the network you want to observe, then save the result with its date, resolver and command. WireBudget parses pasted output; it does not run the command.
Read the flags separately
| Field | What the reader reports | What it cannot establish |
|---|---|---|
| TC | The message’s truncation bit | Whether a later retry succeeded |
| AD | The authenticated-data assertion represented in the header | Authenticity of pasted text or a complete PQ chain |
| DO | The DNSSEC OK flag in the OPT section | A cryptographic verification result |
| MSG SIZE rcvd | The client-reported DNS message length | Exact per-record offsets or network framing bytes |
Do not infer TCP from a large size
The reader recognizes explicit TCP/UDP markers on a SERVER or From line. It separately recognizes the standard truncation-and-retry notice. Older dig versions may print the retry notice without a transport marker in the final SERVER line; the result then says tcp-retry-reported. If neither appears, transport stays unknown even when the message is larger than the comparison budget.
Our 54-byte UDP transcript has no TCP retry notice because it was collected using +ignore. The 2563-byte fallback transcript reports a retry. Reading these together is more informative than treating either size alone as a connectivity verdict.
Supported text and failure states
The parser recognizes common BIND-style header and MSG SIZE rcvd lines, plus Received … B footers and explicit transport markers. RRSIG algorithm extraction uses full IN-class record lines in answer, authority or additional sections. A missing algorithm means none was recognized in that subset; it does not prove the response was unsigned.
Missing or repeated headers and size lines are rejected. Reformatted, translated or abbreviated output may not be supported. Use wire input for exact accounting, and consult the dig manual for your client’s output and option semantics.