# Dns message validate

`dns-message-validate` · version 1.0.0 · Communications · free, no key needed

Validate DNS message hex structure: counts, names, compression, and OPT records.

**Use when you need to: validate dns message wire structure · check dns packet section counts · is this dns hex structurally valid.**

## Decide before calling

Read the [versioned contract](/v1/tools/dns-message-validate/versions/1.0.0) and the supported scope below. Reuse `dns-message-validate@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `dns-message-validate@1.0.0` for validate dns message wire structure. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- validate dns message wire structure
- check dns packet section counts
- is this dns hex structurally valid
- find a truncated dns message
- check dns compression pointer safety
- accept or reject a dns message shape
- בדיקת מבנה של הודעת די אן אס

## Not supported

- return the parsed questions and records
- repair a malformed dns message
- check dnssec or authenticate the sender
- explain individual header flag names

## Behavior

- A lowercase even-length hex string within the byte cap is checked as one RFC 1035 message. Syntax that is not hex throws invalid_input. A message past a declared cap throws limit_exceeded before the structural walk when the cap is visible up front.
- A structurally illegal message returns valid false, a snake_case reason, the decoded byte length, zero section counts, and the byte offset of the failure. Reasons include truncated_header, truncated_name, truncated_record, truncated_rdata, truncated_opt, trailing_bytes, reserved_label, bad_pointer, forward_pointer, compression_loop, opt_name, opt_section and multiple_opt.
- A non-zero header Z is valid. The TC bit alone does not make a complete message invalid. Unknown type, class, opcode and RCODE values are valid. OPT framing follows RFC 6891 Section 6.
- On success, reason and offset are null and the section counts are the header counts. opt_count is 0 or 1.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `message_hex` (string, required): min length 0; max length 1024; pattern `^([0-9a-f]{2})*$`

## Output

- `valid` (boolean, required)
- `reason` (string or null, required): min length 1
- `message_bytes` (integer, required): min 0; max 512
- `question_count` (integer, required): min 0; max 32
- `answer_count` (integer, required): min 0; max 32
- `authority_count` (integer, required): min 0; max 32
- `additional_count` (integer, required): min 0; max 32
- `opt_count` (integer, required): min 0; max 1
- `offset` (integer or null, required): min 0; max 512

## Limits

- max message bytes: 512
- max hex chars: 1024
- max records: 32
- max name octets: 255
- max label octets: 63
- max pointer hops: 16
- max rdata bytes: 489
- max opt options: 16

## Example

Request input:

```json
{
  "message_hex": "03e50800000000010000000000000100010000000000040a010034"
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "reason": null,
    "message_bytes": 27,
    "question_count": 0,
    "answer_count": 1,
    "authority_count": 0,
    "additional_count": 0,
    "opt_count": 0,
    "offset": null
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "dns-message-validate",
  "version": "1.0.0",
  "input": {
    "message_hex": "03e50800000000010000000000000100010000000000040a010034"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/dns-message-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"message_hex":"03e50800000000010000000000000100010000000000040a010034"}'
```

The machine-readable contract is at [/v1/tools/dns-message-validate/versions/1.0.0](/v1/tools/dns-message-validate/versions/1.0.0).

### CLI

```sh
node cli.mjs run dns-message-validate 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Email address list validate](/tools/email-address-list-validate): Check RFC 5322 address-list syntax, including dots, quotes, comments, and groups.
- [Email mailbox validate](/tools/email-mailbox-validate): Check one RFC 5322 mailbox for syntax only and return a stable reason code.
- [Dns message encode](/tools/dns-message-encode): Encode a structured DNS message to canonical uncompressed RFC 1035 wire hex.
- [Dns message parse](/tools/dns-message-parse): Parse a DNS message hex string into the RFC 1035 header, questions, and resource records.
- [Dns header flags explain](/tools/dns-header-flags-explain): Explain an RFC 1035 DNS header flags word, with reserved Z as an integer 0 through 7.
- [Dns rdata decode](/tools/dns-rdata-decode): Decode DNS RDATA hex for A, AAAA, NS, CNAME, PTR, MX, TXT, SOA, SRV, or unknown.