How can you detect EDNS0 usage in DNS traffic?

• A. Look for an OPT pseudo-record in the DNS message, indicating EDNS0; Wireshark labels EDNS0.
• B. Look for NXDOMAIN responses.
• C. Look for Transfer-Encoding: chunked.
• D. Look for Window Scale in TCP handshake.

Answer: (A)

Detecting EDNS0 hinges on recognizing the OPT pseudo-record that EDNS0 uses. When EDNS0 is in use, the DNS message includes an OPT resource record in the Additional section (type 41). This OPT record is not a normal answer data item; it’s a signal that EDNS0 is being applied, carrying options like the maximum UDP payload size and other EDNS settings. In practice, Wireshark will label this as EDNS0 and show the OPT record details, confirming EDNS0 usage.

The other options don’t indicate EDNS0: NXDOMAIN is simply a DNS response code meaning the domain doesn’t exist, Transfer-Encoding: chunked is an HTTP concept, and Window Scale is a TCP handshake option.