Which DNS field stores the domain name in a DNS query?

• A. dns.qry.name
• B. dns.qry.type
• C. dns.qry.class
• D. dns.a

Answer: (A)

In DNS, the name being looked up is carried in the Question section as QNAME. In Wireshark, this is exposed as dns.qry.name, which shows the actual domain being queried. The other fields describe the rest of the query: dns.qry.type is the QTYPE (the kind of record requested, like A for IPv4 addresses), dns.qry.class is the QCLASS (usually IN for Internet), and dns.a refers to A records in the answer portion, not the query itself. So the field that stores the domain name in a DNS query is dns.qry.name.