---
title: "Query Format"
description: "
"
url: https://instituteofprovenance.org/docs/query-format
source: Institute of Provenance
---
# Query Format

Wire protocol messages are binary-encoded using a format inspired by DNS but extended for the larger payloads typical of content trust operations (certificate chains, Merkle proofs, fingerprint vectors).

## Header

The message header is 12 bytes:

```
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              ID               |QR|  Opcode |AA|TC|    Rcode    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          QD Count             |          AN Count             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          NS Count             |          AR Count             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
```

| Field | Bits | Description |
|-------|------|-------------|
| ID | 16 | Transaction identifier, copied from query to response |
| QR | 1 | 0 = query, 1 = response |
| Opcode | 4 | Operation type (0 = standard query, 1 = fingerprint search) |
| AA | 1 | Authoritative answer (response from a Certified Orbital) |
| TC | 1 | Truncated (response too large for transport, retry needed) |
| Rcode | 7 | Response code (0 = success, 1 = format error, 2 = server failure, 3 = name not found) |
| QD Count | 16 | Number of entries in the Question section |
| AN Count | 16 | Number of entries in the Answer section |
| NS Count | 16 | Number of entries in the Authority section |
| AR Count | 16 | Number of entries in the Additional section |

## Question Section

Each question entry specifies a name and record type to query:

| Field | Type | Description |
|-------|------|-------------|
| Name | length-prefixed string | The .xio domain name being queried |
| Type | uint16 | Record type (65001=XIO, 65002=Proof, 65003=XSIGN, 65004=XFPR) |
| Class | uint16 | Always 1 (IN) |

## Answer Section

Each answer entry contains a typed record:

| Field | Type | Description |
|-------|------|-------------|
| Name | length-prefixed string | The name this record applies to |
| Type | uint16 | Record type |
| Class | uint16 | Always 1 |
| TTL | uint32 | Cache duration in seconds |
| RDLength | uint16 | Length of the record data in bytes |
| RData | bytes | Type-specific record data |

The Authority and Additional sections use the same entry format.

## Name Encoding

Names are encoded as a sequence of length-prefixed labels, terminated by a zero-length label. For example, `example.xio` is encoded as:

```
[7] e x a m p l e [3] x i o [0]
```

This encoding is identical to DNS name encoding and supports the same compression mechanism (pointer labels) for repeated names within a message.

## Response Codes

| Code | Name | Description |
|------|------|-------------|
| 0 | NoError | Query completed successfully |
| 1 | FormErr | The query was malformed |
| 2 | ServFail | The server encountered an internal error |
| 3 | NXDomain | The queried name does not exist |
| 4 | NotAuth | The server is not authoritative for this name |
| 5 | Refused | The server refused to process the query |