| dns.count.add_rr | Additional RRs | Unsigned 16-bit integer | Number of additional records in packet |
| dns.count.answers | Answer RRs | Unsigned 16-bit integer | Number of answers in packet |
| dns.count.auth_rr | Authority RRs | Unsigned 16-bit integer | Number of authoritative records in packet |
| dns.count.queries | Questions | Unsigned 16-bit integer | Number of queries in packet |
| dns.flags | Flags | Unsigned 16-bit integer | |
| dns.flags.authenticated | Answer authenticated | Boolean | Was the reply data authenticated by the server? |
| dns.flags.authoritative | Authoritative | Boolean | Is the server is an authority for the domain? |
| dns.flags.checkdisable | Non-authenticated data OK | Boolean | Is non-authenticated data acceptable? |
| dns.flags.opcode | Opcode | Unsigned 16-bit integer | Operation code |
| dns.flags.rcode | Reply code | Unsigned 16-bit integer | Reply code |
| dns.flags.recavail | Recursion available | Boolean | Can the server do recursive queries? |
| dns.flags.recdesired | Recursion desired | Boolean | Do query recursively? |
| dns.flags.response | Response | Boolean | Is the message a response? |
| dns.flags.truncated | Truncated | Boolean | Is the message truncated? |
| dns.id | Transaction ID | Unsigned 16-bit integer | Identification of transaction |
| dns.length | Length | Unsigned 16-bit integer | Length of DNS-over-TCP request or response |