@duponin @bortzmeyer "I can't work out how to make sure the query is well-formed, neither find a validation tool anywhere" That part should be easy. Any good DNS library should have the equivalent of `to_wire/from_wire` methods (they are called like that in DNSPython), which allows to either pass a buffer of bytes as captured in theory from network and see how they are parsed, or the opposite.