Looking at RFC 1035 I am trying to determine what the proper response is for a packet that contains nothing but a DNS header, where all the "counts" are zero:
id short X
qdcount short 0
ancount short 0
nscount short 0
arcount short 0
<EOF>
Should this packet have any response? Should it be considered an error?
Any DNS query where qdcount is not equal to 1 should be rejected by the DNS server.
The returned error will most likely be "Format Error" (FORMERR, rcode=1), which is only logical, since a DNS query for nothing at all must be considered as malformed.
Finding official sources for this is pretty hard. I did find for the NSD server a bug report where it was tested and remarked : "QDCOUNT=0 makes it FORMERR".
For the BIND server, StackOverflow post What does QD stand for in DNS RFC1035 says this about QDCOUNT:
note that this field is useless now, because BIND has always rejected QDCOUNT != 1.
Potentially depends on the opcode specified in the header (there are several – query, notify, update, etc.) For regular queries RFC 1034 says:
A standard query specifies a target domain name (QNAME), query type (QTYPE), and query class (QCLASS) and asks for RRs which match.
I would interpret the use of the singular "target" etc. as a query always having exactly one record in the question section; anything else should return FORMERR.
There are variations (e.g. the obsolete IQUERY uses queries with at least one record in answer section, but empty question section), but I couldn't find any opcodes which would allow all sections to be empty.
Perhaps it is a 'meaningless QUERY'. (Have no actual experience to validate this.)
RFC-2671 section 4.5.4
The responder's maximum payload size can change over time, but can be reasonably expected to remain constant between two sequential transactions; for example, a meaningless QUERY to discover a responder's maximum UDP payload size, followed immediately by an UPDATE which takes advantage of this size.
