 Hello, Didier Stevens here with the third video on my DNS resolver tool, here the command we are going to look at is the Rcode command. It's something that I needed when I was asked what the query status field in Sysmon was, what value was it, and it turns out that query status field is actually the Rcode plus 9000. I explained this here in this blog post. So let's see how we can run this. Let's start by looking at the man page and here you can see that Rcode is quite simple. The type is Rcode, you need to provide a label which is mandatory and that's it. So let's do this. So Rcode and the label, let's say test Rcode. It runs and now I can do an Ness lookup. So the type I'm just going to do A and I'm going to select an Rcode of 0 because the Rcode that you want to return in your, that you want to have returned in your reply to your query is just the number that you put in front. And then here you type the label for this command. So that's test Rcode and then here this can be anything. And I point this to my machine and here now we have received an Rcode with value 0. Now Rcode 0 means that it succeeded but here that's how I implemented it. There is no answer and there are no records, answer records in the reply. So you get this here, this message. If we now try out one, one, if the Rcode is one then it means there is format error. Two that is server failed, three that is non-existing domain. So if you get an NX domain, yeah, it's actually Rcode 3 and so on. So this way you can test all these values.