Its byte order is a weird mix of big endian and little endian, it has little enidan short integers(word) and big endian long integers. BTW, you should read the /usr/include/arpa/nameser_compat.h instead, because in your system, nameser.h is only a wrapper for nameser_compat.h, where the real DNS headers are defined, pay attention to the HEADER structure