DNS

DNS - Domain Name System

Pithy

Mapping between names and addresses is the main function of DNS.
DNS has other features, but almost all exist to support this objective.

Queries and responses

Request: DNS query has a name and a record type.
Answer: set of resource records (RR) or a response saying the record doesn’t exist.
Servers that don’t know the answer to a query return resource records to help the client find it.

DNS Namespace

DNS namespace is organized in a tree that has both forward mappings and reverse mappings.

• Foward mappings: hostnames → IP addresses (and other records)
• Reverse mappings: IP addresses → hostnames

To allow the same DNS system to manage both names and IP addresses:

• the IP branch of the namespace is inverted by listing the octets of the IP address backwards.

Question

Why are IP addressses reversed?

Answer

You’ll agree if we want to search from top down for the ip 63.173.189.1 we’d have to start with the most generic 63 and work down right?
Well we can’t just look up 63 so…

1. We need to prepend 63. to the suffix in-addr.arpa. so it’s a fqdn (a requirement of dns queries), in-addr.arpa indicates as well to the dns server that we’re looking in a reverse zone.
2. Now we need to narrow down further so let’s prepend another octect to get more specific 173.63.in-addr.arpa. As you can see we’re builing the reverse record naturally, just the same as we would for atrust.com -> nubard.atrust.com.

Question

What are “regular” dns records part of the “forward-zone”

Answer

hostname to address was DNS’s original primary lookup direction, “reverse” (address to hostname) was later added, making the inverse “forward”.

Question

What’s with the . (root)

Answer

. means it’s a FQDN, in a similar way is relative home/mat and /home/mat is absolute. It just tells the dns server to start at the top when searching for the corresponding record.

Hows DNS works

Name servers

Definition

Zone: Nameservers have an abstraction called zone, which is the unit of DNS delegation and administration

An authoritative answer from a name server is “guaranteed” to be accurate; a nonauthoritative answer might be out of date

Resource Records

A resource record (RR) is one line in a zone file: name TTL class type rdata. It maps a DNS name to some data — an IP, a mail server, a canonical name, etc. Type determines what rdata means.

Caching

A cached answer is almost free and is usually correct because hostname-to-address mappings change infrequently.
An answer is saved for a period of time called the “time to live” (TTL), which is specified by the owner of the data record in question.

Tools for debugging

# Simplier and pretty output
nslookup
host 
# More details
dig
drill
delv # as in delve deeper than dig

dig

dig +trace docs.pawney.net
dig @192.168.2.1 docs.pawney.net # force a ns with @

parsing the output

Header

# NOERROR = no notable error
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16620
# NXDOMAIN = requested name doesn't exist
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6134 

Answer section

# the answer field is the actual response which resolves the hostname to an ip
;; ANSWER SECTION:
docs.pawney.net.        282     IN      A       172.64.80.1

The DNS Database

Resource Records

Basic format of a resource record

[name] [ttl] [class] type data

# special characters in resource records
;  # comment
@  # the current zone name
() # allow data to span lines
*  # wild card (name field only)

A name can be either relative or absolute. Absolute names end with a dot and are complete. Internally, the software deals only with absolute names; it appends the current origin and a dot to any name that does not already end in a dot. This feature allows names to be shorter, but it also invites mistakes.

The ttl (time to live) field specifies the length of time, in seconds, that the record can be cached and still be considered valid

• By convention, SOA record comes first, followed by NS records
• Records for each host are typically grouped together
• Common to sort by name field; some sites sort by IP address instead (makes unused addresses easier to spot)

Gotchas with records Records

Question

What’s the point in MX records, when A records also map hostname to IP

Answer

MX adds priority values and redudancy which plain A records have no way to express

example.com.  MX  10  mail1.example.com.
example.com.  MX  20  mail2.example.com. # mx allows a fallback here and maps the A records
mail1.example.com.  A  203.0.113.10
mail2.example.com.  A  203.0.113.20

Note: this only works for SMTP clients, no other software will try to use the MX record as a client

SRV records

SRV records are a general version of what MX records do. They let you listen and route to different hosts based on priorities. In otherworths it’s like CNAME load balancing.

example

# contrived example of two ssh servers
_ssh._tcp.example.com.  300  IN  SRV  10 60 22 ssh1.example.com.
_ssh._tcp.example.com.  300  IN  SRV  10 40 22 ssh2.example.com.
dig _ssh._tcp.example.com SRV # then client could ssh to the reponse

DNS Server (resolver) Security

DNSSEC

DNSSEC validation normally happens resolver <-> authoritative, not client <-> resolver. Client to server is DoT/DoH.

It’s main purpose is to ensure resolver servers lookups of records to authoritative servers are cryptographically signed and cannot be forged. If they were forged the client would get served the forged record and could be sent the wrong address.

DNS Client Security

Note

TODO! DoT/DoH