Day 2 - DNS: Names and Addresses

📌 Key Takeaways

• DNS is the system that converts domain names into IP addresses. The port is 53.
• A domain is a hierarchy, in the order root (.) → top-level (TLD) → second-level → host.
• Name → IP is a forward lookup, and IP → name is a reverse lookup.
• Memorize the record types — A (IPv4) · AAAA (IPv6) · MX (mail) · CNAME (alias) · NS (name server) · PTR (reverse).
• The lookup commands are nslookup · dig · host, and the Linux DNS server program is BIND.

What DNS Does

   What happens when you type www.example.com?
 
   1  Check /etc/hosts first                (if it is there, you are done here)
   2  Ask the DNS server in /etc/resolv.conf
   3  The DNS server tells you 93.184.216.34
   4  Connect to that IP

• People use names and computers use numbers. DNS is what bridges the two.
• Without DNS, connecting by IP works but connecting by name does not. This is a clue for diagnosing problems.
• In the early days of the Internet there was no DNS. The names and addresses of all computers were written in a single file, and everyone downloaded and used it. When the number of computers grew and that approach became unmanageable, DNS appeared, splitting names into a hierarchy and managing each zone separately. /etc/hosts is a relic of that old approach.
• So the core idea of DNS is that "no single place knows everything." Each server knows only its own zone, and for anything it does not know, it only tells you whom to ask.

The Domain Hierarchy

                    .  (root)
         ┌──────────┼──────────┐
        com        kr         org        ← Top-level domains (TLD)
         │          │
      example    co.kr                   ← Second-level domains
         │          │
       www       naver                   ← Hosts

• A complete name that includes the trailing dot, like www.example.com., is called an FQDN (Fully Qualified Domain Name).
• Read from the right, going up the hierarchy. com is above example.

• gov is for government, edu for education, and mil for military organizations. Questions about their purposes come up.

• Under kr, the labels are abbreviated to two letters. They are co (company), or (organization), go (government), and ac (academic). The trap is that the counterpart of edu is ac.kr, not ed.kr.
• A gTLD has three or more letters, while a ccTLD has exactly two. If it has two letters like kr, jp, or us, it is a country code.
• Domains are case-insensitive. WWW.Example.COM and www.example.com are the same.

Types of DNS Servers

• What we write in /etc/resolv.conf is usually the address of a caching server (for example, 8.8.8.8).
• A slave server replicates its information from the master. This is to prepare for failures and load.
• The master is also called the primary name server and the slave the secondary name server. This replication is called a zone transfer.

How a Lookup Actually Flows

This is what a caching server does when www.example.com is asked for the first time.

   My computer ──①──►  Caching server (8.8.8.8 as listed in /etc/resolv.conf)
                        │
                        ├──②──►  Root server       "com is known by that TLD server over there"
                        ├──③──►  com TLD server    "example.com is known by that name server over there"
                        └──④──►  Authoritative server for example.com  "It is 93.184.216.34"
                        │
   My computer ◄──⑤──  Caching server   (passes on the answer and remembers it for a while)

• It descends from top to bottom, in the same order as reading the domain from the right. Root → com → example.com.
• The root server does not know the answer. It only tells you where the servers in charge of the top-level domains are. Being at the top of the hierarchy does not mean "knowing everything".
• The caching server remembers the answer it received for a set time (TTL). If the same name is asked again, it skips ②~④ and answers right away. That is why the second lookup is faster, and also why changes to DNS information do not spread immediately.

Forward and Reverse

• Forward is what you use day to day. Reverse is used for things like verifying the trustworthiness of a mail server.

Resource Records

A is address, MX is mail, CNAME is alias, NS is name server, PTR is reverse — be sure to tell these five apart. Questions about MX (mail) in particular come up.

• AAAA (quad A) is for IPv6. If IPv4's A is 32 bits, IPv6 is 4 times that at 128 bits, so there are four A's.

• A and CNAME point to different targets. A points to an IP address, and CNAME points to another name. A name set up with CNAME has to be followed all the way to the A record at the end before you get an IP.
• MX points to a server name, not a mail address. The step in yesterday's mail delivery process where we asked DNS "where is the recipient's mail server?" is exactly this MX lookup.
• MX carries a priority number. The smaller the number, the sooner it is tried. If there are 10 and 20, mail goes to server 10 first, and if that fails, to server 20.
• PTR is the opposite direction of A. Spelled out, it stands for Pointer.

Lookup Commands

nslookup naver.com          # Simple lookup
host naver.com              # One-line summary
dig naver.com               # Detailed lookup
dig naver.com MX            # Mail servers only
dig -x 8.8.8.8              # Reverse lookup

$ nslookup www.example.com
Server:		8.8.8.8
Address:	8.8.8.8#53
 
Non-authoritative answer:
Name:	www.example.com
Address: 93.184.216.34

• Do not confuse the upper Address with the lower Address. The upper is the DNS server's address, and the lower is the answer you were looking for.
• "Non-authoritative" is not an error. Almost every ordinary lookup comes out this way.

$ dig www.example.com
 
;; QUESTION SECTION:
;www.example.com.		IN	A
 
;; ANSWER SECTION:
www.example.com.	3600	IN	A	93.184.216.34
 
;; SERVER: 8.8.8.8#53(8.8.8.8)

• The actual output is longer than this. The places to look are three: the question (QUESTION), the answer (ANSWER), and the server that answered (SERVER).
• One line of the ANSWER SECTION is in the order name · TTL (seconds) · IN · record type · value. The example above means "this answer may be remembered for 3600 seconds (1 hour)."
• dig displays names with a trailing dot (www.example.com.). This is the FQDN notation we saw earlier.

• Only dig puts @ before the server and needs -x for reverse lookups. With nslookup and host, if you just give an IP they automatically do a reverse lookup.
• All three commands only look things up. They do not change any settings. ping also shows a name converted to an IP, but it is not classified as a DNS lookup tool.

Related Files and Servers

• Since hosts comes before dns, /etc/hosts is consulted first. That is why values written there take priority over DNS.
• BIND (Berkeley Internet Name Domain) is the most widely used DNS server software. Just know the name.
• The product name is BIND, the daemon name is named, and the configuration file is /etc/named.conf (Red Hat family). Like Apache and httpd, the product and process names differ.

• In resolv.conf, write an IP, not a name. If you wrote the DNS server by name, DNS would be needed again to resolve that name.
• In an environment that obtains addresses automatically, DHCP hands out the DNS server addresses along with the IP, subnet mask, and default gateway. In that case /etc/resolv.conf is filled in by the system, not by a person. If something you edited by hand has reverted after a reboot, this is the case.
• DNS and DHCP do different jobs. DNS converts names to addresses, and DHCP hands out addresses. They appear side by side as wrong answer choices in practice questions.

Tomorrow we cover remote access and file transfer — TELNET, SSH, and FTP.

📖 Glossary

• DNS : A system that converts between domain names and IP addresses. The port is 53.
• FQDN : A complete domain name that includes the root.
• TLD : Top-level domain. Divided into gTLDs like com and org and ccTLDs like kr and jp.
• Authoritative server : A DNS server that actually holds the information for that domain.
• Caching server : A DNS server that looks things up on the user's behalf and stores the results.
• A record / AAAA record : Records that connect a name to an IPv4 address / an IPv6 address.
• MX record : A record that specifies the server that receives that domain's mail.
• BIND : DNS server software widely used on Linux. The daemon is named named.