Domain Name System (DNS)

Overview

Structure of the DNS Directory

The DNS Tree

Reserved TLDs

• .test - is recommended for use in testing of current or new DNS related code.
• .example - is recommended for use in documentation or as examples.
• .invalid - is intended for use in online construction of domain names that are sure to be invalid and which it is obvious at a glance are invalid.
• .localhost - This TLD has been statically defined in host DNS implementations as having an 'A' record pointing to the loopback IP address (127.0.0.1) and is reserved for this purpose. Any other use would conflict with widely deployed code which assumes this use.

Root Name Servers

Mail Names

Operation of DNS

• The first task is that of the Name Server that details the tree-structured Domain Name Space and carries out the mapping between names and IP addresses (Domain Name Manager) by way of Resource Records.
• The second task is that of the Resolver, which asks another name server for the answer if the local one cannot find the mapping asked for by the DNS client. If that name server cannot find the answer it asks another name server further up the tree until a name server is found that has the answer in its cache or it is an authoritative name server that looks after this zone and does not need to ask another name server. This can take a number of seconds sometimes, such that the DNS client application times out. A retry normally resolves this.

1. The client sends a DNS query for the IP address of 'www.example.com' to its configured local DNS server.
2. If the local name server has the IP address then it sends this back in a reply to the client. If the name server checks its database and realises that it has not yet resolved this name, so it breaks the domain name into portions to see if it knows any of the portions or whether it can forward on the query to a name server that does know e.g. it starts with 'www.example.com', then 'example.com', then just '.com' each time forwarding queries onwards i.e. it performs recursive lookups.
3. Then the local DNS sends a query to one of the root name servers e.g. a.root-servers.net. All DNS servers are pre-configured with the root name servers that can be amended over time as the need arises.
4. The root name server knows all the '.com' name servers and so sends a Referral to one of them e.g. b.gtld-servers.net i.e. the root name server tells the local name server to try the .com server.
5. The local name server repeats the request but directs it at the '.com' server.
6. The '.com' server searches its database and finds that it knows an authoritative domain name server for the domain example.com e.g. 'authority.example.com'. This server tells the local DNS to try 'authority.example.com'.
7. The local name server repeats the request again but directs it at the 'authority.example.com' server.
8. The authoritative name server has an entry for 'www.example.com' in its database and therefore sends a DNS response with the IP address of 'www.example.com' back to the originating local name server. The Response will have the Authoritative Bit set.
9. The local DNS then forwards this response to the client that originated the query in the first place and also caches the IP address for future requests. The length of time that the answer remains cached is dependent on the Time to Live (TTL) which is set on a server-by server basis.

The DNS Protocol

• ID - The Identifier is created by the program to represent the query. Replies use this identifier so that requests and replies can be matched.
• QR - This bit is 0 for a query, or 1 for a response.
• OPcode - This has a value of 0 for a standard query, 1 for an inverse query and 2 for a status request.
• AA - if a response has this bit set to 1, then the response comes from an Authoritative server.
• TC - Truncated means that the message was longer than the bandwidth would allow.
• RD - Recursive Desired means that the query wants the server to pursue the request recursively.
• RA - The response has this bit set to 1 if recursive querying is available on the server.
• Z - This is unused and is zero for all queries and responses.
• Rcode - The Response Code has the following values:
  • 0 - No error
  • 1 - Format error, the server did not understand the query
  • 2 - Server failure, either the server is not functioning correctly or has failed to obtain a response after forwarding on the request.
  • 3 - Name error, only the authoritative server would set this value
  • 4 - Not implemented, the server does not carry out this function
  • 5 - Refused
• QDcount - The number of queries in the question part of the packet
• ANcount - The number of Resource Records in the answer part
• NScount - The number of Name Server resource records in the Authority Records part
• ARcount - The number of resource records in the Additional Records part

• Qname - The target domain-name is presented as a sequence of labels, each label consisting of a length octet followed by that number of octets. The domain name ends with the zero length octet for the null label of the root as described earlier. This DNS server looks for RRs that match the specified Qtype and Qclass. If it does not have a match, this server can point to a DNS server that may have a match instead.
• Qtype - Specifies the type of query e.g. A, PTR, AXFR, MAILB etc.
• Qclass - Specifies the class of query, e.g. IN for Internet, CH for Chaos.

• Name - or 'Owner', the Domain name where the resource resides
• Type - A type code indicating the type of data in Rdata, this is a 16 bit field that defines the type of RR:
  • A - Host address i.e. an 'A' record, or 'Answer' record. This is a successful resolution response.
  • CNAME - Canonical name of the Alias. This is used if you want to do a hostname to hostname association rather than a hostname to IP address association. This is useful if you have a number of hostnames associated with one IP address i.e. one computer has a number of names associated with it such as www.example.com and ftp.example.com.
  • HINFO - CPU type and OS used by the host
  • MX - Domain Mail Exchange
  • NS - Authoritative Name Server for the Domain, used in DNS Referrals.
  • PTR - a pointer to another part of the Domain space by host name, used with inarpa.addr when performing reverse DNS lookups.
  • SOA - Start of a Zone of Authority
• Class - The class of data in Rdata, this is a 16 bit field identifying a protocol family, IN for Internet and CH for Chaos system
• TTL - Identifies in seconds, how long the Resource Record (RR) should be kept in the DNS cache of non-authoritative servers. The lower this value, the greater the bandwidth used for zone information. Normally a few hours is short enough.
• RDlength - Length of Rdata in octets
• Rdata - Variable length description of the resource which contains the data for whatever Type (see above) the RR contains i.e.
  • A - for IN, a 32 bit IP address, for CH, a 16 bit octal address
  • CNAME - a domain name alias
  • MX - a 16 bit preference value and host address of a Mail Exchange; the lower the number, the more preferred the Exchange is. This MX record handles mail requests from the Mail server. You can have a number of MX records, hence the preference value. If a mail server sends a request and no MX record exists, then the resolver performs an A record lookup and a connection to that IP address is made on port 25 (SMTP) anyway.
  • NS - Authoritative Name Server for the Domain
  • PTR - a pointer to another part of the Domain space, this is a domain name or host name
  • SOA - Start of a Zone of Authority information
• Pointer - For compression purposes, a pointer is used to point to multiple occurrences of a domain name within the data. The pointer occurs at the end of the list of labels. Labels are identified by 00 whilst a pointer is identified by 11 followed by an offset value.

Zone Transfers

Start of Authority (SOA)

@ IN SOA ns hostmaster (

	2001112301
	4H
	1H
	5D
	24H)

• @ - hostname of the master name server, this gets swapped with the domain name (e.g. rhyshaden.com) when BIND loads the zone file.
• ns - name server, this is the name of the name server holding the zone information (authoritative Master server) and is automatically completed and advertised as a FQDN e.g. ns.rhyshaden.com. The Slave servers query the master server i.e. this name, for the zone. The master server does not need to query anyone for the zone.
• hostmaster - this is the e-mail address for the individual that controls the zone e.g. hostmaster@rhyshaden.com. Rather than just enter 'hostmaster' here, you could enter a FQDN in order to use an e-mail address outside of the e.g. for 'rhyshaden@somecompany.co.uk' you would use 'rhyshaden.somecompany.co.uk'.
• 2001112301 - is a serial number indicating to the slaves the version number of the zone information. The format is yyyymmddxx i.e. in date form with the last two digits being the version for that day. The slave servers check the SOA first when looking to update the zone information, if this number is newer than their copy, they will download the new zone file information.
• 4H - 4 hours has been set for the Refresh time which is the length of time the zone is stored in the slave servers before they check the master for an updated copy.
• 1H - 1 hour has been set for the Retry time. When a slave first comes on line it immediately tries to download a copy of the zone from the master. If this fails, then the slave will retry every so often according to this retry time.
• 5D - 5 days has been set for the Expire time. If the master becomes unavailable for a period of time, the slave servers will keep the zone alive for this period.
• 24H - 24 hours has been set as the Minimum time that the zones can live on in the slave servers.

Other record examples

IN NS ns
IN A 10.1.1.1
IN MX 10 mail

ns A 10.2.2.2
www CNAME @