Domain name system

BY: MAHAKANT SHARMA
Internee Cyber Peace Foundation
MTech in Cyber Security Student in Rashtriya Raksha University.

AGENDA
• What is DNS?
• How does DNS work?
• DNS servers involved in loading a webpage
• difference between an authoritative DNS server and a
recursive DNS resolver?
• steps in a DNS lookup
• What is a DNS resolver?
• What are the types of DNS Queries?
• What is DNS caching? Where does DNS caching occur?

WHAT IS DNS?
The Domain Name System (DNS) is the phonebook of the
Internet. Humans access information online through domain
names, like nytimes.com or espn.com. Web browsers interact
through Internet Protocol (IP) addresses. DNS translates domain
names to IP addresses so browsers can load Internet resources.
Each device connected to the Internet has a unique IP address
which other machines use to find the device. DNS servers
eliminate the need for humans to memorize IP addresses such as
192.168.1.1 (in IPv4), or more complex newer alphanumeric IP
addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).

HOW DOES DNS WORK?
• The process of DNS resolution involves converting a hostname (such as
www.example.com) into a computer-friendly IP address (such as 192.168.1.1).
An IP address is given to each device on the Internet, and that address is
necessary to find the appropriate Internet device - like a street address is used
to find a particular home. When a user wants to load a webpage, a translation
must occur between what a user types into their web browser (example.com)
and the machine-friendly address necessary to locate the example.com
webpage.
• In order to understand the process behind the DNS resolution, it’s important to
learn about the different hardware components a DNS query must pass between.
For the web browser, the DNS lookup occurs “ behind the scenes” and requires
no interaction from the user’s computer apart from the initial request.

4 DNS SERVERS INVOLVED IN LOADING A
WEBPAGE
• DNS recursor - The recursor can be thought of as a librarian who is asked to go find a particular book
somewhere in a library. The DNS recursor is a server designed to receive queries from client machines
through applications such as web browsers. Typically the recursor is then responsible for making
additional requests in order to satisfy the client’s DNS query.
• Root nameserver - The root server is the first step in translating (resolving) human readable host
names into IP addresses. It can be thought of like an index in a library that points to different racks of
books - typically it serves as a reference to other more specific locations.
• TLD nameserver - The top level domain server (TLD) can be thought of as a specific rack of books in a
library. This nameserver is the next step in the search for a specific IP address, and it hosts the last
portion of a hostname (In example.com, the TLD server is “com”).
• Authoritative nameserver - This final nameserver can be thought of as a dictionary on a rack of
books, in which a specific name can be translated into its definition. The authoritative nameserver is
the last stop in the nameserver query. If the authoritative name server has access to the requested
record, it will return the IP address for the requested hostname back to the DNS Recursor (the
librarian) that made the initial request.

WHAT'S THE DIFFERENCE BETWEEN AN
AUTHORITATIVE DNS SERVER AND A RECURSIVE
DNS RESOLVER?
Recursive DNS resolver Authoritative DNS server
The recursive resolver is the computer
that responds to a recursive request
from a client and takes the time to track
down the DNS record. It does this by
making a series of requests until it
reaches the authoritative DNS
nameserver for the requested record (or
times out or returns an error if no record
is found). Luckily, recursive DNS
resolvers do not always need to make
multiple requests in order to track down
the records needed to respond to a
client; caching is a data persistence
process that helps short-circuit the
necessary requests by serving the
requested resource record earlier in the
Put simply, an authoritative DNS server
is a server that actually holds, and is
responsible for, DNS resource records.
This is the server at the bottom of the
DNS lookup chain that will respond with
the queried resource record, ultimately
allowing the web browser making the
request to reach the IP address needed
to access a website or other web
resources. An authoritative nameserver
can satisfy queries from its own data
without needing to query another
source, as it is the final source of truth
for certain DNS records.

WHAT'S THE DIFFERENCE BETWEEN AN
AUTHORITATIVE DNS SERVER AND A RECURSIVE
DNS RESOLVER?
Recursive DNS resolver Authoritative DNS server

THE 8 STEPS IN A DNS LOOKUP
• A user types ‘example.com’ into a web browser and the query travels into the Internet and is received by a DNS
recursive resolver.
• The resolver then queries a DNS root nameserver (.).
• The root server then responds to the resolver with the address of a Top Level Domain (TLD) DNS server (such
as .com or .net), which stores the information for its domains. When searching for example.com, our request is
pointed toward the .com TLD.
• The resolver then makes a request to the .com TLD.
• The TLD server then responds with the IP address of the domain’s nameserver, example.com.
• Lastly, the recursive resolver sends a query to the domain’s nameserver.
• The IP address for example.com is then returned to the resolver from the nameserver.
• The DNS resolver then responds to the web browser with the IP address of the domain requested initially.
• Once the 8 steps of the DNS lookup have returned the IP address for example.com, the browser is able to make
the request for the web page:
• The browser makes a HTTP request to the IP address.

WHAT IS A DNS RESOLVER?
• The DNS resolver is the first stop in the DNS lookup,
and it is responsible for dealing with the client that
made the initial request. The resolver starts the
sequence of queries that ultimately leads to a URL
being translated into the necessary IP address.
• Note: A typical un cached DNS lookup will involve both
recursive and iterative queries.
• It's important to differentiate between a recursive DNS
query and a recursive DNS resolver. The query refers to
the request made to a DNS resolver requiring the
resolution of the query. A DNS recursive resolver is the
computer that accepts a recursive query and processes
the response by making the necessary requests.

WHAT ARE THE TYPES OF DNS QUERIES?
• Recursive query - In a recursive query, a DNS client requires that a DNS server (typically a
DNS recursive resolver) will respond to the client with either the requested resource
record or an error message if the resolver can't find the record.
• Iterative query - in this situation the DNS client will allow a DNS server to return the best
answer it can. If the queried DNS server does not have a match for the query name, it will
return a referral to a DNS server authoritative for a lower level of the domain namespace.
The DNS client will then make a query to the referral address. This process continues with
additional DNS servers down the query chain until either an error or timeout occurs.
• Non-recursive query - typically this will occur when a DNS resolver client queries a DNS
server for a record that it has access to either because it's authoritative for the record or
the record exists inside of its cache. Typically, a DNS server will cache DNS records to
prevent additional bandwidth consumption and load on upstream servers.

WHAT IS DNS CACHING? WHERE DOES DNS
CACHING OCCUR?
• The purpose of caching is to temporarily stored data in a
location that results in improvements in performance and
reliability for data requests. DNS caching involves storing data
closer to the requesting client so that the DNS query can be
resolved earlier and additional queries further down the DNS
lookup chain can be avoided, thereby improving load times and
reducing bandwidth/CPU consumption. DNS data can be cached
in a variety of locations, each of which will store DNS records
for a set amount of time determined by a time-to-live (TTL).

WHAT IS DNS CACHING? WHERE DOES DNS
CACHING OCCUR?
Browser DNS caching Operating system (OS) level DNS caching
Modern web browsers are designed by
default to cache DNS records for a set
amount of time. the purpose here is
obvious; the closer the DNS caching
occurs to the web browser, the fewer
processing steps must be taken in order
to check the cache and make the correct
requests to an IP address. When a request
is made for a DNS record, the browser
cache is the first location checked for the
requested record.
In chrome, you can see the status of your
DNS cache by going to chrome://net-
internals/#dns.
The operating system level DNS resolver is
the second and last local stop before a
DNS query leaves your machine. The
process inside your operating system that
is designed to handle this query is
commonly called a “stub resolver” or DNS
client. When a stub resolver gets a request
from an application, it first checks its own
cache to see if it has the record. If it does
not, it then sends a DNS query (with a
recursive flag set), outside the local
network to a DNS recursive resolver inside
the Internet service provider (ISP).
When the recursive resolver inside the ISP
receives a DNS query, like all previous

Domain name system

More Related Content

What's hot

Similar to Domain name system

Recently uploaded

Domain name system