Neural Nets

DNS Architecture And DNS Records

/ 8 min read

Download As PDF
dns, dns records, computer networks

Domain Name System

The Domain Name System (DNS) serves as a foundational component of the internet, translating human-readable domain names into IP addresses that computers use to communicate. This article explores DNS architecture and the various DNS record types, using the visual representations provided in the diagrams to outline how DNS functions and the roles of specific DNS records.

DNS Architecture

Picture By Aaron Filbert - Own work, CC BY-SA 4.0, Link

DNS Architecture Overview

The Above architecture diagram illustrates the flow of DNS resolution, highlighting key components involved in resolving a domain name to an IP address. Here’s a breakdown of each component -

1. Applications on the User’s Computer

  • Email Client / Web Browser: These applications initiate DNS queries when users try to access web pages or send emails. Each application often has its own application-specific cache, which stores DNS responses temporarily. For instance, a web browser might store DNS records for recently visited websites in its cache for a short period (usually seconds to a few minutes) to avoid repeated DNS queries.

2. Local Resolver

  • Local Resolver: The local resolver is the first DNS resolver encountered when an application initiates a DNS query. It is often part of the operating system’s network stack (e.g., nsswitch.conf in Unix-like systems or DNS Client in Windows).
  • Local Cache: This local resolver stores frequently accessed DNS responses in a local cache, which helps reduce DNS lookup time. Cached entries here obey a Time-To-Live (TTL) value that controls how long the entry can be kept before it must be refreshed.

3. Caching/Forwarding Resolver

  • Caching/Forwarding Resolver: This resolver is typically provided by the user’s organization or ISP. Its primary job is to check if the domain exists in its multi-user cache before forwarding queries to an external resolver. This cache stores records accessed by multiple users across the network, allowing faster resolution for commonly accessed domains.
  • Forwarding: When the domain is not in the cache, the caching resolver forwards the query to an external DNS server (e.g., a public DNS server like Google DNS or Cloudflare DNS).

4. Recursive Resolver

  • Recursive Resolver: The recursive resolver is where the DNS query is broken down into multiple steps and systematically resolved.
  • If a domain is not found in any of the prior caches, the recursive resolver performs an iterative lookup, starting with the Root Server and moving down the DNS hierarchy until it finds the authoritative answer for the domain. Recursive resolvers are designed to handle large numbers of requests efficiently and can cache responses to improve performance for future queries.

5. Authoritative Servers

  • Root Server: The root server is the highest point in the DNS hierarchy. It directs queries for specific top-level domains (TLDs) to the appropriate TLD servers. Root servers don’t store information about individual domains; instead, they only store references to TLD servers, making them essential for initial query redirection.
  • TLD Server: Each TLD server is responsible for a specific top-level domain (like .com, .org, .net). These servers hold records that direct the query to the appropriate Second-Level Domain (SLD) servers.
  • SLD Server: The SLD server, managed by the domain owner or registrar, holds authoritative DNS records for individual domain names. It provides the final answer in the form of an IP address or other relevant DNS information.

This hierarchical system is essential to the scalability and robustness of DNS, as it allows each layer to manage only a specific part of the domain namespace.

DNS Record

A DNS record is a piece of information that maps a domain name to associated data, such as an IP address, email server, or other resources. For example, A records map a domain name to an IPv4 address, MX records specify the mail server for a domain, and CNAME records allow one domain to be an alias of another. The different types of DNS records have distinct structures and are used to configure the domain and its associated services based on the specific needs of a website or application.

DNS Record Types

The following diagram categorizes DNS record types. Here’s an in-depth look at each category, including use cases, technical explanations, and lesser-known records.

DNS Record Types

Picture By Ruurtjan Pul - https://www.nslookup.io/learning/dns-record-types/, CC BY 4.0, Link

1. DNS Meta Records

  • NS (Name Server): Specifies the DNS servers that are authoritative for a particular domain. Each domain must have at least one NS record, often listing multiple for redundancy.
  • SOA (Start of Authority): Contains crucial metadata about the zone, including:
    • MNAME: Primary master name server.
    • RNAME: Email of the administrator responsible for the zone.
    • Serial Number: Incremented with every update, signaling secondary DNS servers to refresh.
    • Refresh, Retry, Expire, TTL Values: Define caching behavior and retry intervals.
  • CNAME (Canonical Name): Creates an alias for a domain. CNAMEs are useful for mapping subdomains to other domains or servers (e.g., pointing www.example.com to example.com).
  • PTR (Pointer): Used for reverse DNS lookups, where an IP address is mapped back to a domain name. PTR records are stored in a specially formatted reverse DNS zone.
  • DNAME (Delegation Name): Delegates an entire domain subtree to another domain. Unlike CNAME, which only applies to a single hostname, DNAME applies to all names below it.
  • OPT (Option): Part of the EDNS (Extension Mechanisms for DNS) specification. It allows DNS packets to exceed 512 bytes and supports new options like DNSSEC.

2. IP Address Records

  • A Record: Maps a domain name to an IPv4 address. It’s the most common DNS record and the basis for connecting domain names to servers.
  • AAAA Record: Similar to an A record but maps a domain to an IPv6 address.
  • APL (Address Prefix List): Stores lists of IP prefixes, often used in policy-based systems. APL records can contain both IPv4 and IPv6 prefixes.

3. Informational Records

  • TXT (Text Record): Stores arbitrary text information. Commonly used for verification (e.g., DKIM, SPF) and domain ownership validation.
  • HINFO (Host Information): Stores the host’s hardware and operating system information, though it is rarely used due to security concerns.
  • LOC (Location): Specifies geographical location data in the form of latitude, longitude, altitude, and size.
  • RP (Responsible Person): Provides contact information (usually email) for the domain administrator.

4. Service Discovery Records

  • SRV (Service Record): Specifies information about a service available on the domain, including port number and priority. Widely used in VoIP and SIP.
  • NAPTR (Naming Authority Pointer): Often used in conjunction with SRV records to map domains to services in applications like VoIP. NAPTR records can apply regular expressions to modify the queried domain name and point it to an SRV record.
  • MX (Mail Exchange): Directs email traffic to the appropriate mail servers for the domain, with preference values used to prioritize mail servers.
  • SMIMEA (S/MIME Association): Stores S/MIME certificates for email addresses, enabling encrypted email communication and enhancing email security.

6. Security Records

  • DNSSEC (DNS Security Extensions): A suite of security protocols and records that add integrity and authenticity to DNS responses:
    • DNSKEY: Holds a public key for signing and verifying DNS data.
    • RRSIG (Resource Record Signature): A digital signature that authenticates DNS data.
    • NSEC/NSEC3: Used in negative responses to show which records do not exist in a zone.
    • DS (Delegation Signer): Provides a chain of trust by verifying child zones.
  • TLSA (TLS Authentication): Associates TLS certificates with a domain, strengthening HTTPS security. Used alongside DANE (DNS-Based Authentication of Named Entities) for verification.
  • SSHFP (SSH Fingerprint): Stores SSH public key fingerprints, allowing verification of SSH hosts.
  • CAA (Certification Authority Authorization): Specifies which Certificate Authorities are permitted to issue certificates for the domain, helping to prevent unauthorized issuance.

7. Miscellaneous Records

  • URI (Uniform Resource Identifier): Stores URIs for specific services and is often used in service discovery.
  • SVCB (Service Binding) / HTTPS: Newer records for specifying protocol bindings and associated metadata, providing enhanced security and performance for services.
  • AFSDB (Andrew File System Database): Points to Andrew File System (AFS) database locations. This record is part of AFS distributed file systems and is rarely used today.
  • EUI48 / EUI64: Stores MAC addresses (48-bit or 64-bit), often for device or IoT-based network identification.

Summary

DNS architecture, with its tiered resolver system and reliance on recursive querying, supports the seamless and efficient lookup of domain names across a globally distributed database. Each DNS record type serves a specific role, from basic IP resolution to security, service discovery, and metadata. These details are critical for network engineers, as they provide tools to manage DNS traffic, enhance security, and optimize performance.

Understanding these nuances enables more effective DNS configuration, aiding in faster response times, secure communications, and robust service discovery in both personal and enterprise-level networks.