Primer on Domain Name System (DNS)

The Doman Name System (or DNS) is a distributed, hierarchical, replicated database, which maps a human-readable domain name (such as example.com) to network IP address(es). It is a general purpose network lookup service that runs on UDP (as well as TCP) network port 53.

DNS is a client-server protocol, where the client is referred to as the Resolverand the server is called the Name Server.

Every domain name is a label path, read from the right to the left, starting with a trailing . (dot) - 'www.example.com.'. The part 'example.com' is the Domain Name and the part 'api.example.com' is the sub-domain.

Every DNS lookup starts at a Root Server (.), the dot. There are 13 root server clusters across the globe, operated by different organizations, such as, ICANN, VeriSign, etc.

The root server(s) direct the DNS lookup to the Top Level Domain (or TLD for short) based on the last part of the domain main, such as .com, .edu, .gov, .net, .org, etc.

Each of the TLD server knows about all the domains registered under them. For example, the TLD for .com knows where to find the the second-level domain server(s), such as example.com. It is the domain name, like example.com, that one needs to purchase and register in a Name Server.

The following illustration depicts the hierarchical Domain Name model:

DNS uses different type of records to configure specific pieces of information that are associated with a domain.

Each record has a name, a type, a value, and a time-to-live (TTL) associated with it. Note that the TTL tells the resolvers how long they can cache a DNS lookup result. TTL values are in seconds.

Each record type has the generic form: <domain> <TTL> <class> <type> <DATA>

The following are some of the most common used record types in DNS:

A : Maps a domain name to an ipv4 address

Example:

www.example.com. 300 IN A 35.105.115.125
AAAA : Maps a domain name to an ipv6 address

Example:

www.example.com. 300 IN AAAA 2605:2705:275:75:2605:2505:2405:1305
CNAME : Aliases one domain name to another aomain name

Example:

www.example.com. 300 IN CNAME app275.github.io.
MX : Specifies the SMTP mail server(s) for a domain

Example:

example.com. IN MX 10 mail.example.com.

example.com. IN MX 10 backup-mail.example.com.
TXT : Stores arbitrary textual information that is used for domain verification or email authentication

Example:

example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=af032780eb..."
NS : Declares the authoritative name server(s) for a domain

Example:

example.com. 3600 IN NS ns1.herokudns.com.

example.com. 3600 IN NS ns2.herokudns.com.
CAA : Restricts which Certificate Authorities are permitted to issue certificates for a domain

Example:

example.com. IN CAA 0 issue "digicert.com"

Note that a Name Server is the source of truth that actually holds the DNS record(s) for a domain.

The resolver in any OS is the DNS server that does the recursive lookup by following up the search path: Root => TLD => Authoritative name server(s).

Given we now understand the core pieces of DNS, the following are the steps taken by a browser to resolve a domain name to its corresponding networkIP address:

01: The browser checks its own DNS cache
02: If not found, the browser asks the OS, which checks its own DNS cache (and the system hosts file)
03: If not found, the OS sends the query to the recursive resolver (usually the ISP's)
04: The resolver checks its cache and returns the answer if it has one
05: Otherwise, the resolver asks a root server, which refers it to the .com TLD server
06: The TLD server refers the resolver to the authoritative name servers (from the NS records)
07: The authoritative server returns the A/AAAA record, or a CNAME, in which case the resolver looks up the target name
08: The resolver caches the answer and returns it to the OS
09: The OS caches it and returns it to the browser
10: The browser caches the IP and opens a connection to it

All the command executions will be on a Ubuntu 24.04 LTS based Linux desktop.

The two main commands we will use: dig and resolvectl.

We will start by using the dig command first.

To lookup the DNS A record for the domain example.com, execute the following command in a terminal window: