Handbooks / Computer Networks / Chapter 4

DNS

7 pages · ~5 min✓ Reviewed

Builds on TCP vs UDP. Next up: HTTP and TLS.

Computer NetworksPage 1

DNS Mental Model

1. Names and Data

DNS maps names to data (mostly IPs)
A distributed, hierarchical database
Read a name right to left
www.example.com. = root . → com → example → www

2. Who Asks Whom

Stub resolveryour OS
Recursive resolverISP, 8.8.8.8, 1.1.1.1: does the work
Authoritativeholds the real answer for a zone

3. Tiers, Zones, Transport

Tier	Knows
Root (13 identities a–m, many anycast instances)	the TLD servers
TLD (.com, .org)	the domain's NS
Authoritative	the records

A zone = namespace slice one set of authoritative servers manages
A delegation (NS record) hands a subtree to another zone

Remember

Stub asks, recursive resolves, authoritative answers.

Computer NetworksPage 2

Resolution Workflow Step by Step

1. Cache Check, Then the Walk

Browser cachehit: stop
OS cache + hostshit: stop
Resolver cachehit: stop
Walk hierarchyfull miss only

Cold lookup: www.example.com

1Resolver asks rootreferral: .com TLD NS
2Resolver asks TLDreferral: example.com NS
3Resolver asks authoritativereturns the A record

2. Recursive vs Iterative

	Recursive	Iterative
Path	stub → resolver	resolver → root/TLD/auth
Reply	final answer or error	best answer or referral: 'ask them'
Requests	one	many, asker follows each
Load	resolver works and caches	each server stays cheap

3. Glue Records

Glue = A/AAAA of a nameserver inside the zone it serves
ns1.example.com serves example.com: circular without it
The parent supplies glue alongside the referral

Both at once

A real lookup uses both: recursive from stub to resolver, iterative from resolver down the hierarchy.

Computer NetworksPage 3

Record Types That Matter

1. Address and alias records

A = name → IPv4
AAAA = name → IPv6
Many A/AAAA at one name = round-robin
CNAME = alias of another name
A CNAME cannot share its name with any other record
So no CNAME at the apex: use ALIAS/ANAME or A

2. Mail and zone records

MX = mail server + priority; lower is tried first
MX target = hostname, never an IP or CNAME
NS = the zone's authoritative nameservers; the parent uses it to delegate
SOA = zone serial + timers

bash

dig example.com MX +short

10 is tried before 20

output

10 mail1.example.com.
20 mail2.example.com.

3. Compared

Type	Answers	Gotcha
A	IPv4	many allowed
AAAA	IPv6	many allowed
CNAME	alias	never at apex
MX	mail	lower wins
NS	delegation	authoritative servers
TXT	SPF, DKIM, DMARC, ownership	free-form text
PTR	reverse IP → name (rDNS)	IP → name only

Classic mistakes

CNAME at the apex, or an MX pointing at a CNAME or IP.

Computer NetworksPage 4

TTL and Caching

1. What TTL Is

TTL = seconds a resolver may cache a record
Set per record by the authoritative server
Counts down in the resolver's cache

TTL	Range	Effect
Low	60–300 s	fast changes, more queries
High	3600–86400 s	fewer queries, slow changes

2. Changing Records Safely

1Lower TTLone old TTL ahead
2Switch record
3Raise TTL

'Propagation' = old cached answers expiring
No push: you cannot force other resolvers to refresh

3. Negative Cache and Flush

NXDOMAIN is cached too, for the SOA minimum
A just-created record can still look missing

bash

ipconfig /flushdns
resolvectl flush-caches
sudo dscacheutil -flushcache

Windows / systemd-resolved / macOS

Computer NetworksPage 5

dig and nslookup in Practice

1. dig Queries

Command	Result
`dig example.com A +short`	answer only
`dig example.com MX`	also AAAA, TXT, NS
`dig @8.8.8.8 example.com`	ask one resolver, compare
`dig +trace example.com`	walk from the root
`dig -x 203.0.113.5`	reverse PTR lookup

2. Reading and Tracing

+trace stops where delegation breaks

1Rootrefers to .com
2TLDrefers to NS
3Authoritativegives answer

ANSWER section: the records
TTL column: seconds left in cache
Status: NOERROR ok, NXDOMAIN no name, SERVFAIL server failure

3. nslookup

Command	Result
`nslookup example.com`	default A lookup
`nslookup -type=MX example.com`	other type
`nslookup example.com 8.8.8.8`	ask that resolver
`set type=MX`	interactive mode
nslookup	older, less detail than dig

4. Common Mistakes

Zone file name missing the trailing dot
CNAME at the apex
MX pointing at a CNAME or IP
Testing before the old TTL expires
Editing a zone the registrar NS doesn't point to

Verify first

Query the registrar's NS with dig @ns1.example.com name; caches hide your change.

Computer NetworksPage 6

DNS Cheat Sheet

1. Lookup Flow

Stubyour OS
Resolverrecursive query
Rootreferral
TLDreferral
Authoritativeanswer
Cachedfor TTL

Stub → resolver is recursive
Resolver → root/TLD/authoritative is iterative referrals

2. Records & Status Codes

Record	Meaning
`A`	IPv4
`AAAA`	IPv6
`CNAME`	alias, not at apex
`MX`	mail, lower priority wins
`NS`	delegation
`TXT`	SPF/DKIM/verification
`PTR`	reverse
`SOA`	zone info

Status	Meaning
NOERROR	ok
NXDOMAIN	name doesn't exist
SERVFAIL	server/DNSSEC failure
REFUSED	policy block

3. Debug & Change Safely

bash

dig +short example.com
dig @8.8.8.8 example.com
dig +trace example.com
dig -x 203.0.113.5
nslookup -type=MX example.com 8.8.8.8

+trace shows each referral

1Lower TTL
2Wait old TTL
3Change record
4Verifydig @authoritative
5Raise TTL

Cached misses

NXDOMAIN is cached too: a new record can look missing until the negative TTL expires.

Computer NetworksPage 7

Check yourself

TTL was 86400. At 10:00 you set 300, at 10:05 you changed the IP. Why do some users see the old IP tomorrow?

Resolvers that cached before 10:00 keep the 86400 s copy
The new TTL applies only after they refetch
Lower TTL one old TTL (24 h) before the change

dig @ns1 new.example.com works, but your resolver says NXDOMAIN right after you create it. Why?

It cached the earlier NXDOMAIN
Negative TTL comes from the SOA
Wait it out, or flush your own cache

Spot the bug: example.com has CNAME lb.host.net. and MX 10 mail.example.com.

A CNAME cannot coexist with other records at its name
The apex also holds SOA and NS
Use A records or ALIAS/ANAME instead