Wentworth Institute of

Technology Engineering & Technology

WIT COMP3170

Domain Name System

 Wentworth Institute of
Technology Engineering & Technology

IP Addresses

Ultimately, we use IP addresses to

represent computers in the Internet, so
we must use IP addresses when we need
to send information from one computer to
another
But remembering IP addresses is difficult
for the average user, so instead we use
human readable names to represent
computers
WIT COMP3170 2 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Names vs IP Addresses
Names, a.k.a. hostnames, provide two
key advantages over IP addresses
They are easier to remember
They provide meaningful context in the
name, rather than just a string of numbers,
which can often be used to identify the
organization involved (e.g., google.com)
However, it means we must have a way
to map between hostnames and IP
addresses
WIT COMP3170 3 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

DNS
Domain Name System
Used for name resolution, specifically to translate
hostnames to IP addresses (like a phone book for
names to phone numbers)
www.wit.edu -> 69.43.65.41
www.amazon.com -> 72.21.215.232
Thousands of DNS servers distributed around the
world to support the DNS protocol
Defined in RFCs 1034, 1035 (and others)
Primarily uses UDP, port 53
WIT COMP3170 4 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

DNS Concepts
Domains and host names
Records
Namespace
Queries
Zones

WIT COMP3170 5 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

DNS Names

Fully Qualified Domain Name (FQDN)

www.wit.edu. The trailing .

can usually be
Host name Domain name left of
portion portion

Each name/domain component (between

the dots) is a label
Labels can contain letters (upper or lower
case), numbers, and hyphens
WIT COMP3170 6 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Examples
lconnect.wit.edu
lconnect is the hostname
wit.edu is the domain name
www.engadget.com
www is the hostname
engadget.com is the domain name
www.cs.wit.edu
www is the hostname
cs.wit.edu is the domain name
WIT COMP3170 7 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Resource Records
All the actual mappings between
hostnames and IP addresses are stored in
records
For example, lifehacker.com is mapped to
the IP address 23.235.33.64
So, when you go to http://lifehacker.com,
your web browser has to find that mapping
before it can send the HTTP request
To find the mapping, your computer must
locate the record for8 lifehacker.comDo. Learn.
WIT COMP3170
 Wentworth Institute of
Technology Engineering & Technology

Resource Records
DNS actually stores more than just
hostname to IP address mappings
There are many different types of records
depending on what is being stored
The DNS system is actually nothing more
than a distributed database of information
The records are, in general, mapping one
value to another value
Really used as a general translation
mechanism for the Internet
WIT COMP3170 9 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Resource Records
The standard record type is an "A" record, which
is the hostname to IP address mapping
Other types include:
PTR: Pointer, IP address to host name (reverse
mapping)
AAAA: IPv6, host name to IPv6 address
CNAME: Canonical Name (alias), additional names
associated with an existing A record
MX: Mail eXchange, for finding email servers for a
domain
SOA: Start Of Authority, used to start a new zone
NS: Name Server, finding DNS servers for subdomains
WIT COMP3170 10 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Resource Records

Records contain the following fields:

Owner: host or domain name for the record
TTL: number of seconds that this record can be
cached before it must be flushed and re-
resolved
Class: protocol family, almost always IN
Type: type of record
Data (RDATA): mapped valued (e.g., IP address)

WIT COMP3170 11 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

DNS Namespace

Records are stored across a large number

of DNS servers, based on the overall DNS
namespace
The DNS namespace is a hierarchy of
names based on groupings of records into
domains (like wit.edu)
Each domain can have subdomains that
contain their own records

WIT COMP3170 12 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Namespace
Hierarchical structure of names

Root Domain .

Top-Level
com net edu org gov
Domains

Second-Level
wit northeaster simmon wustl
Domains n s
Hosts
www email lconne bb
or
ct
Subdomains

WIT COMP3170 13 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Namespace
Every domain at every level of the tree is
managed by at least one DNS server (and
often more)
This server is responsible for two things
The records in that domain
The IP addresses of the DNS servers for any
subdomains
There are several thousand DNS servers
in the Internet today that are structured
in a hierarchy based on the DNS
namespace
WIT COMP3170 14 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Queries
To find the IP address for a hostname,
computers issue a DNS query
Also called resolving the address
Queries are sent to DNS servers in the DNS
hierarchy
At some point, a response will be sent back that
either contains the IP address or an error
message stating that the hostname does not
exist
There are two main types of queries
Iterative
WIT COMP3170 15 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Theory: Iterative Queries

Root Server
192.36.148.17
Client

Query:
Query:
Query:
who
who
who
isisis Internet Ask .edu server:
www.wit.edu?
www.wit.edu?
www.wit.edu? 192.5.6.30

.edu TLD Server

How does the 192.5.6.30
client know to
send to
192.36.148.17? Ask wit.edu server:
wit.edu DNS 69.43.67.6
69.43.67.6 Answer:
69.43.65.41

WIT COMP3170 16 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Theory: Recursive Queries

Root Server
192.36.148.17
Client
Query: who is
www.wit.edu?
Query: who is Internet Answer:
www.wit.edu?
69.43.65.41
.edu TLD Server
192.5.6.30
Query: who is
www.wit.edu?
Answer:
wit.edu DNS 69.43.65.41
69.43.67.6 Answer:
69.43.65.41

WIT COMP3170 17 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Iterative vs. Recursive

Iterative queries place a higher burden on the
client
Recursive queries place a higher burden on the
servers
In both cases, there is a high level of inefficiency
Every query starts at the top of the DNS server
hierarchy and hits every level to get to the result
Solution: clients contact a local DNS server that
caches DNS mappings
Typical set up: clients issue recursive queries to local
server, then local server uses cached answerDo. orLearn.
uses
WIT COMP3170 18
 Wentworth Institute of
Technology Engineering & Technology

Common Practical Queries

Root Server
Client Uses 192.36.148.17
Local DNS Server
cached
answer

Query: who is Answer:

Query:
Query:
Query:
Answer:
who
who
who
isisis
www.wit.edu? 69.43.65.41 Ask .edu server:
www.wit.edu?
www.wit.edu?
www.wit.edu?
69.43.65.41 192.5.6.30

LAN
How does it Internet
know to send to .edu TLD Server
Client 2 192.5.6.30
192.36.148.17?
Query: who is
www.wit.edu?
wit.edu DNS Ask wit.edu server:
69.43.67.6 Answer: 69.43.67.6
69.43.65.41

WIT COMP3170 19 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Exercise

List every packet sent and received for a

computer to resolve sites.google.com to
an IP address. For each packet, list who
sends it, who receives it, and a short
description of the packet.

WIT COMP3170 20 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Answer

1. client -> local server: who is sites.google.com?

2. local server -> root server: who is sites.google.com?
3. root server -> local server: ask .com server
4. local server -> .com server: who is sites.google.com?
5. .com server -> local server: ask google.com server
6. local server -> google.com server: who is sites.google.com?
7. google.com server -> local server: sites.google.com is
74.125.228.97
8. local server -> client: sites.google.com is 74.125.228.97

WIT COMP3170 21 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Exercise

List every packet sent and received for a

computer to resolve
www.en.wikipedia.org to an IP address.
For each packet, list who sends it, who
receives it, and a short description of the
packet.

WIT COMP3170 22 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Answer

1. client -> local server: who is www.en.wikipedia.org?

2. local server -> root server: who is www.en.wikipedia.org?
3. root server -> local server: ask .org server
4. local server -> .org server: who is www.en.wikipedia.org?
5. .org server -> local server: ask wikipedia.org server
6. local server -> wikipedia.org server:
who is www.en.wikipedia.org?
7. wikipedia.org server -> local server:
ask en.wikipedia.org server
8. local server -> en.wikipedia.org server:
who is www.en.wikipedia.org?
9. en.wikipedia.org server -> local server:
www.en.wikipedia.org is
208.80.154.225
10.local server -> client:
www.en.wikipedia.org is
208.80.154.225
WIT COMP3170 23 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Local DNS Servers

Typically use the DNS server for the
domain as the local server for queries
That is, the domain server responds to
internal (local) and external queries to resolve
addresses
Local queries might be for internal or external
addresses
External queries are usually only for local
addresses
Can also have separate servers just for
handling local queries
WIT COMP3170 24
(cache-only Do.
server)
Learn.
 Wentworth Institute of
Technology Engineering & Technology

Bootstrapping
How does the local DNS server know the
IP address of a root server?
When the DNS server software is
installed, it includes a special file called
the root hints file
This hints file contains a list of the IP
addresses for some of the root servers
Once you have the IP address for one of
them, you can query it to get an updated
list of all of them 25
WIT COMP3170 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Root Servers
The root servers for the root domain are
some of the most critical pieces of the
Internet infrastructure today
There are officially 13 root servers, but
each one is replicated across many sites
Officially called a.root-servers.net through
m.root-servers.net
See http://root-servers.org

WIT COMP3170 26 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Wireshark

Filter on "dns" to see only DNS packets

DNS uses IPv4, and UDP with a server
port number of 53
Each DNS query contains at least one
question
Each DNS response that has a mapping
contains an answer

WIT COMP3170 27 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

DNS Tools
nslookup
Command line tool for Windows and
Unix/Linux
Issues DNS requests to resolve names to IPs
For example: nslookup lifehacker.com
First entries are the
hostname and IP
address of your DNS
Next is the actual
record that was
queried, including the
hostname and IP
address
WIT COMP3170 28 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Client Information
Most clients needs to be told who the local DNS
servers are when you join a network
Unless you are using statically configured DNS
servers, e.g., OpenDNS or Google Public DNS
How does a client learn this information? DHCP
options!
DHCP also includes options for telling clients
what the local DNS domain is
For example, on campus your laptop will be part of
the wit.private domain

WIT COMP3170 29 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Client Query Process

When a client sends a DNS query for a
non fully qualified domain name (without
a dot at the end of the name) it first tries
to append the local domain name
If that fails, then it tries without
appending the local domain name
This way, it will try to use local names
first (which the local server will know)
before looking for global names
WIT COMP3170 30 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Example
In Windows, start Wireshark and filter on dns
packets
Open a command prompt
Issue a DNS query for www.google.com using
nslookup: nslookup www.google.com
Look at the DNS packets in Wireshark and you
should see queries for
www.google.com.wit.private and then for
www.google.com (both A and AAAA)
Now issue a query for www.google.com. (dot at
the end!), and you should
WIT COMP3170 31
see only queries for
Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

DNS Tools

whois
Allows you to get information about the
organization that is in charge of a particular
domain name
Includes domain registration dates and
domain expiration dates
Command line tool for Unix/Linux
Can also use
http://www.internic.net/whois.html

WIT COMP3170 32 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Domain Registration

Anyone can register a domain name with

one of the many domain registrars
The domain registrars work with ICANN to
ensure that the DNS hierarchy is
maintained correctly (and to make sure
that any domain is only owned by one
person/company)
It is a source of much contention when it
comes to company names, trademarks,
WIT COMP3170 33 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Dynamic DNS
One common way DNS is used by tech savvy
consumers is via dynamic DNS
Most residential ISPs use dynamic IP address
assignment (with DHCP) for their customers
So, the IP address might change from time to time
If you want remote access to your home
network, you can use a dynamic DNS service to
map your IP address to a domain name
A simple script can be used to check your
current IP, and if it has changed, then update
the DNS record
WIT COMP3170 34 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Content Delivery Networks

DNS is also used today to facilitate more
complex and more efficient delivery of web
content
Companies like Akamai build Content Delivery
Networks (CDNs) where web content is
distributed to thousands of servers around the
world (rather than in a centralized data center)
Then, when a client issues a DNS query related
to that content the system directs the query
towards a CDN DNS server, which ultimately
returns an IP address of a server that is
WIT COMP3170 35 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Security
Unfortunately, DNS was designed in the era
before the Internet become a scary place
DNS does not have any means to
cryptographically sign or verify queries or
answers
More recently, a number of RFCs have defined a
suite of security extensions known as DNSSEC
The basic idea is to provide authentication
mechanisms and data integrity guarantees

WIT COMP3170 36 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Zones
Zones are the basic unit of configuration
and administration in a DNS domain
A zone consists of all the mappings from
names to IPs for a domain
Every zone must have at least one
authoritative server that handles the
mappings in that zone
There are different types of zones:
primary, secondary, forward, and reverse
WIT COMP3170 37 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Primary and Secondary Zones

A primary zone is the authoritative zone for a
domain
The DNS server hosting the primary zone is the
authoritative server for the domain, and contains a
writable copy of all mappings for the domain
There can be only one primary zone for a domain
Secondary zones are read-only copies of the
primary zone for a domain
Used for redundancy and load balancing
Use zone transfers (AXFR and IXFR) to keep the copy
of the primary zone up to date

WIT COMP3170 38 Do. Learn.

 Wentworth Institute of
Technology Engineering & Technology

Forward and Reverse Zones

Forward zones are used to map host
names to IP addresses
Reverse zones are used to map IP
addresses back to host names
Used primarily for verification and security
purposes
Uses special domain: in-addr.arpa
Subdomains are IP addresses/subnets in
reverse
Example for 192.168.100.0/24:
WIT COMP3170 39 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Reverse Lookups
When you actually issue a reverse query
for a PTR record to find the host name
associated with a given IP address, it uses
the in-addr.arpa domain
Specifically, the four IP address bytes are
reversed and then in-addr.arpa is
appended
For example, if you lookup 69.43.65.41
the actual query will be for
41.65.43.69.in-addr.arpa
WIT COMP3170 40 Do. Learn.
 Wentworth Institute of
Technology Engineering & Technology

Wrap Up

DNS is vital to the ongoing function of the

Internet today
It is a protocol that defines how
computers find mappings from
hostnames to IP addresses using queries
It is also a hierarchical infrastructure of
thousands of servers that support that
protocol

WIT COMP3170 41 Do. Learn.