DNS Resolution

DNS Resolution and record types (A Record, CNAME, MX, TXT)

What is DNS?

DNS (Domain Name System) is the protocol responsible for resolving human-readable domain names (e.g., `example.com`) into machine-readable IP addresses (e.g., `93.184.216.34`). DNS acts as the naming infrastructure of the internet.

DNS Lookup Flow

The process of DNS resolution involves multiple steps from your device to authoritative servers. The system is designed hierarchically and follows a strict delegation of responsibility.

Local DNS Cache

The resolver on the client machine first checks its local cache: - If the domain is found in memory and has not expired (TTL), the IP address is returned immediately. - If not, it proceeds to ask a configured recursive resolver.

Recursive Resolver

A recursive resolver (often provided by an ISP or manually configured) attempts to resolve the domain by checking: - Its own cache - If not cached, it performs a full DNS traversal starting from the root

Root Servers

Root servers do not contain specific domain records. They direct the resolver to the correct Top-Level Domain (TLD) servers, based on domain suffix (e.g., `.com`, `.org`, `.net`, `.no`).

Example:

TLD Servers

TLD servers maintain information about which authoritative name servers are responsible for domains under that TLD. For `.com`, the TLD server points to the name server managing `example.com`.

Authoritative Name Server

The authoritative server holds the definitive DNS records for the domain. This is the final step in the lookup process and returns the relevant DNS record type (A, MX, etc.).

DNS Record Types

DNS uses multiple record types to describe different functionalities. The table below outlines commonly used types:

Record Type	Description	Example
A	Maps domain to IPv4 address	`example.com → 93.184.216.34`
AAAA	Maps domain to IPv6 address	`example.com → 2606:2800:220:1:248:1893:25c8:1946`
CNAME	Canonical alias for another domain	`www.example.com → example.com`
MX	Mail exchange server	`example.com → mail.example.com (Priority: 10)`
TXT	Arbitrary text data (e.g. SPF, domain verification)	`v=spf1 include:_spf.example.com ~all`
NS	Name server for a domain	`example.com → ns1.dnsprovider.com`
SOA	Start of authority, metadata for domain	Contains zone serial, refresh, retry, etc.

TTL and Caching

All DNS responses include a TTL (Time to Live) value which determines how long a record can be cached. Lower TTLs allow rapid changes but increase lookup traffic. Higher TTLs reduce latency but delay propagation of updates.

Implications of TTL

- TTL = 3600 → Cache duration = 1 hour - Short TTLs recommended before DNS changes

Security Considerations

DNS responses can be manipulated in transit or via poisoned caches. While traditional DNS is unencrypted and unauthenticated, enhancements exist:

DNSSEC

DNSSEC (Domain Name System Security Extensions) signs DNS records with cryptographic signatures, ensuring authenticity.

- Detects forged responses - Requires client and server-side support

Encrypted DNS

Technologies like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) protect DNS queries from being observed or modified in transit.

Diagnosing DNS

Use CLI tools to inspect and trace DNS resolution:

Tool	Usage Example	Description
dig	`dig example.com A`	Queries a specific DNS record
nslookup	`nslookup example.com`	Basic DNS query tool
host	`host example.com`	Returns A/AAAA/MX records
whois	`whois example.com`	Domain registration info

Misconfigurations and Abuse

Misconfigured DNS records can lead to service disruption, data leaks, or impersonation. Examples include: - Incorrect MX leading to failed mail delivery - Exposed internal TXT data - Open DNS resolvers used for reflection attacks