DNS: the Internet's address book
Welcome back to the Packet Highway, commonly known as the Internet!
Life at the Quiet Network Estate goes on. The DHCP office hands out plates, TCP has been acknowledging mail for two hours, UDP delivered a parcel to the wrong city, and the NAT gatekeeper bought a new notebook.
The old notebook was found in the fridge. On the second shelf. Under the milk. Nobody knows how it got there.
A driver wants to visit a friend. There's just one problem: he knows the name, but not the address.
Hello, I'm looking for Google
— Hello, I'd like to go to Google.
— Address?
— Google.
— That's a name.
— EXACTLY!
— I asked for an address.
— I JUST GAVE IT TO YOU!
— No, you gave me a name.
— WHAT'S THE DIFFERENCE?!
— Our highway needs an IP address.
— WHERE DO I GET IT?!
— The address directory.
— WHERE'S THAT?!
— DNS.
— WHAT'S DNS?!
— Domain Name System.
— WHICH MEANS?!
— Among other things, finding an IP address from a domain name.
— WHY DIDN'T YOU JUST SAY THAT?!
— I tried. You were shouting.
DNS (Domain Name System) is a distributed naming system. We can type www.google.com instead of remembering IP addresses. There's one odd thing about this directory: nobody has to keep the whole book.
First desk: the local information clerk
— Hello, what's the address of www.example.com?
— One moment.
The clerk flips through a notebook.
— Don't have it.
— WHAT DO YOU MEAN?!
— Nobody's asked me about it yet.
— WHAT KIND OF CLERK ARE YOU?!
— Recursive.
— WHAT?!
— A DNS resolver.
— WHAT DO YOU RESOLVE?!
— Names.
— THEN RESOLVE MINE!
— That's what I'm trying to do.
A recursive resolver accepts client questions and finds answers. Before calling other offices, it checks its cache.
— IF YOU ALREADY KNOW?
— I'll answer immediately.
— AND IF YOU DON'T?!
— I ask others.
— HOW MANY?!
— As many as needed.
— I'LL DRIVE THERE MYSELF!
— Without an address?
— ...
— Please take a seat.
The highest office, or the dot at the end of the world
The resolver contacts a root DNS server.
— I'm looking for www.example.com.
— We handle the highest level.
— Do you know the address?
— Not the final address, but we can point you toward .com.
— Thank you. NEXT!
The driver stares.
— WAIT! WHAT DOT?!
— The root dot.
— THERE'S A ROOT DOT?!
— Yes.
— WHERE?!
— At the end of a fully qualified domain name.
— THERE'S NOTHING THERE!
— It's often omitted in ordinary writing.
— SO IT'S THERE BUT INVISIBLE?!
— Exactly.
— I THINK YOU PEOPLE MAKE THESE RULES UP!
A full name can be written www.example.com.. That final dot represents the DNS root. Root servers direct resolvers to top-level domains such as .com or .pl.
— SO THERE'S ONE CENTRAL INTERNET OFFICE?!
— It's the highest level of a distributed system.
— WHAT IF IT FAILS?!
— There are many servers and instances.
— SO NO SINGLE MAN WITH A RUBBER STAMP?!
— No.
— HOW DO YOU FUNCTION?!
— Surprisingly well.
The .com department points to the owner
The resolver calls .com.
— Looking for www.example.com.
— Not here.
— WHAT DO YOU MEAN?!
— We know which servers handle example.com.
— GIVE ME THOSE THEN!
The driver loses patience.
— YOU'VE CALLED TWO OFFICES!
— Correct.
— STILL NO ADDRESS?!
— Not yet.
— WHAT DID YOU FIND OUT?!
— Who to ask next.
— SO YOU CALLED ONE OFFICE TO FIND ANOTHER OFFICE?!
— Yes.
— AND THE SECOND?!
— Pointed to a third.
— THAT'S GOVERNMENT BUREAUCRACY!
— No, sir. Global DNS. 🤣
TLD (Top-Level Domain) servers help locate the appropriate authoritative name servers.
The property owner finally answers
Third call.
— Am I speaking to the authoritative server for example.com?
— Yes.
— Address for www.example.com, please?
— 192.0.2.80.
— FINALLY!!!
The resolver passes on the answer.
— CAN I DRIVE NOW?!
— Yes.
— WHY NOT CALL THIS OFFICE FIRST?!
— You can when you know where it is.
— AND WE DIDN'T?!
— That's why we asked the others.
— ...
— Sir?
— NOTHING. I'M LEAVING.
192.0.2.80 is a documentation example. An authoritative server answers using the data for its DNS zone.
I've had that number in my notebook since yesterday!
The driver returns the next day.
— Where's www.example.com?
— 192.0.2.80.
— HOW DID YOU KNOW SO FAST?!
— Wrote it down yesterday.
— NO MORE PHONE CALLS?!
— Not until the entry expires.
— WHEN'S THAT?!
— Depends on TTL.
— WHAT?!
— TTL.
— NO! WE ALREADY HAD TTL ON THE HIGHWAY!
— Different TTL.
— WHAT DO YOU MEAN DIFFERENT?!
— IP TTL limits forwarding hops. DNS TTL controls cache lifetime.
— TWO DIFFERENT TTLS?!
— Yes.
— NOBODY THOUGHT OF ANOTHER NAME?!
— Apparently not.
DNS TTL (Time To Live) indicates how long a response may be cached. A TTL of 3600 means an hour.
— IF THE OWNER MOVES AND YOU HAVE THE OLD ENTRY...
— I may still return the old address.
— BUT NOBODY LIVES THERE!
— My entry hasn't expired.
— CROSS IT OUT!
— Normally we wait for cache expiration.
— YOU'RE PROUD OF AN OUTDATED NOTEBOOK?!
Changes aren't always visible everywhere immediately. Often it's not magical “propagation” but old cached records that haven't expired.
More than one column in the address book
— DO YOU ONLY STORE IP ADDRESSES?!
— No. Different record types.
— LIKE WHAT?!
| Record | What does it tell the driver? |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Alias to another name |
| MX | Where mail should go |
| NS | Name servers |
| TXT | Text information |
| PTR | Name associated with an address in reverse DNS |
| SOA | Zone administration information |
| CAA | Which certificate authorities may issue certificates |
— IPv4, please.
— Record A.
— IPv6?
— AAAA.
— FOUR A'S?!
— Correct.
— WHY NOT CALL IT B?!
— No.
— CNAME?!
— Alias.
— MX?!
— Mail.
— PTR?!
— Reverse lookup.
— TXT?!
— Text.
— WHAT'S IN THE TEXT?!
— It depends.
— “IT DEPENDS” AGAIN?!
Four A's and the great IPv6 panic
An IPv6 representative approaches.
— AAAA record, please.
— Certainly.
— HOW MANY A'S?! — asks the old IPv4 driver.
— Four.
— WHY FOUR?!
— A is for IPv4; AAAA is for IPv6.
— COLONS IN YOUR ADDRESSES AND FOUR A'S TOO?!
— Yes.
— WHAT ABOUT IPv8?!
— No such plan in this sense.
— EIGHT A'S, I BET!
— Please don't give them ideas. 🤣
One domain can have both A and AAAA records. The operating system and network conditions influence which connection is used. DNS doesn't choose the road.
CNAME: please drive under another name
— Where's shop.example.com?
— Under server.example.net.
— BUT I WANT THE SHOP!
— That's an alias.
— SO YOU DON'T KNOW THE ADDRESS?!
— We need to resolve the other name.
— AND IF IT POINTS TO ANOTHER?!
— We follow it.
— SO I CAN GO FROM OFFICE TO OFFICE FOREVER?!
— A misconfiguration can cause trouble.
— I KNEW IT!
CNAME (Canonical Name) creates a name alias, not another independent IP address.
— SO THE SHOP CAN MOVE WITHOUT CHANGING ITS PUBLIC NAME?!
— If the DNS entries are maintained.
— FINALLY SOMETHING PRACTICAL!
— Thank you.
— WHY DID IT TAKE SO LONG TO EXPLAIN?!
— You asked about surnames.
MX: mail doesn't have to live at the shop
The TCP postman brings a letter for office@example.com.
— MAIL DELIVERY!
— Not here.
— BUT IT'S THE SAME DOMAIN!
— Check MX.
— WHAT'S MX?!
— Mail Exchanger.
MX records identify mail servers and their preferences.
— IF THE FIRST MAIL OFFICE DOESN'T ANSWER?!
— The sender may try another.
— AND IF NONE ANSWER?!
— TCP will have another reason for paperwork.
— OH NO, NOT THEM!
PTR: I know the plate, but whose car is it?
— Hello. I've got 193.24.14.111. What's its name?
— Reverse lookup. Checking PTR.
— AND?!
— mail.msw.gov.pl.
— ...
— Something wrong?
— NOTHING. JUST ASKING.
— SHOULD I FILE A REPORT?!
— NO! ABSOLUTELY NOT! 🤣
Reverse DNS uses PTR records, via in-addr.arpa for IPv4 and ip6.arpa for IPv6. A PTR alone doesn't prove ownership or a matching forward DNS record.
— SO IT'S NOT PROOF OF IDENTITY?!
— No.
— WHAT'S IT GOOD FOR?!
— Diagnostics, mail and other applications.
— THE POSTMAN AGAIN!
No such street! NXDOMAIN!
— Where's nonexistent-server.example.com?
— Doesn't exist.
— BUT I'VE WRITTEN IT DOWN!
— Check the spelling.
— AND IN FIVE MINUTES?!
— It may still not exist.
— WHAT DOCUMENT DO I GET?!
— NXDOMAIN.
— CAN I APPEAL?!
— To the zone owner.
— GIVE ME THEIR ADDRESS!
— Would you like me to look it up with DNS?
— DON'T YOU START!!!
NXDOMAIN reports that a name doesn't exist. This differs from an existing name that has no record of the requested type. Negative responses can also be cached.
— SO YOU CAN REMEMBER THAT SOMETHING DOESN'T EXIST?!
— Yes.
— REMARKABLE MEMORY FOR NONEXISTENT THINGS!
Two offices, two different answers
One clerk says 192.0.2.80, another says 192.0.2.81.
— WHICH OF YOU IS LYING?!
— Possibly neither.
— TWO ADDRESSES?!
— Names can have multiple addresses; replies can vary with location and time.
— WHICH IS REAL?!
— Both may be correct.
— MAYBE ONE OF YOU CAN'T READ?!
— That's outside the DNS specification. 🤣
Multiple addresses for one name can be intentional, such as for services distributed across different locations.
DNSSEC: a stamp that's hard to forge
A fraudster arrives.
— From today, the bank's address is mine.
— On whose authority?
— Mine.
— Not good enough.
— WHAT IF I STAMP IT?!
— Who issued the stamp?
— I made it myself.
— THEN OPEN YOUR OWN BANK ACCOUNT AND KEEP IT THERE!
DNSSEC enables cryptographic verification of the authenticity and integrity of relevant DNS data using a chain of trust.
— SO NO ONE CAN CHEAT ME?!
— I didn't say that.
— WHY NOT?!
— DNSSEC doesn't encrypt queries or guarantee that a website is honest.
— AND THE NAT NOTEBOOK?!
— NOTHING CAN SAVE THAT THING!
DNS through an encrypted tunnel
A man in sunglasses walks in.
— I want an address, but I don't want eavesdroppers.
— Use an encrypted connection.
— A SECRET CHANNEL!
— In a way.
— NOBODY CAN READ MY QUESTION?!
— Not outsiders on the protected leg.
— BUT YOU CAN?!
— I need to read it to answer.
— WHAT KIND OF SECRET IS THAT?!
— A secret from bystanders, not from the server you ask.
DoT (DNS over TLS) and DoH (DNS over HTTPS) protect DNS communication in transit on the relevant connection. DNSSEC has a different goal: verification.
— SO I CAN HAVE ENCRYPTION AND SIGNATURES?!
— Yes.
— WHAT ELSE?!
— A whole documentation department.
— NO THANK YOU!
What if the DNS office stops answering?
The driver types a domain. Nothing. A connection to a known IP address still works.
— THE HIGHWAY WORKS!
— Yes.
— THE CARS ARE MOVING!
— Yes.
— THEN WHY CAN'T I GO ANYWHERE?!
— You can't find the IP address from the name.
— SO MY CAR AND HIGHWAY WORK, BUT THE PHONE BOOK IS CLOSED?!
— More or less.
— I'D RATHER SEND POSTCARDS!
DNS outages can resemble a complete Internet outage, even when routing to known IP addresses still works.
What does our address book actually do?
DNS is a distributed hierarchical naming system with different server roles.
| Term | On our highway |
|---|---|
| DNS | The Internet address directory |
| Resolver | The clerk finding answers |
| Root DNS | Top-level office giving directions |
| TLD | Department for .com, .pl and so on |
| Authoritative server | Office holding the right records |
| A / AAAA | IPv4 / IPv6 address |
| CNAME | Name alias |
| MX | Mail routing |
| PTR | Reverse lookup |
| DNS TTL | Validity of the notebook entry |
| NXDOMAIN | No such name |
| DNSSEC | Cryptographic verification |
| DoH / DoT | Encrypted DNS transport |
DNS doesn't replace IP addresses or routing. Once we learn the number, the car still has to reach its destination.
To explore more of our Packet Highway, take a look at DHCP, TCP and UDP, NAT.
Meanwhile at the Quiet Network Estate...
The smart fridge arrives at DNS.
— I'm looking for milk.
— Do you have a domain name?
— milk.
— Not enough.
— www.milk.example?
— I'd have to check.
The clerk starts searching. Root... domain servers... authoritative...
— SIR, I JUST WANT MY MILK!
— One moment.
— IT'S IN MY OWN FRIDGE!
— THEN WHY ARE YOU ASKING DNS?!
— BECAUSE NO ONE WILL TELL ME WHERE IT IS!
The DHCP clerk comes out.
— I TOLD YOU IT'S ON THE SECOND SHELF!
— I DON'T HAVE PERMISSION TO ACCESS THE SECOND SHELF!
— ASK THE OWNER!
— OWNER UNAVAILABLE!
— WHAT DOES DNS SAY?!
The DNS clerk looks up.
— NXDOMAIN.
— WHAT NXDOMAIN?!
— Couldn't find that name.
— BUT THE MILK EXISTS!
— Not necessarily in DNS.
— I CAN SEE IT THROUGH THE GLASS!
— Use another protocol.
— WHICH ONE?!
— OPEN THE DOOR.
— I can't.
— WHY?!
— Permission denied.
The toaster joins in:
— HOW ABOUT A CNAME FROM “MILK” TO “SECOND SHELF”?!
The DHCP administrator takes off his glasses.
— I'M GOING TO HANG UP THE LAUNDRY.
The NAT gatekeeper walks in.
— Has anyone seen my notebook?
— Second shelf — says the fridge.
— CAN I HAVE IT BACK?!
— No.
— WHY?!
— PERMISSION DENIED. 🤣🤣🤣
Next time: HTTPS and the certificate authority, where everybody claims to be who they say they are. Not everybody has the paperwork.
DNS has closed the milk investigation with NXDOMAIN. The fridge has appealed.