What is DNS?
The Domain Name System (DNS) is a hierarchical decentralized naming system that translates human-friendly domain names (like example.com) into machine-readable IP addresses (like 192.0.2.1).
Think of DNS as the internet's phone book - it matches names with numbers (IP addresses) so you don't have to remember complex numerical addresses.
Before DNS
In the early internet (ARPANET), computers used a hosts.txt file maintained by SRI that mapped names to numbers. This became impractical as the network grew.
192.0.2.1 example.com
192.0.2.2 test.com
DNS Creation
DNS was invented in 1983 by Paul Mockapetris to solve the scaling problems of the hosts.txt system. It introduced:
- Distributed database
- Hierarchical naming structure
- Caching for performance
How DNS Works
The DNS Resolution Process
- Browser Cache: Your browser checks its own cache first
- OS Cache: The operating system checks its DNS cache
- Resolver: Your ISP's DNS server is queried
- Root Server: If needed, the root DNS servers are consulted
- TLD Server: The Top-Level Domain server (.com, .org, etc.) is queried
- Authoritative Server: The domain's nameserver provides the IP
- Caching: Each step caches the result for future requests
DNS Record Types
A Record
Maps a domain to an IPv4 address
AAAA Record
Maps a domain to an IPv6 address
CNAME
Canonical name (domain alias)
MX
Mail exchange server
TXT
Text information (often for verification)
NS
Nameserver for the domain
DNS Hierarchy
DNS Components
Root Name Servers
13 logical servers (actually hundreds of physical servers) that know where to find TLD servers
TLD Servers
Servers for top-level domains (.com, .org, .net) that know about authoritative nameservers
Authoritative Nameservers
The final authority for a domain's DNS records
Recursive Resolvers
Servers (like your ISP's) that do the legwork of DNS lookups
DNS Security
Common DNS Attacks
DNS Spoofing/Cache Poisoning
Corrupting DNS cache with false information to redirect traffic
DNS Amplification
Using DNS servers to amplify DDoS attacks
NXDOMAIN Attack
Flooding DNS with requests for non-existent domains
Protection Mechanisms
DNSSEC
DNS Security Extensions that add cryptographic signatures to DNS data
DNS over HTTPS/TLS
Encrypting DNS queries to prevent eavesdropping
Response Rate Limiting
Limiting DNS responses to prevent amplification attacks