Intermediate · IP services: DHCP, DNS, NAT and more · topic 37 of 57 · 30 min
DNS: names to addresses
Explanation
Why names?
Computers route packets by IP address, but people remember names. DNS (Domain Name System) is the internet's phone book: you give it a name, it gives back an address. It also lets the address change without anyone noticing: a company can move its website to a new server and simply update the DNS record.
The hierarchy
Names are read from right to left. In www.example.co.in, the invisible dot at the very end is the root. Then come the top-level domain (TLD) .in, then co.in, then example.co.in, and finally the host www.
- Root servers: they know where every TLD's servers are. There are 13 root server names (a to m.root-servers.net), each copied to many sites around the world, including in India.
- TLD servers: they know which servers are responsible for each domain inside the TLD. Generic TLDs include .com and .org; country-code TLDs include .in, whose registry is run by NIXI (National Internet Exchange of India).
- Authoritative servers: the servers that hold the real records for one domain (its zone), managed by the domain owner or their DNS provider.
Recursive and iterative queries
Your PC does not walk the hierarchy itself. It sends one recursive query to a resolver (your ISP's, your company's, or a public one such as 8.8.8.8 or 1.1.1.1): "find me the full answer". The resolver then makes iterative queries: it asks a root server, which says "ask the .in servers"; it asks a .in server, which says "ask example.co.in's servers"; and it asks the authoritative server, which gives the answer.
Caching and TTL
Every record comes with a TTL (time to live) in seconds. The resolver and your PC keep (cache) the answer until the TTL runs out, so the next lookup is instant and the root and TLD servers are not asked every time. The cost: when you change a record, some users keep the old answer until their cached copy expires. Before a planned server move, admins lower the TTL a day early.
Record types
| Type | What it holds | Example |
|---|---|---|
| A | An IPv4 address | shop.example A 203.0.113.20 |
| AAAA | An IPv6 address | shop.example AAAA 2001:db8::20 |
| CNAME | An alias pointing to another name | www.shop.example CNAME shop.example |
| MX | Mail server for the domain, with a preference (lower is tried first) | shop.example MX 10 mail.shop.example |
| NS | The authoritative name servers of the zone | shop.example NS ns1.dnsprovider.example |
| PTR | Reverse lookup: address to name | 20.113.0.203.in-addr.arpa PTR shop.example |
| TXT | Free text, used for SPF, DKIM and domain verification | shop.example TXT "v=spf1 ..." |
| SOA | Start of authority: primary server, admin contact, serial number and timers of the zone | One per zone |
A CNAME cannot sit beside other records with the same name. That is why the bare domain (shop.example) usually has A records, and www is a CNAME to it. A resolver follows CNAMEs until it reaches an A or AAAA record.
Ports
Normal queries use UDP port 53, because one small question and one small answer need no connection. TCP port 53 is used for zone transfers between DNS servers and for answers too large for UDP. Newer encrypted forms exist: DNS over TLS (TCP 853) and DNS over HTTPS (port 443).
Tools
C:\> nslookup www.example.com
C:\> nslookup -type=mx example.com
C:\> ipconfig /displaydns
C:\> ipconfig /flushdns
$ dig example.com A
$ dig +short example.com MX
$ dig -x 8.8.8.8
$ dig +trace example.comDNS on Cisco IOS
R1(config)# ip domain-lookup
R1(config)# ip name-server 8.8.8.8 1.1.1.1
R1(config)# ip domain-name office.example
R1(config)# ip host FILESRV 10.0.0.20
SW1(config)# no ip domain-lookupip domain-lookup is on by default. When you mistype a command, for example "shwo", IOS thinks it is a host name, tries to resolve it and you wait while it says "Translating shwo... domain server". On lab devices with no DNS server, no ip domain-lookup stops that. The router then cannot resolve any names, which is fine for most switches.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
DNS: names to addresses · 1/8
In this lesson you will see how a name like irctc dot co dot in becomes an IP address.
Prefer a video by a teacher? Find free videos on “how dns works recursive resolver root tld authoritative explained” on YouTube ↗
In real life: Moving a shopping site to a new server
A small online saree shop in Surat moves its website to a new cloud server before the Diwali sale. A week before, the developer lowers the TTL of the A record from 86400 seconds (1 day) to 300 seconds (5 minutes). On moving day she changes the A record to the new address. Within five minutes most customers reach the new server; the old one keeps running for a day for anyone with a stale cache. The MX records for the shop's email are not touched, so mail keeps flowing.
$ dig +noall +answer shop.example A
shop.example. 300 IN A 203.0.113.20Practice (0/3 done)
Which DNS record type holds an IPv6 address?
Write resolve(name, records) that follows CNAME records until it reaches an A record, and returns that IPv4 address. records maps a name to a tuple (type, value), where type is "A" or "CNAME". Return None if a name is missing, or if the CNAMEs form a loop (protect yourself: remember names you have already visited, and give up after 8 steps).
On your own computer, use nslookup (Windows) or dig (Linux/macOS) to explore a real domain you use, such as your college's or a bank's website. Find its A (and AAAA if any) records, MX records and NS records, and run the same A query twice a minute apart. Write what you found and explain the TTL you saw.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- NAT and PATIP services: DHCP, DNS, NAT and more · same module
- Management services: NTP, SNMP, syslog and TFTPIP services: DHCP, DNS, NAT and more · same module
- Clients, servers, IP addresses and URLsBackend Development · How the web and backends work
- DNS: the internet's phone bookCyber Security: from zero to SOC analyst · Networking for security
- DNS and CDN: Route 53 and CloudFrontCloud Computing (AWS, Azure, Google Cloud) · Networking and databases: VPC and RDS
- Network basics: IP addresses, routes, DNS and the ip commandLinux and Red Hat (RHCSA to RHCE) · Software and networking
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Which record tells other mail servers where to deliver email for a domain?
Answer: MX
MX records name the mail servers; the lowest preference number is tried first.
ping 8.8.8.8 works, but ping www.google.com says "could not find host". What is most likely broken?
Answer: DNS
Reaching an IP address proves routing works. Failing on a name points to DNS.
What does a resolver do with the TTL of an answer?
Answer: Keeps the answer in its cache for that many seconds
TTL is how long the answer may be cached before asking again.
Which transport does DNS normally use for ordinary queries?
Answer: UDP 53
Normal queries use UDP 53; TCP 53 is used for zone transfers and large answers.
Why do engineers type no ip domain-lookup on lab switches?
Answer: So mistyped commands are not treated as host names to resolve
It stops IOS trying to resolve typos as host names, which makes you wait.
What does DNS do?Related
Answer: Turns a domain name into an IP address
DNS works like a contacts list: you give it a name and it finds the IP address of the server.
What is TTL in a DNS answer?Related
Answer: Time to live: how long the answer may be cached
TTL is how many seconds resolvers may reuse the answer.
You will move a website to new servers tomorrow. What should you do today with its DNS record?Related
Answer: Lower the TTL, for example to 60 seconds
A short TTL makes resolvers pick up the new address quickly after the change.
Which statement about DNS is correct?Related
Answer: It uses UDP port 53 and also TCP port 53
Most DNS queries use UDP 53; large replies and zone transfers use TCP 53.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “IP services: DHCP, DNS, NAT and more” before its exam: NAT and PAT, Management services: NTP, SNMP, syslog and TFTP, QoS basics: keeping voice and video clear.
- Module 8 exam: IP services · 15 questions · 25 min, without help. 5 topics of this module still to finish first.
- Then the next module, Network security. 57 topics left in the course before the final exam.