DNS: Internet Telephone Book

Содержание и основные понятия

Back to the table of contents
Alterna chapter 6 · page 6.2
DNS: Internet Telephone Book
When you dial
alterna-edu.ru
DNS turns an understandable name into an IP server address.
In chapter 4, you learned that
DNS Request
Now let's see how the domain name turns into an IP address.
DNS is
distributed database
which keeps the name IP in line with thousands of servers around the world.
GEF · Basic
PLF · Infred
EEG · task 13
01
Home name system: how it works
Ierarchy from root to specific server
GEF
EEG 13
Structure of the domain name
The Domain Name Reads
right to left
: from general to private.
www.alterna-edu.ru
- We're going to:
Part
Level
Meaning
.
(point at the end)
Corna (0)
The Invisible "Root" is the top of the DNS tree.
ru
Level 1 (TLD)
National Domain of Russia
alterna-edu
Level 2 (SLD)
Name of organisation/site
www
Level 3 (subsoil)
Specific host / service
.
root
.ru
.com
.org
alterna-edu.ru
www.alterna-edu.ru
google.com
mail.google.com
example.org
Each level delegates management to the next level
Figure 1.
DNS tree: from root (..) to specific hostess
Important
The full domain name (FQDN) ends with a point:
www.alterna-edu.ru.
- but they don't usually write the dot.
02
Types of DNS records
DNS stores not only IPs — different entries for different tasks
GEF
EEG 13
Type
What Keeps
Example
A
Domain
IPv4
alterna-edu.ru → 93.189.45.12
AAAA
Domain
IPv6
example.com → 2001:db8::1
CNAME
A pseudonym of the other domain.
www.example.com → example.com
MX
Mail server + priority
example.com → mail.example.com (10)
NS
Authoritative DNS server
example.com → ns1.hosting.ru
TXT
Arbitrary text
SPF, DKIM, Domain Certification
PTR
IP ♪ Domain (reverse)
93.189.45.12 → alterna-edu.ru
SOA
Zone information
Primary NS, email admin, serial number
Remember for the EEG
A
- Address (IPv4)
AAAA
- Address (IPv6),
CNAME
- an alias,
MX
- Post office,
NS
- DNS zone server.
📋
Types of DNS records
press type · description and example
Interactor
Press types of records to find out what they're holding.
A
IPv4 address
93.189.45.12
AAAA
IPv6 address
2001:db8::1
CNAME
A pseudonym
www → example.com
MX
Mail server
mail.example.com (10)
NS
DNS Zone server
ns1.hosting.ru
TXT
Text entry
v=spf1 include:...
PTR
Reverse
93.189.45.12 → host.ru
SOA
Zone information
ns1 admin serial timers
Press the type of record for details.
03
How DNS resolution works
Request path from browser to IP address
GEF
EEG 13
Recurring resolution
When you enter
www.alterna-edu.ru
your computer is asking
recursive DNS server
(usually from the provider) He's doing the whole search:
Cash
- Checks first, does he already know the answer?
Core server
"Who knows .ru?" says, "TLD servers . Ru: 194.54.7.1."
TLD server.ru
- "Who knows allerna-edu.ru?" - "Authority NS: ns1.hosting.ru (93.1989.45.1)"
Authoritative NS
— «www.alterna-edu.ru = 93.189.45.12» ✓
The answer goes back to the browser,
Cashed
during TTL.
Brouser
Recurring DNS
Root (.)
TLD (.ru)
Auth NS
93.189.45.12 ✓
Request
1: Who knows .ru?
TLD: 194.54.7.1
2: Who knows allerna-edu.ru?
NS: ns1.hosting.ru
3: www.alterna-edu.ru = ?
= 93.189.45.12
response + cache
IP!
Four steps: Root ♪ TLD ♪ Auth ♪ IP. The answer is cached to TTL.
Figure 2.
DNS recursive resolution: 4 steps from browser to IP address
Cashing and TTL
TTL
Time To Live is the time in seconds the answer is stored in a cache. The typical values are 300 (5 minutes) - 86400 (24 hours).
Why cache?
Without cache, every request to
google.com
I'd go through four servers with a cache -- an instant response from the provider's memory or your OS.
🔍
DNS Resolution Simulator
Enter the domain · see the path of the request
Interactor
Enter a domain name or select an example to see the DNS resolution process.
04
DNS Safety
How to Protect a Phone Book from Counterfeiting
PLF · Infred
EEG 13
Threats
DNS Spoofing
The intruder replaces the DNS answer:
bank.ru
It leads to a fake IP. The user hits a fake website without suspicion of fraud.
Protection
Technology
How it works
DNSSEC
The client checks the authenticity with the key.
DoH
(DNS over HTTPS)
DNS-demands inside HTTPS traffic.
DoT
(DNS over TLS)
DNS via TLS tunnel (port 853).
DNS Attack
DDoS attack: The perpetrator sends small requests with
Fake IP victim
They're sending them to open DNS servers.
Huge answers
Victim, reinforcement x 50-100.