DNS Resolution Explained

1. The Core Function of DNS: A Phonebook for the Internet

Computers on a network identify each other using numerical IP addresses (e.g., 142.250.187.206). Humans, on the other hand, find it much easier to remember names (e.g., google.com). DNS is the system that bridges this gap by translating human-readable domain names into machine-readable IP addresses.

Without DNS, you'd have to memorize the IP address for every website you want to visit, which is simply not feasible.

To start, let's watch a short animated video that introduces this core concept.

The key idea is simple: you provide a name, and DNS gives you back a number. Now, let's look at the sophisticated process that makes this happen.

2. The DNS Resolution Process: A Step-by-Step Journey

When your computer needs to resolve a domain name it hasn't visited recently, it kicks off a fascinating chain of queries. The lookup isn't handled by a single server but by a hierarchy of different server types working together.

Here are the main players in this process:

1. DNS Recursor (or Recursive Resolver): This is the server that does the legwork on behalf of your computer. It's usually operated by your Internet Service Provider (ISP) or a public provider like Google (8.8.8.8) or Cloudflare (1.1.1.1). It receives your query and traverses the DNS hierarchy to find the answer.
2. Root Name Servers: There are 13 sets of these servers globally, forming the top of the DNS hierarchy. They don't know the IP address for google.com, but they know which servers manage the .com domain.
3. Top-Level Domain (TLD) Name Servers: These servers manage specific top-level domains like .com, .org, .net, or country codes like .uk or .de. The .com TLD server doesn't know the IP for google.com, but it knows the specific servers that are the authority for the google.com domain.
4. Authoritative Name Server: This is the final destination and the ultimate source of truth for a specific domain. The authoritative name server for google.com holds the actual DNS records, including the IP address, and provides it to the recursor.

The following diagram illustrates this hierarchical flow.

To get a detailed walkthrough of this journey, please read the following article from Cloudflare, a major player in the DNS ecosystem.

A Note on Caching

You might have noticed that accessing a website you've recently visited is almost instantaneous. This is thanks to DNS caching. To avoid repeating this entire multi-step process for every request, the results of DNS lookups are temporarily stored (cached) at various levels: in your browser, in your operating system, and on the recursive DNS server. When you request google.com again, your OS can likely provide the IP address from its cache immediately, skipping the entire lookup process.

3. Practical Exploration: Using dig on Your System

As an Arch Linux user, you have powerful command-line tools at your fingertips. For DNS, the most important one is dig (Domain Information Groper). It allows you to perform DNS lookups and see exactly what the servers are telling you.

Let's put theory into practice. Open your terminal and try these commands.

1. Basic Lookup
A simple dig command will query for the A record (the IPv4 address) of a domain.

dig google.com

Look for the ANSWER SECTION. You'll see one or more A records with the IP addresses for google.com.

2. Querying for Other Record Types
DNS stores more than just A records. For example, MX records specify the mail servers for a domain.

dig google.com MX

The ANSWER SECTION now shows the names of Google's mail servers. This is an example of DNS enumeration—gathering intelligence about a target's infrastructure.

3. Tracing the Full Path
The +trace option is incredibly powerful. It makes dig perform the full iterative query itself, showing you the entire path from the root servers down to the authoritative server. This lets you see the hierarchy we just discussed in action.

dig +trace google.com

The output will show:

• Your query to the root servers (.).
• Their response, pointing you to the .com TLD servers.
• Your query to a .com TLD server.
• Its response, pointing you to Google's authoritative name servers.
• Your final query to Google's name server, which provides the A record.

To learn more about dig and see examples of how to query for different record types, the following resource is very helpful.

4. DNS from a Hacker's Perspective

For a penetration tester, DNS is often the first stop during the reconnaissance phase. DNS records are public and can reveal a wealth of information about a target organization's infrastructure, a process called DNS enumeration.

By querying for different record types, you can discover:

• A records: IP addresses of web servers and other public-facing systems.
• AAAA records: IPv6 addresses.
• MX records: Mail servers, which are often high-value targets.
• TXT records: SPF/DKIM/DMARC email security policies, which can sometimes be misconfigured.
• NS records: The authoritative nameservers themselves.
• Subdomains: Finding subdomains like dev.company.com, vpn.company.com, or test.company.com can reveal less-protected or forgotten parts of a network.

Furthermore, traditional DNS queries are sent in plaintext (over UDP port 53), making them vulnerable to eavesdropping and manipulation (DNS spoofing). To learn more about this and the solutions created to fix it, the following video is a great primer.

Understanding these vulnerabilities and how to query for revealing information is a core skill you'll build upon with tools like nmap, theHarvester, and Recon-ng.

Conclusion

You now understand the critical role DNS plays in making the internet usable. You can trace the journey of a DNS query through its hierarchical system and have practical experience using dig to explore DNS records yourself.

Key Takeaways:

• DNS is the "phonebook of the Internet," translating domain names into IP addresses.
• The resolution process is hierarchical, involving a chain of queries from a recursive resolver to root, TLD, and finally authoritative name servers.
• DNS caching is used at multiple levels to speed up lookups for frequently accessed domains.
• The dig command is a powerful tool for querying DNS records from the command line, and dig +trace lets you see the full resolution path.
• From a security perspective, DNS is a primary source of information during reconnaissance (DNS enumeration).

Next Lesson Preview:
Now you know how we get an IP address for a domain name. But once your computer has the IP address of another device on the same local network (like your router), how does it actually send data to the correct physical machine? In the next lesson, we'll dive down a layer to explore the Address Resolution Protocol (ARP), which handles the crucial task of mapping IP addresses to physical MAC addresses on a local network.