Networking · Protocols
DNS
The Domain Name System is the distributed, hierarchical directory that resolves names to addresses and service records for nearly every other service.
Overview
DNS maps human readable names to IP addresses, mail routing targets, service locations and text metadata. It is hierarchical: the root zone delegates to top level domains, which delegate to registered domains, which may delegate further to subdomains.
Internally, DNS is also the backbone of Windows domain operation. Domain controllers publish SRV records that clients use to locate authentication services, so a DNS fault in an Active Directory environment presents as a widespread authentication outage.
How it works
- 01A client (stub resolver) sends a recursive query to a configured resolver, usually over UDP/53, falling back to TCP for large responses or zone transfers.
- 02If the answer is not cached, the recursive resolver queries the root servers, follows referrals to the TLD servers, then to the authoritative name servers for the zone.
- 03The authoritative server returns the record set; the resolver caches it for the duration of the record's TTL and returns the answer to the client.
- 04DNSSEC allows a resolver to validate that the answer chain is signed and unaltered; DoH and DoT encrypt the client to resolver hop.
Sequence
- 1Client stub resolver
- 2Recursive resolver (cache check)
- 3Root name servers
- 4TLD name servers (.com)
- 5Authoritative name servers (example.com)
- 6Answer cached and returned
Every step is cacheable. Most production DNS problems are cache or TTL problems, not resolution problems.
Reference table
| Type | Purpose | Notes |
|---|---|---|
| A / AAAA | Name to IPv4 / IPv6 address | The most common lookups |
| CNAME | Alias to another name | Cannot coexist with other records at the same label |
| MX | Mail exchange target and priority | Points to a name, never an IP |
| TXT | Arbitrary text | Carries SPF, DKIM, DMARC and domain verification |
| SRV | Service location: host, port, priority, weight | Used heavily by Active Directory and SIP |
| NS | Delegation to authoritative servers | Must match the parent zone delegation |
| PTR | Reverse lookup: address to name | Expected by many mail servers |
| CAA | Which CAs may issue certificates | Reduces mis issuance risk |
Where it is used
- Service discovery for domain joined clients and for cloud workloads.
- Traffic steering: weighted, latency based and failover routing at the DNS layer.
- Email authentication through SPF, DKIM and DMARC records.
- Security telemetry, DNS logs are one of the highest value data sources in a SOC.
Security considerations
- Cache poisoning and spoofing are mitigated by DNSSEC validation, source port randomisation and 0x20 encoding.
- DNS is a common exfiltration and command and control channel; monitor for high entropy subdomains and abnormal query volumes.
- Restrict zone transfers to named secondaries and disable open recursion on internet facing resolvers.
- Protective DNS filtering blocks known malicious domains before a connection is ever attempted.
Common misconfigurations
- Domain members pointed at a public resolver instead of internal DNS, breaking authentication and Group Policy.
- Dangling CNAME records that point at deprovisioned cloud resources, enabling subdomain takeover.
- Very long TTLs on records that need to change during failover, or 60 second TTLs everywhere, punishing resolver load.
- Split horizon zones that drift, so internal and external answers disagree.