Domain Name System (DNS)

1. Concept and Purpose of DNS

Computers and routers route packets using numerical IP addresses (e.g., 142.250.190.46), but humans remember alphanumeric names (e.g., www.google.com).

The Domain Name System (DNS) (RFC 1034 / 1035) is a hierarchical, distributed database system that acts as the "phonebook of the Internet," mapping human-readable hostnames to numerical IP addresses.

                  +-----------------------------------+
                  |   "What is www.example.com?"      |
                  +-----------------------------------+
                                    |
                                    v
       [ Hostname: www.example.com ] ───> [ IP: 93.184.216.34 ]

2. Hierarchical Domain Name Space

The domain namespace is structured as an inverted tree with the Root at the top:

                            [ . ] (Root Level)
                                      |
         +----------------------------+----------------------------+
         |                                                         |
  GENERIC TLDs (.com, .org, .edu, .gov)              COUNTRY-CODE TLDs (.in, .uk, .ca)
         |                                                         |
  [ google.com ]   [ wikipedia.org ]                        [ ac.in ]   [ co.uk ]
         |
  [ mail.google.com ] [ drive.google.com ]

Hierarchy Levels:

Root Domain (.): Represented by a null string or dot at the top of the tree. Supervised by ICANN and operated across 13 worldwide root server clusters (A through M).
Top-Level Domains (TLD):
- Generic TLDs (gTLD): .com (commercial), .org (non-profit), .edu (education), .gov (government).
- Country-Code TLDs (ccTLD): Two-letter country codes: .in (India), .uk (United Kingdom), .us (United States).
Second-Level Domains: Registered by individuals or corporations (e.g., google.com, wikipedia.org).
Subdomains: Created by the domain owner to organize internal services (e.g., mail.google.com, cs.stanford.edu).

FQDN (Fully Qualified Domain Name): Absolute name terminated with a trailing dot (www.example.com.).
PQDN (Partially Qualified Domain Name): Relative name without trailing dot (www).

3. The DNS Resolution Process

DNS resolution combines Recursive and Iterative queries:

  Client (Browser)                                         Root Server (.)
         |                                                        ^
         | 1. Recursive Query: "What is www.example.com?"         |
         v                                                        |
  Local DNS Resolver (ISP / 8.8.8.8)                              |
         |----------------- 2. Iterative: "Where is .com?" ------>|
         |<---------------- 3. Reply: "Ask TLD .com at IP_TLD"---|
         |
         |----------------- 4. Iterative: "Where is example.com?"-> TLD Server (.com)
         |<---------------- 5. Reply: "Ask Auth NS at IP_Auth"---|
         |
         |----------------- 6. Iterative: "IP for www.example.com?"-> Auth Name Server (example.com)
         |<---------------- 7. Reply: "93.184.216.34" ------------|
         |
         |=== 8. Return IP 93.184.216.34 ========================> Client

Recursive Query (Client to Local DNS Resolver): The client demands that the local resolver do all the legwork to resolve the name or return an error.
Iterative Query (Local Resolver to Hierarchy Servers): The server contacted responds with the best referral it has ("I don't know the exact IP, but ask this next server").
Caching & TTL: The local resolver caches the resolved IP for the duration specified in the TTL (Time to Live) field, instantly serving future requests without querying the Internet.

4. DNS Resource Record (RR) Types

The DNS database stores entries called Resource Records (RRs):

Record Type	Full Name	Purpose	Example
A	Address Record	Maps hostname to 32-bit IPv4 address	`example.com. IN A 93.184.216.34`
AAAA	IPv6 Address	Maps hostname to 128-bit IPv6 address	`example.com. IN AAAA 2606:2800:220:1::`
CNAME	Canonical Name	Creates an alias pointing to the true name	`www.example.com. IN CNAME example.com.`
MX	Mail Exchange	Directs incoming email to mail servers	`example.com. IN MX 10 mail.example.com.`
NS	Name Server	Delegates a DNS zone to an authoritative server	`example.com. IN NS ns1.example.com.`
PTR	Pointer Record	Reverse DNS: Maps IP address to Hostname	`34.216.184.93.in-addr.arpa IN PTR example.com.`
SOA	Start of Authority	Stores zone administrative metadata and serial	Primary NS, Admin email, Refresh timers
TXT	Text Record	Human-readable text; SPF/DKIM email verification	`v=spf1 include:_spf.google.com ~all`

5. Transport Protocol Usage: UDP vs. TCP on Port 53

DNS uses Well-Known Port 53 on both UDP and TCP:

UDP Port 53: Used for standard client queries and responses. Standard DNS messages are under $512\text{ bytes}$ ; UDP avoids connection handshake latency.
TCP Port 53: Used for Zone Transfers (replicating entire DNS databases between primary and secondary name servers) and responses exceeding $512\text{ bytes}$ (or DNSSEC) requiring reliable transmission.

6. Key Exam Questions & Takeaways

Differentiate Recursive and Iterative DNS queries.
- In a Recursive query, the client places the entire resolution burden on the queried server, which must return either the resolved IP or an error. In an Iterative query, the contacted server returns the IP of the next authoritative server down the chain if it cannot answer directly.
When does DNS use TCP instead of UDP?
- For Zone Transfers between primary and secondary DNS servers to ensure database replication integrity, and when query responses exceed the 512-byte UDP packet limit (e.g., DNSSEC).
What is Reverse DNS lookup and which record type performs it?
- Reverse DNS resolves a known IP address back into its domain hostname using PTR (Pointer) records inside the special in-addr.arpa domain.

Domain Name Space (DNS)