How DNS resolution works, explained
Every connection starts with a name lookup. Here is what happens between typing a name and getting an address, and why a forged answer in a cache is dangerous, with links to the standards themselves.
- What it is
A tree of names, a database of answers.
DNS is a distributed database. Its name space is a tree: the root at the top, then top-level domains such as com, then individual domains. Authoritative name servers hold the data for each zone, the part of the tree they are responsible for. The database holds many record types, not only addresses.
- How it works
The resolver walks down the tree.
Your computer asks a resolver, which does the walking. If the answer is not in its cache, the resolver asks a root server and follows each referral to servers closer to the answer: the top-level domain, then the domain itself. The answer is cached for no longer than its TTL. In practice the resolver often already caches the early hops, and some names need more than one delegation level.
Source: RFC 1034, sections 3.6 and 5.3.3; RFC 1035, section 3.2.1
- Why it matters
A forged answer misleads everyone.
Once a caching resolver accepts a spoofed answer, it repeats it to its clients, and they contact the wrong, possibly malicious, servers. The poisoned entry is bounded by the TTL it carries, which the attacker can choose, and the attacker can try again afterwards. Randomising the query ID and source port makes spoofing far harder, and DNSSEC lets a validating resolver check digital signatures on signed zones.
The takeaway: Names map to addresses through a tree of servers. A resolver walks that tree and caches the answer. A forged answer in that cache misleads everyone who asks, until it expires.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
How does a name become an address? And what if the answer is a lie? DNS is a distributed database that maps names to addresses. The name space is a tree: the root at the top, then top-level domains like com, then individual domains. Each part of the tree has its own authoritative name servers. Your computer asks a resolver. If the answer isn't cached, the resolver asks a root server, which refers it to the top-level domain's servers. Those refer it to the domain's own servers, which give the answer. The resolver then keeps it only as long as its TTL allows. That trust is the weak point. If an attacker slips a forged answer into a resolver's cache, everyone asking that resolver for that name is sent to the attacker's address, until the TTL runs out. Random ports and ID numbers make forging harder, and DNSSEC adds digital signatures. So, names map to addresses through a tree of servers. A resolver walks that tree and caches the answer. And a forged answer in that cache misleads everyone who asks, until it expires.
Narrated with an AI voice.
