GO KALI FREE
IntermediateNetworking

DNS Explained: How the Domain Name System Works and Its Security

An in-depth exploration of DNS architecture, resolution process, record types, caching, security threats, and privacy protocols like DoH and DoT.

#DNS#domain name system#networking#DNSSEC#DoH#DoT

How DNS Resolves Domains

Every network request you make — every scan, every web page, every API call — starts with a DNS lookup. Attackers exploit DNS for data exfiltration, command-and-control, and cache poisoning. Understanding the resolution process lets you troubleshoot connectivity, detect malicious activity, and harden your infrastructure. This guide breaks DNS down into the practical mechanics you need for security work.

DNS Hierarchical Architecture

DNS uses a distributed, hierarchical architecture with no single point of failure.

Root Servers

At the top of the hierarchy are 13 root server systems (identified as A through M), operated by organizations like ICANN, Verisign, and the University of Maryland. These servers do not contain domain-specific information but direct queries to the appropriate Top-Level Domain (TLD) nameserver. Anycast routing distributes root server traffic across hundreds of physical machines worldwide.

TLD Nameservers

Top-Level Domain nameservers manage domains within specific TLDs like .com, .org, .net, .edu, and country code TLDs like .uk, .de, .jp. When a root server receives a query for "example.com", it directs the resolver to the .com TLD nameserver.

Authoritative Nameservers

Authoritative nameservers hold the actual DNS records for a domain. When you register a domain, you configure its authoritative nameservers (often provided by the registrar or a DNS hosting service). These servers respond with the definitive IP address for the domain.

Recursive Resolvers

Recursive resolvers (also called caching resolvers) handle the actual lookup process on behalf of clients. Your ISP or a public resolver like Google (8.8.8.8) or Cloudflare (1.1.1.1) runs recursive resolvers. They cache responses to speed up subsequent queries.

The DNS Resolution Process

When you type "example.com" into your browser, a complex but fast series of queries occurs:

  • **Browser cache check** — The browser checks its internal DNS cache
  • **OS cache check** — The operating system checks its DNS cache
  • **Recursive resolver query** — If not cached, the request goes to the configured recursive resolver
  • **Root server query** — The resolver asks a root server where to find .com nameservers
  • **TLD server query** — The resolver asks the .com TLD server for example.com's authoritative nameservers
  • **Authoritative server query** — The resolver asks example.com's authoritative nameserver for the IP address
  • **Response and caching** — The resolver caches the result and returns it to your browser

    • This entire process typically completes in 10-100 milliseconds thanks to extensive caching at every level.

    DNS Record Types

    DNS supports multiple record types for different purposes:

    | Record | Purpose | Example |

    |--------|---------|---------|

    | A | Maps domain to IPv4 address | example.com → 93.184.216.34 |

    | AAAA | Maps domain to IPv6 address | example.com → 2606:2800:220:1:248:1893:25c8:1946 |

    | CNAME | Canonical name alias | www.example.com → example.com |

    | MX | Mail exchange server | example.com → mail.example.com (priority 10) |

    | TXT | Arbitrary text data | SPF records, DKIM, verification strings |

    | NS | Authoritative nameserver | example.com → ns1.example.com |

    | SOA | Start of authority | Administrative info about the zone |

    | SRV | Service location | _sip._tcp.example.com → server:5060 |

    | PTR | Reverse lookup (IP to name) | 34.216.184.93 → example.com |

    DNS Caching

    Caching is essential for DNS performance. Without it, every query would traverse the full hierarchy. DNS records include a Time-To-Live (TTL) value that tells resolvers how long to cache the response.

  • **Browser cache** — Very short (minutes to hours)
  • **OS cache** — Moderate (minutes to hours)
  • **Recursive resolver cache** — Configurable, typically matches the TTL
  • **Application-level cache** — Applications can also cache DNS results

    • Proper TTL configuration balances freshness against resolver load. Static resources can use longer TTLs (hours or days), while services that change IP addresses frequently should use shorter TTLs (minutes).

    DNS Security Considerations

    Despite its critical role, DNS was designed without built-in security mechanisms. This has led to several attack vectors.

    DNS Spoofing (Cache Poisoning)

    An attacker injects fraudulent DNS records into a resolver's cache, redirecting users to malicious sites. When a resolver caches a poisoned record, all users of that resolver are affected until the TTL expires. DNSSEC (DNS Security Extensions) prevents this by cryptographically signing DNS records.

    DNS Tunneling

    Attackers encode data in DNS queries and responses to bypass firewalls that block other traffic. Since DNS is rarely blocked entirely, tunneling provides a covert communication channel for data exfiltration or command-and-control traffic. Organizations can detect tunneling by monitoring for unusual DNS query patterns, such as high query volumes or long domain names.

    DNS-based DDoS Attacks

    The DNS infrastructure itself can be targeted by distributed denial-of-service (DDoS) attacks. Amplification attacks exploit open DNS resolvers to send large responses to a spoofed victim address — a small query results in a much larger response, amplifying the attacker's traffic. Attackers can also target authoritative nameservers directly to make domains unreachable.

    Domain Hijacking

    Attackers gain unauthorized access to a domain registrar account and change the authoritative nameservers, redirecting all traffic for the domain. Prevention requires strong account security (MFA), registrar locks, and monitoring.

    DNSSEC

    DNS Security Extensions (DNSSEC) adds cryptographic signatures to DNS records. When a resolver receives a signed record, it can verify the signature against the parent zone, creating a chain of trust from the root zone down to the individual domain.

    DNSSEC prevents cache poisoning and other spoofing attacks but adds complexity. Configuration involves generating signing keys, signing zones, and managing key rollovers. Adoption has been slow due to this complexity, but major TLDs and many domains now support DNSSEC.

    DNS Tools

    Proficiency with DNS tools is essential for network troubleshooting and security investigation.

    dig

    dig (Domain Information Groper) is the most powerful DNS troubleshooting tool:

    dig example.com                     # Standard A record lookup
dig example.com MX                  # Lookup MX records
dig example.com ANY                 # Lookup all record types (deprecated in some cases)
dig +trace example.com              # Trace resolution path step by step
dig @8.8.8.8 example.com            # Query a specific resolver
dig -x 93.184.216.34                # Reverse DNS lookup

    nslookup

    nslookup is simpler but still widely used:

    nslookup example.com
nslookup -type=MX example.com
nslookup 93.184.216.34

    host

    host provides the simplest output:

    host example.com
host -t MX example.com

    DNS Privacy

    Traditional DNS queries are sent in plaintext, meaning anyone on the network can see which domains you are visiting. Two protocols address this privacy gap:

  • **DNS over HTTPS (DoH)** — Encrypts DNS queries in HTTPS traffic on port 443, making them indistinguishable from regular web traffic
  • **DNS over TLS (DoT)** — Encrypts DNS queries using TLS on port 853

    • Major DNS providers support both protocols. DoH is more deployment-friendly since it uses the standard HTTPS port, but DoT is simpler and more transparent. Both prevent eavesdropping and manipulation of DNS traffic.

    Public DNS Providers

    | Provider | IPv4 | Features |

    |----------|------|----------|

    | Google | 8.8.8.8, 8.8.4.4 | Fast, reliable, DoH/DoT support |

    | Cloudflare | 1.1.1.1, 1.0.0.1 | Privacy-focused, no logging, DoH/DoT |

    | Quad9 | 9.9.9.9 | Blocks known malicious domains |

    | OpenDNS | 208.67.222.222, 208.67.220.220 | Content filtering, phishing protection |

    DNS is a foundational internet technology that every networking and security professional must understand deeply. From its hierarchical architecture to its security challenges and privacy innovations, DNS knowledge is essential for troubleshooting, security analysis, and system administration.

    Frequently Asked Questions

    What is DNS and how does it work?

    DNS (Domain Name System) translates domain names like example.com into IP addresses. When you type a URL, your browser checks its cache, queries a recursive resolver, which then queries root, TLD, and authoritative servers to find the IP address, typically in 10-100 milliseconds.

    What are the different DNS record types?

    A records map domains to IPv4 addresses, AAAA to IPv6, CNAME for aliases, MX for mail servers, TXT for text data (SPF, DKIM), NS for nameservers, and SOA for zone authority. See our [networking basics](/learn/networking-basics) guide for more details.

    What is DNS caching and why does it matter?

    DNS caching stores resolved DNS responses at multiple levels (browser, OS, resolver) to speed up subsequent queries. Records have a TTL (Time-To-Live) value. Lower TTLs mean faster propagation of changes but increase DNS query load.

    What is DNS cache poisoning?

    DNS cache poisoning (spoofing) injects fraudulent DNS records into a resolver's cache, redirecting users to malicious sites. [DNSSEC](/learn/dns-explained) prevents this by cryptographically signing DNS records, creating a chain of trust from root to domain.

    What is DNS tunneling?

    DNS tunneling encodes data in DNS queries and responses to bypass firewalls. Attackers use it for data exfiltration or command-and-control traffic. Detect it by monitoring for unusual patterns like high query volumes or unusually long domain names.

    What is the difference between DoH and DoT?

    DNS over HTTPS (DoH) encrypts DNS queries within HTTPS traffic on port 443, making them indistinguishable from web traffic. DNS over TLS (DoT) uses TLS on port 853. Both prevent eavesdropping, but DoH is harder to block.

    What is DNSSEC and why is it important?

    DNSSEC adds cryptographic signatures to DNS records, preventing cache poisoning and spoofing attacks. It creates a chain of trust from the root zone down to individual domains. Adoption has been slow due to configuration complexity.

    What public DNS providers are available?

    Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9), and OpenDNS (208.67.222.222) are popular public DNS resolvers. Cloudflare focuses on privacy, Quad9 blocks malicious domains, and all support DoH/DoT encryption.

    How do I troubleshoot DNS issues?

    Use `dig` or `nslookup` to query DNS records directly, `dig +trace` to follow the resolution path step by step, and check local DNS cache with `systemd-resolve --flush-caches` on Linux. Verify the configured DNS server with `cat /etc/resolv.conf`.

    What is a CNAME record?

    A CNAME (Canonical Name) record creates an alias pointing one domain to another. For example, www.example.com might CNAME to example.com. CNAMEs cannot coexist with other record types on the same name and are not suitable for root domains.