LAB 3

Understanding DNS Working (Using dnslookup and

dig)
Ref: Wikipedia

The Domain Name System (DNS) is a hierarchical distributed naming system for computers,
services, or any resource connected to the Internet or a private network. It associates various
information with domain names assigned to each of the participating entities. A Domain Name
Service resolves queries for these names into IP addresses for the purpose of locating computer
services and devices worldwide. By providing a worldwide, distributed keyword-based redirection
service, the Domain Name System is an essential component of the functionality of the Internet.

DNS Records

A DNS name server is a server that stores the DNS records for a domain name, such as address
(A) records, name server (NS) records, and mail exchanger (MX) records (see also list of DNS
record types); a DNS name server responds with answers to queries against its database.

Domain name space

The domain name space consists of a tree of domain names. Each node or leaf in the tree has
zero or more resource records, which hold information associated with the domain name. The
tree sub-divides into zones beginning at the root zone. A DNS zone may consist of only one
domain, or may consist of many domains and sub-domains, depending on the administrative
authority delegated to the manager.
The hierarchical Domain Name System, organized into zones, each served by a name server

Authoritative name server

An authoritative name server is a name server that gives answers that have been configured by
an original source, for example, the domain administrator or by dynamic DNS methods, in
contrast to answers that were obtained via a regular DNS query to another name server. An
authoritative-only name server only returns answers to queries about domain names that have
been specifically configured by the administrator.

Address resolution mechanism

Domain name resolvers determine the appropriate domain name servers responsible for the
domain name in question by a sequence of queries starting with the right-most (top-level)
domain label.
A DNS recursor consults three nameservers to resolve the address www.wikipedia.org.

The process entails:

1. A network host is configured with an initial cache (so called hints) of the known addresses
of the root nameservers. Such a hint file is updated periodically by an administrator from
a reliable source.
2. A query to one of the root servers to find the server authoritative for the top-level
domain.
3. A query to the obtained TLD server for the address of a DNS server authoritative for the
second-level domain.
4. Repetition of the previous step to process each domain name label in sequence, until the
final step which returns the IP address of the host sought.

The diagram illustrates this process for the host www.wikipedia.org.

Record caching

The DNS Resolution Process reduces the load on individual servers by caching DNS request
records for a period of time after a response. This entails the local recording and subsequent
consultation of the copy instead of initiating a new request upstream. The time for which a
resolver caches a DNS response is determined by a value called the time to live (TTL) associated
with every record.

DNS Zone

A DNS zone is a portion of a domain name space using the Domain Name System (DNS) for
which administrative responsibility has been delegated.
Example of zone authority in DNS queries

As an example of the DNS resolving process, consider the role of a recursive DNS
resolver attempting to look up the address "en.wikipedia.org.". It begins with a list of addresses
for the most authoritative name servers it knows about – the root zone name servers (indicated
by the full stop or period), which contains name server information for all top-level domains of
the Internet.

When querying one of the root name servers, it is possible that the root zone will not directly
contain a record for "en.wikipedia.org.", in which case it will provide a referral to the authoritative
name servers for the "org." top level domain (TLD). The resolver is issued a referral to the
authoritative name servers for the "org." zone, which it will contact for more specific information.
Again when querying one of the "org." name servers, the resolver may be issued with another
referral to the "wikipedia.org." zone, whereupon it will again query for "en.wikipedia.org.". Since
(as of July 2010) "en.wikipedia.org." is a CNAME to "text.wikimedia.org." (which is in turn a
CNAME to "text.esams.wikimedia.org."), and the "wikipedia.org." name servers also happen to
contain authoritative data for the "wikimedia.org." zone, the resolution of this particular query
occurs entirely within the queried name server, and the resolver will receive the address record it
requires with no further referrals.

If the last name server queried did not contain authoritative data for the target of the CNAME, it
would have issued the resolver with yet another referral, this time to the zone text.wikimedia.org..
However, since the resolver had previously determined the authoritative name servers for the
zone org., it does not need to begin the resolution process from scratch but instead start at
zone org., thus avoiding another query to the root name servers.

There is no requirement that resolving should involve any referrals at all. Looking
up en.wikipedia.org. on the root name servers always results in referrals, but if an alternative DNS
root is used which is set up to contain a record for en.wikipedia.org., then the record is returned
on the first query.

Using nslookup

In it is most basic operation, nslookup tool allows the host running the tool to query any
specified DNS server for a DNS record. The queried DNS server can be a root DNS server, a top-
level-domain DNS server, an authoritative DNS server, or an intermediate DNS server (see the
textbook for definitions of these terms). To accomplish this task, nslookup sends a DNS query to
the specified DNS server, receives a DNS reply from that same DNS server, and displays the
result.
Consider the first command:
nslookup www.mit.edu
Now consider the second command:
nslookup –type=NS mit.edu
finally consider the third command:
nslookup www.uet.edu.pk bitsy.mit.edu
In this example, we indicate that we want to the query sent to the DNS server bitsy.mit.edu rather
than to the default DNS server of UET. Thus, the query and reply transaction takes place directly
between our querying host and bitsy.mit.edu. In this example, the DNS server bitsy.mit.edu
provides the IP address of the host
www.uet.edu.pk, which is a web server at the UET Lahore.

Lab Exercise 1:
Do the following (and write down the results):

1. Run nslookup to obtain the IP address of a Web server of UET.

111.68.102.6

2. Run nslookup to determine the authoritative DNS servers for UET.

3. Run nslookup to determine the mail servers for UET.

Using Dig
dig (domain information groper) is a network administration command-line tool for
querying Domain Name System (DNS) name servers.
Dig is useful for network troubleshooting and for educational purposes. Dig can operate
in interactive command line mode or in batch mode by reading requests from an
operating system file. When a specific name server is not specified in the command
invocation, it will use the operating systems default resolver, usually configured via
the resolv.conf file. Without any arguments it queries the DNS root zone.

Dig supports Internationalized Domain Name (IDN) queries.

Dig is part of the BIND domain name server software suite. Dig replaces older tools
such as nslookup and the host program.

Lab Exercise 3

Download dig tool for your operating system

1. Run this command: dig google.com

a. What IP addresses are associated with google.com?
b. Run the same command again. Note that the numbers in the second column of
the Answer Section change. Wait a few seconds and run it a third time. What do
the numbers in the second column represent?
2. Run this command: dig google.com ns
a. What is different about the information provided by this version of the command?
 b. How many name servers are there for google.com?
3. Run this command google.com mx