DNS: Turning Names into Addresses

Application Layer and Security · 30 min

Core CS · Computer Networks

Four questions, and only the last one answers

A packet header has nowhere to write a name. No single machine holds the mapping either, so every lookup walks a tree from the root downward, one refusal at a time, and then caches the result so it never has to happen again.

Resolve one name down the tree, then watch the cache answer it in one step
Your machine asks one resolver for the complete answer. That resolver asks a root server, then a top level domain server, then the authoritative server, and the first two both reply I do not know, ask this one instead. Recursive is what you ask for. Iterative is how it actually gets done.

01 The idea

People use names, packets carry addresses

Every connection you make starts with a number. The destination address field in an IPv4 header is 32 bits wide and in IPv6 it is 128 bits, and there is nowhere in either header to write the college website. A router forwards on addresses and nothing else. So before a single packet leaves your machine, something has to turn the name you typed into an address, and that lookup is a network operation in its own right: it has its own protocol, its own port, its own failure modes, and its own latency that you pay before the real connection even begins.

The first version of the solution was one file. On the early ARPANET a single HOSTS.TXT listing every host and its address was maintained centrally at the Network Information Center at SRI, and every machine on the network fetched a fresh copy periodically. It worked while there were a few hundred hosts, and it failed for three reasons that any central registry eventually hits. The file itself grew without bound. The load on the one machine serving it grew roughly with the square of the network size, because both the number of entries and the number of machines fetching them were increasing at once. And a single registry means one organisation approving every name on earth, which is an administrative bottleneck long before it is a technical one.

What replaced it, in 1983, is the Domain Name System, and it fixed all three problems with the same move: split the database up and hand each piece to whoever actually owns it. Three properties follow, and they are the three things to hold on to. The name space is a tree. Authority over the tree is delegated downward, so the people who run examate.in answer for the names inside it and nobody has to ask permission to add one. And every answer carries a TTL, a lifetime, so it can be cached by anyone who sees it.

Read a name the way the tree is built, which is right to left. In www.examate.in. the trailing dot is the root, an empty label that is almost always left off when you type but is always there on the wire. To its left, in is the top level domain. Then examate.in is the second level domain, the piece an organisation registers. Then www is a subdomain or host name inside it. Each dot-separated piece is a label, capped at 63 bytes, and the whole encoded name is capped at 255 bytes. Written out in full with the trailing dot, ending at the root, the name is a fully qualified domain name, and it is unambiguous. Written without it, www on its own means whatever your machine's search list decides it means.

Everything else in this lesson follows from one uncomfortable fact: no server holds the whole map. There is no machine you can ask that knows where www.examate.in is and also where every other name on the internet is. The root servers know only which servers were delegated each top level domain. The .in servers know only which servers were delegated each domain inside .in. Only the last server in the chain has the actual address, and finding it means walking down the tree collecting one refusal per level.

No server holds the whole map. You ask one resolver for the finished answer, and it walks the tree from the root downward, collecting one referral per level until it reaches the server that is authoritative for the name. Everything else in DNS is caching that walk so it does not have to happen again.
Zone and authorityA zone is the slice of the tree that one organisation actually answers for. The server holding it is authoritative: it answers from the zone's own data rather than from a cache, and it sets the AA bit in the reply to say so. A domain is a whole subtree of names; a zone is the part of that subtree not cut away by a delegation to somebody else.
ReferralA reply that deliberately contains no answer. The Answer section is empty, the Authority section names the servers one level further down, and the Additional section usually carries their addresses as glue. It is not an error and not a failure. It means not me, ask them, and it is the shape of every reply in a lookup except the last one.
TTLA per-record lifetime in seconds, set by the zone's owner, saying how long anyone who receives this record is allowed to keep it. Every cache holding the record counts it down, so the TTL you are handed is what is left, not what was published. It is the only control anyone has over how stale an answer can be.

02 Worked example

One name, resolved from a completely cold cache

One name, worked end to end, and it is the same name for the rest of the lesson: www.examate.in., record type A. Nothing anywhere is cached. The root server address 198.41.0.4 is the real one for a.root-servers.net; every other address here comes from the documentation ranges reserved by RFC 5737, so none of them can collide with a real host. Read left to right.

Stub resolverThe few hundred lines inside your operating system that getaddrinfo() calls. It checks its own tiny cache, misses, and does the only thing it can do. It cannot walk anything itself.
Recursive resolver 198.51.100.53Your ISP's, your router's, or a public one. The stub sends it one query with the RD bit set, recursion desired. From here the resolver owns the problem and the stub hears nothing until it is finished.
Root 198.41.0.4Asked for www.examate.in. A, and it does not answer. Answer section empty, AA clear, Authority section holding the NS records for in. and Additional holding their glue addresses. This is the referral, and it is the point of the whole lesson.
TLD 192.0.2.53The .in registry's server, asked the same complete name again. It knows which servers were delegated examate.in. and nothing about what is inside it, so it refers again, to ns1.examate.in. at 203.0.113.10.
Authoritative 203.0.113.10Asked the same name a third time, and this one answers from the zone file with AA set: www.examate.in. 300 IN A 203.0.113.25. The resolver caches it, the stub caches it, and your program finally gets an address.

Four queries for one name, and three of them were sent by a machine you never spoke to. Count what each participant actually did, because the counting is the answer to half the questions asked about this topic. The stub asked once, and its query was recursive: it set RD=1, which means do not send me a referral, go and get the finished answer. A stub never sees a referral in its life. The resolver asked three times, and its queries were iterative: RD clear, take an answer or a pointer, whichever you have. Notice that all three carried the identical question, www.examate.in. A. The resolver does not ask the root about in and then the TLD about examate; a DNS query always carries the complete name, and it is the server that decides how much of it it can act on.

Now the highlighted node, because why the root refuses to answer is the follow-up. It is not being unhelpful and it is not overloaded. The root zone physically contains delegations and nothing else: on the order of 1,500 top level domains, each with a handful of NS records. There is no entry in it for www.examate.in and there never will be, because storing one would mean storing every name on the internet in one zone, which is the exact design that HOSTS.TXT died of. The same argument repeats one level down: the .in registry stores which nameservers were delegated each registered domain, not what is inside those domains, which is why you can add a hostname to your own zone this afternoon without telling a registry anything.

Two details in that reply carry marks. The Authority section holds NS records, and an NS record holds a name, not an address. So a referral to ns1.examate.in. would be circular on its own: to reach the server for examate.in you would have to resolve a name that is itself inside examate.in. That is what the Additional section is for. The parent zone publishes glue, the A record for the nameserver, alongside the delegation, and the circularity is broken. Second, the resolver never had to ask anybody where the root servers are. It ships with a root hints file listing all thirteen of them by name and address, and that file is the one piece of hardcoded knowledge in the entire system. Everything else is discovered.

While we are on the thirteen: there are 13 named root server identities, a.root-servers.net through m.root-servers.net, and that number was chosen because thirteen name-and-address pairs were the most that would fit in the original 512-byte UDP DNS reply. The honest real-world clause, and it is worth saying out loud in an interview because it shows you know why the number is stale: those are 13 addresses, not 13 machines. Each one is announced from many locations at once using anycast, where the same IP address is advertised into BGP from hundreds of sites and the routing system delivers your packet to the nearest one, so the real count is well over a thousand physical servers on every continent.

Finally, the number that decides whether any of this ever happens again: the 300 in www.examate.in. 300 IN A 203.0.113.25. That is the TTL in seconds. For the next 300 seconds, any query to that resolver for that name is answered out of memory in one step with no walk at all, and the resolver returns the remaining lifetime rather than the published one. Run the same lookup twice in a row and watch the TTL go down; that is how you tell a cached answer from a fresh one without any other tooling. Caching happens at every level, not only at the resolver: the stub caches if it caches at all, the resolver caches, and the resolver also caches the two referrals it collected, so the next lookup of any name under examate.in starts from the delegation rather than from the root. And the negative case is cached too. If the authoritative server had replied NXDOMAIN, this name does not exist, RFC 2308 says that non-existence is itself cached, for a lifetime taken from the zone's SOA record, so a typo in a link does not re-walk the tree on every retry.

03 Mechanics

The five roles, the two words, and the records

Four tables, in the order the questions come. First the participants, because almost every wrong answer about DNS comes from collapsing two of these five into one. Read the last column as a promise: it is what that box will and will not put in a reply.

RoleWhere it runsWhat it holdsWhat it replies with
Stub resolverInside your OS, reached through getaddrinfo()A tiny cache, and the resolver's address from /etc/resolv.conf or DHCP option 6Nothing. It asks one question and waits.
Recursive resolverYour ISP, your home router, or a public serviceA large shared cache and the root hints fileThe finished answer, or a failure such as SERVFAIL or NXDOMAIN
Root server13 anycast identities, a to m.root-servers.netThe root zone: a delegation for every TLDa referral to the TLD, never an answer
TLD serverRun by the registry for that TLDA delegation for every domain registered under ita referral to the domain’s nameservers
Authoritative serverRun by the domain owner or their DNS providerThe zone file itself, the actual recordsThe answer, with AA set. Or NXDOMAIN, also authoritatively.

The row people merge. The stub and the recursive resolver are not the same thing and they do not do the same job. The stub is a library, not a server, and it walks nothing. The resolver is the only box in the list that ever moves down the tree, and it is also the only one whose address you configure. If you remember one sentence from this table, make it that one: the recursion happens at the resolver, and the iteration happens beneath it.

Which is the second table, and the one worth being pedantic about. Recursive and iterative are not two kinds of DNS. They are two legs of the same lookup, and the words describe who does the walking.

Recursive queryIterative query
The asker is sayingGo and get me the final answer for this name.Give me the answer if you have it, otherwise tell me who to ask next.
The RD bitRD = 1RD = 0
If the server cannot answerIt goes and asks other servers on your behalfIt returns a referral and stops. Its job is done.
Who does the workThe serverThe asker
Used on which legStub to recursive resolverRecursive resolver to root, TLD, authoritative
What comes backOne answer, or one failureA referral at every hop but the last
Number of queries in section 0213

The sentence that gets the mark. The client's query is recursive; the resolver's queries are iterative. Answering "DNS is recursive" or "DNS is iterative" without naming the leg is the single most common way this question is failed, because both halves are true of different halves of the same lookup. Two clauses worth adding. An authoritative server asked with RD=1 does not perform recursion for you; it ignores the bit, answers if the name is in its zone, and otherwise refers or refuses. And a recursive resolver that will do this work for anybody on the internet is called an open resolver, which is how DNS amplification attacks are built: a small forged query produces a large reply aimed at the victim whose address was spoofed.

Third, the records. A zone is a set of resource records, each written as name, TTL, class, type, then the data. The class is IN for internet and you will realistically never see another. What matters is the type, and specifically what each type is allowed to hold.

TypeWhat it holdsExampleThe trap
AOne IPv4 address, 32 bits, four bytes of datawww.examate.in. 300 IN A 203.0.113.25The type is A for address, not "IP". One record holds exactly one address; several A records for one name is how simple load spreading is done.
AAAAOne IPv6 address, 128 bitswww.examate.in. 300 IN AAAA 2001:db8:42::25Four times the bits of an A record, which is where the four As come from. A host can publish both and the client chooses.
CNAMEanother NAME, never an addressshop.examate.in. 3600 IN CNAME cdn.example.net.A CNAME cannot point at an address, cannot sit at the zone apex, and cannot coexist with any other record at the same name. Resolving it means starting a fresh lookup on the target.
MXA 16-bit preference plus a mail exchanger's nameexamate.in. 3600 IN MX 10 mail1.examate.in.the LOWER preference is tried first — and the target must be a name that has an A or AAAA record, never a CNAME and never an address literal
NSThe name of a server delegated to answer for a zoneexamate.in. 172800 IN NS ns1.examate.in.It appears twice: in the parent zone as the delegation, and inside the child zone itself. The parent's copy is the one a resolver follows on the way down, and only the child's copy is authoritative.
PTRA name, for the reverse lookup address to name25.113.0.203.in-addr.arpa. IN PTR www.examate.in.The address is written backwards and lives under in-addr.arpa, or ip6.arpa for IPv6. A PTR is not created automatically and is not required to agree with the A record.
TXTArbitrary text stringsexamate.in. 3600 IN TXT "v=spf1 mx -all"This is where SPF, DKIM and domain-ownership proofs live. DNS does not interpret any of it; the mail server or the verifying service does.
SOAZone metadata: primary server, admin mailbox, serial, refresh, retry, expire, minimumexamate.in. IN SOA ns1.examate.in. hostmaster.examate.in. 2026080601 7200 3600 1209600 300Exactly one per zone. Its minimum field is no longer a default TTL: RFC 2308 redefined it as the negative caching lifetime, the one at the end of that line.

Why a CNAME cannot sit at the apex, which is asked more often than it looks. The apex of a zone, the bare examate.in., must carry an SOA record and its NS records. A CNAME is not allowed to coexist with any other record at the same name, because a CNAME means this name is an alias, look at the other name instead, and that is incompatible with also having data of your own. So examate.in. CNAME something is illegal, which is exactly why you cannot point a bare domain at a CDN hostname the obvious way. Providers solved it with non-standard records that behave like a CNAME to the outside world but return A records: Route 53 calls them alias records, Cloudflare calls it CNAME flattening. Naming that workaround is a strong answer, because it shows you know it is a workaround.

Last, the transport and the message, because "why does DNS use UDP" is a guaranteed question and the good answer has arithmetic in it.

QuestionAnswerWhy it is that way
Port53, on both UDP and TCPThe same port number is registered for both transports. TCP is not a different service.
Default transportUDPA query and its reply are one small datagram each. No handshake means one round trip instead of two, and a lost query costs one retransmission rather than a connection.
When TCP is usedtruncated replies, and zone transfersIf the reply will not fit, the server sends what it can with the TC (truncated) bit set and the client repeats the query over TCP. Zone transfers move a whole zone and need reliability and ordering.
Original UDP size cap512 bytes of DNS payloadRFC 1035. This is also the reason there are exactly 13 root servers.
Getting past 512EDNS(0), RFC 6891The client advertises a larger UDP buffer in an OPT pseudo-record, commonly 1232 bytes since the 2020 recommendation, or 4096 on older software.
Headera fixed 12 bytesA 16-bit ID, 16 bits of flags including QR RD RA AA TC and the 4-bit RCODE, then four 16-bit counts, one per section.
The four sectionsQuestion, Answer, Authority, AdditionalA referral is exactly the reply where Answer is empty and the other two are full.
Zone transfersAXFR full, IXFR incrementalHow a secondary authoritative server copies the zone from the primary. Both run over TCP.
Common RCODEs0 NOERROR · 2 SERVFAIL · 3 NXDOMAIN · 5 REFUSEDNXDOMAIN means the name does not exist. SERVFAIL means the resolver could not find out, which is a very different problem.
Encrypted variantsDoT on TCP 853 · DoH on TCP 443Plain DNS on port 53 is neither encrypted nor authenticated. DNSSEC signs records so you can detect forgery, but it does not hide anything; DoT and DoH hide the traffic but do not authenticate the data.

The arithmetic behind "why UDP", and it is worth being able to produce. Take the query from section 02. The header is 12 bytes. The question section holds the encoded name plus a 2-byte type and a 2-byte class, and a name is encoded as a length byte in front of each label with a zero byte for the root: 3www is 4 bytes, 7examate is 8, 2in is 3, and the root label is 1, so the name is 16 bytes and the question section is 20. The whole query is 32 bytes. Opening a TCP connection to carry 32 bytes costs a full round trip before the question is even asked, plus connection state on a server answering millions of these. If a UDP query is lost the resolver asks again after a second or two, which is cheaper than any handshake and is why the retry, not reliability, is the right tool here.

Why this is the outage that takes everything with it. Every protocol in this course begins with a DNS lookup, so when name resolution fails nothing works, and it does not look like a DNS problem. It looks like every service being down at once. The failure is also strangely delayed, because while records are still cached the outage is invisible, and it becomes total only as those TTLs run out. In October 2016 a large DDoS against Dyn's authoritative infrastructure made a long list of perfectly healthy sites unreachable for hours, purely because their names could not be resolved. The defence is the same one you would apply to any single point of failure: publish your zone on two independent authoritative providers, on separate NS records, so losing one is survivable.

And the honest part, which is about the TTL you chose months earlier. A long TTL is free until the day you need to change something. Recovery from a bad record is not instant, because a record you published with an 86400-second TTL is held by caches you do not control and cannot flush for up to 24 hours after you fix it. There is no push, no invalidation and no "propagation" to wait for; there is only expiry. That is why a planned migration starts by lowering the TTL before the change rather than during it, and why one bad TTL decision is what turns a five-minute outage into a day-long one.

05 Cheat sheet

The answers that get asked, and the wrong ones that get given

Every row is something you can be asked to state in under ten seconds. The right-hand column is the specific wrong answer that gets written down, not a general caution.

What they askThe answerThe trap
Port and transport53, UDP by default, TCP on the same port when needed"DNS is UDP" — TCP is specified, not a workaround
What forces TCPa reply with the TC bit set, and every zone transferSaying "large replies" without naming the TC bit or AXFR.
Recursive vs iterativethe stub’s query is recursive, the resolver’s queries are iterative"DNS is iterative" — true of one leg only; name the leg
Who can answer www.examate.inonly the authoritative server for examate.inSaying the root, or the TLD. Neither has ever heard of the name.
What the root returnsa referral: Answer empty, NS in Authority, glue in AdditionalCalling it an error. A referral is a successful reply with RCODE 0.
Why glue existsthe NS name is inside the zone being delegatedForgetting that an NS record holds a name, so a delegation alone would be circular.
How many root servers13 named identities, a to m.root-servers.net, anycast to 1000+ machines"13 computers" — and the 13 comes from the 512-byte UDP limit
What a CNAME may point atanother name, and nothing elsea CNAME to an IP address — and never at the zone apex
MX preferencethe lower number is tried firstAssuming higher wins, and pointing an MX at a CNAME.
What a TTL controlshow long any cache may keep this record, in secondsThinking the server pushes updates. Nothing is pushed; records only expire.
Negative cachingNXDOMAIN is cached too, for the SOA minimum field (RFC 2308)Thinking only successes are cached, so a typo re-walks the tree every time.
Name and label limitslabel 63 bytes, whole encoded name 255 bytesQuoting characters rather than bytes, and forgetting the length byte per label.
Header, sections, and the secure ports12-byte header · Question, Answer, Authority, Additional · DoT 853, DoH 443"DNSSEC encrypts DNS" — it signs; DoT and DoH encrypt
Recursive is what you ask for, iterative is how it is doneOne lookup, two legs. Your machine sends one recursive query and receives one answer. The resolver sends several iterative queries and receives several referrals. Both words are correct about the same lookup, which is why the answer has to name the leg.
A referral is not a failureThe root and the TLD both replied successfully and both replied with nothing in the Answer section. Their job is to hold delegations, not addresses, and the walk down the tree is exactly the sequence of those refusals. Only the authoritative server sets AA.
Every record is a lease, not a factA record you receive comes with a TTL and every cache counts it down. That single number decides both how much traffic the tree carries and how long a mistake survives after you fix it, and you have to choose it before you know which of the two will matter.

06 Where & why

Four systems you can point at, and what each of them changes

None of this is a teaching abstraction. Each of these is a box in section 03's table, run by somebody real, and each one differs from the textbook in a way worth naming out loud.

Google Public DNS 8.8.8.8
The recursive resolver, rented

Setting your machine's resolver to 8.8.8.8, or 8.8.4.4, or 2001:4860:4860::8888, replaces one box in the chain and nothing else: it still does the same iterative walk from the root that your ISP's resolver would have done. What you gain is a very large shared cache, so most names are already warm. What you give up is locality. Content delivery networks answer with an address near the resolver, so a distant resolver can hand you a distant server, which is what EDNS Client Subnet exists to fix by passing a truncated version of your address along with the query.

dig, from BIND 9
It will print section 02 for you

dig www.examate.in A shows the answer and its TTL; run it twice and watch the TTL fall, which proves the second reply came from a cache. dig +trace turns off recursion and performs the iterative walk itself, printing the root's referral, then the TLD's, then the authoritative answer, in exactly the order of this lesson. dig +norecurse sets RD=0 on a single query, which is how you ask a resolver "do you already have this cached" without making it go and find out.

AWS Route 53
The authoritative side, and the apex problem

Named after the port. It runs the authoritative servers for a zone, so it is the last box in the chain rather than the resolver. It is also where the apex restriction from section 03 becomes a product decision: because a CNAME cannot sit at examate.in, Route 53 offers alias records, which look like a CNAME in the console but return real A records at query time. Health checks with DNS failover are the other common use, and they inherit the TTL problem exactly: a failover is only as fast as the TTL on the record being swapped.

Kubernetes CoreDNS
The same protocol, inside a cluster

Every pod's /etc/resolv.conf points at the cluster's DNS service, and a service name such as payments.default.svc.cluster.local resolves to its ClusterIP through an ordinary A record. The famous trap is the generated ndots:5 option: any name with fewer than five dots is tried against every search domain first, so a lookup of an external name like api.stripe.com costs three failed lookups against the cluster search domains before the real one, doubled again if the stub asks for A and AAAA. It is a pure DNS problem, it shows up as latency in the application, and the fix is a fully qualified name with the trailing dot.

DNS is the dependency every other protocol has and nobody lists. That is what makes it worth understanding in both directions: as a lookup, it is a tree walk that caching turns into a single memory read, and as a failure, it is the one outage that presents as everything being broken at once. The number that decides which of those you get on any given day is the TTL, and you have to pick it long before you find out.

07 Interview questions

What they ask, and what they follow up with

"What happens when you type a URL into a browser" is the most asked open-ended question in this syllabus, and the DNS part is where most answers go vague. Say the roles out loud in order, and say which query is recursive and which are iterative; an answer with no referrals in it reads as memorised.

Walk me through what happens between typing a name and the first packet leaving your machine.
Five participants, in order. Your program calls getaddrinfo(), which enters the stub resolver in the operating system; it checks a small cache and, on a miss, sends one query to the recursive resolver configured by DHCP. That resolver checks its own cache and, on a miss, queries a root server, which refers it to the TLD server for the last label, which refers it to the authoritative server for the domain, which answers from the zone file with AA set. The answer comes back to the stub and is cached at every level for its TTL. Only then does the real connection start, so the DNS lookup is latency you pay before the first byte of the actual protocol moves.
Is DNS recursive or iterative?
Both, on different legs of the same lookup, and the answer has to name the leg. The stub’s query is recursive: it sets RD=1 and is asking the resolver to go and get the finished answer, so a stub never sees a referral in its life. The resolver’s queries are iterative: RD=0, take an answer or a pointer, whichever you have, and the resolver does the walking itself. So the recursion happens at the resolver and the iteration happens beneath it. Saying flatly that DNS is one or the other is the single most common way this question is failed.
Why does the root server not just answer the query? Is a referral an error?
A referral is not an error, it is a successful reply with RCODE 0. The root zone physically contains delegations and nothing else, on the order of 1,500 top level domains with a few NS records each, so there is no entry in it for a hostname and there never will be. Storing one would mean storing every name on the internet in one zone, which is the design that HOSTS.TXT died of. The reply has an empty Answer section, AA clear, NS records in the Authority section and their addresses in Additional. The same argument repeats at the TLD, which knows which nameservers were delegated a domain and nothing about what is inside it.
An NS record holds a name, not an address. So how does the resolver ever reach that server?
Through glue. If the parent zone only handed back examate.in. NS ns1.examate.in. the resolver would be stuck: to reach the server for examate.in it would first have to resolve a name that is itself inside examate.in. So the parent publishes the nameserver’s A or AAAA record alongside the delegation, in the Additional section, and the circularity is broken. Glue is only required when the nameserver’s name lies inside the zone being delegated; if the servers were named under some other domain, an ordinary lookup would reach them.
Why are there exactly thirteen root servers?
Because thirteen name-and-address pairs were the most that would fit inside the original 512-byte UDP DNS reply from RFC 1035. So the number is an artefact of a packet size, not a capacity decision. The honest follow-up is that they are 13 identities, a through m.root-servers.net, not 13 machines. Each address is announced from many sites at once using anycast, where the same IP is advertised into BGP from hundreds of locations and routing delivers your packet to the nearest one, so the real count is well over a thousand servers on every continent.
Why does DNS use UDP, and what forces it onto TCP?
A query and its reply are one small datagram each: the query in the worked example is 32 bytes, a 12-byte header plus a 20-byte question section. Opening a TCP connection to carry 32 bytes costs a full round trip before the question is even asked, plus connection state on a server handling millions of these. If a UDP query is lost the resolver repeats it, which is cheaper than any handshake. It moves to TCP on the same port 53 in two cases: the reply does not fit, so the server sends what it can with the TC bit set and the client repeats the question over TCP; and zone transfers, AXFR and IXFR, which need reliability and ordering. EDNS(0) raised the practical UDP limit, commonly to 1232 bytes.
What does a TTL actually control, and who counts it down?
It is a per-record lifetime in seconds, set by the zone owner, saying how long anybody who receives the record may keep it. Every cache holding it counts down, and hands on what is left rather than what was published, which is why running the same lookup twice shows a falling number and is the simplest way to prove a reply came from a cache. The important consequence is that nothing is ever pushed. There is no invalidation and no message that says forget the old value; a record only stops being served when it expires. So a change is not slow because of propagation, it is slow because caches you do not control are still inside a window you chose earlier.
What is the difference between NXDOMAIN and SERVFAIL?
NXDOMAIN, RCODE 3, means the name definitively does not exist, and only a server authoritative for that zone is in a position to say so; the reply carries the zone SOA in the Authority section rather than a delegation. SERVFAIL, RCODE 2, means the resolver could not find out: the authoritative servers were unreachable, or timed out, or a validation check failed. They point at completely different problems. NXDOMAIN is usually a typo or a record nobody created; SERVFAIL is usually the zone’s nameservers being broken or unreachable, and it is the one that means the domain owner has an outage.
What is inside an MX record, and which mail server is tried first?
Two fields: a 16-bit preference and the name of a mail exchanger. The lower preference wins, so MX 10 mail1 is tried before MX 20 mail2, which is the part people invert. What an MX does not hold is an address, so the sending server has to resolve that name to an A or AAAA record afterwards, and the authoritative server usually saves it the trip by putting those records in the Additional section when they are in the same zone. Two rules go with it: an MX target must not be a CNAME, and it must not be an address literal.
What does a reverse lookup actually query, and can I trust the result?
A reverse lookup is an ordinary DNS query for a PTR record under a special name. The address is written with its octets reversed and placed under in-addr.arpa, so 203.0.113.25 is queried as 25.113.0.203.in-addr.arpa., and IPv6 uses ip6.arpa with one nibble per label. The zone is delegated by whoever holds the address block, which is normally your provider rather than you, so you often cannot create the record yourself. And a PTR is not generated automatically and is not required to agree with the A record it points back at, which is why forward-confirmed reverse DNS, checking both directions, is what mail servers actually test.
Is DNS secure? What do DNSSEC, DoT and DoH each give you?
Plain DNS on port 53 is neither encrypted nor authenticated, so it is readable by anyone on the path and forgeable by anyone who can answer first. The two problems have two different fixes and they are commonly confused. DNSSEC signs records with a chain of trust from the root, so you can detect a forged answer; it does not hide anything, and every query and reply stays in the clear. DoT on TCP 853 and DoH on TCP 443 encrypt the traffic between you and your resolver, so a bystander cannot read which names you asked for; they say nothing about whether the data was genuine. Saying DNSSEC encrypts DNS is the error to avoid.
People call DNS a single point of failure. What actually breaks, and what do you do about it?
Every protocol in this course begins with a name lookup, so when resolution fails the symptom is not one broken service, it is everything appearing broken at once. It is also strangely delayed: while records are still cached the outage is invisible, and it becomes total only as the TTLs run out, which makes it hard to correlate with the event that caused it. The October 2016 DDoS against Dyn’s authoritative infrastructure took a long list of perfectly healthy sites offline for exactly this reason. The defence is the ordinary one for a single point of failure: publish the zone on two independent authoritative providers under separate NS records, so losing one is survivable.

08 Practice problems

Six to work on paper

Draw the chain of participants before you answer any of these, and mark on it which link is recursive and which are iterative. Three of the six turn on a TTL rather than on a query, and two of them cannot be answered without adding up bytes.

Read the name right to left

Easy
Take the name mail.cse.examate.ac.in. Name the root, the top level domain, and every label below it in order. Given that ac.in is itself delegated to an education registry, say which label an organisation actually registered and which zone is authoritative for the full name. Then give the length, in bytes, of that name as it is encoded in the Question section of a query.
Follow-up
The piece an organisation registers is not always the second label from the right, so the delegation boundary is one level lower here than the usual rule would put it. The encoded length is also not the number of characters you can count on the screen.
Show the hint
Put a length byte in front of every label and one more byte on the end for the root, then ask which server would have to be asked before any of the labels to its left mean anything.

Three lookups in a row

Easy
A recursive resolver starts with a completely empty cache and is asked, in this order, for www.examate.in A, then blog.examate.in A, then www.example.net A. For each of the three, state how many queries the resolver itself sends and to which servers. Then explain in one sentence why the second lookup is far cheaper than the first, and why the third is not.
Follow-up
The second lookup is a cache miss on the name and still costs a fraction of the first, so the saving cannot be coming from the answer. The third one is as expensive as the first even though the resolver has been running and caching the whole time.
Show the hint
Ask what the resolver wrote down at every hop of the first lookup, not only at the last one, and then ask which of those notes is any use to a name ending in a different label.

The TTL you chose six months ago

Medium
An A record is published with a TTL of 86400. Resolver X read it at 08:55, resolver Y read it at 02:00 the same morning, and resolver Z has never been asked for the name. At 09:00 you change the address on the authoritative server. For each of the three, give the earliest and the latest moment it can begin serving the new address, then give the worst case across every cache on the internet. Finally, state the minimum time before the change at which you would have had to lower the TTL to 300 for the worst case to genuinely be 300 seconds, and say why that number is not 300 seconds.
Follow-up
One of the three is already correct before you touch anything, and the countdown inside each cache started when that cache fetched the record, not when you edited it. The answer to the last part is a whole day rather than five minutes, and working out why is the point of the question.
Show the hint
A cache begins its countdown when it received the record, not when you edited it, so ask how old the oldest copy still legitimately in circulation could be at the instant you publish the shorter TTL.

A chain of two aliases

Medium
www.examate.in is a CNAME to lb.examate.in, which is itself a CNAME to edge.example.net, which has an A record with a TTL of 60. A completely cold resolver is asked for www.examate.in A. List every query the resolver sends, in order, naming the server asked and the name asked about, and total them. Then say which of the three names the 60-second TTL belongs to, and what has to happen 61 seconds later.
Follow-up
Two of the three names live in one zone and one does not, and only one of the two redirections costs a fresh walk from the root. The shortest TTL in a chain is also not the lifetime of the chain: when it runs out, only one of the three records has to be fetched again, and not from the root.
Show the hint
For each hop ask whether the resolver already knows a server that is authoritative for the target’s zone; if it does, the redirection costs one query rather than a walk.

The typo that would not go away

Medium
A script runs every 10 seconds and looks up a hostname the student mistyped, so it does not exist. The zone’s SOA line ends with a minimum of 900. The first mistyped lookup happens at t = 0. Over the first hour, how many times does the query reach the authoritative server, and how many of the roughly 360 script runs are answered without a packet leaving the resolver? Then say whether creating the missing record at t = 30 s makes the script start working immediately, and give the moment it does start working.
Follow-up
The failure is stored exactly the way a success is, so fixing the zone does not fix the script. The number that decides how long the student waits is not on the record they have just created, and it is not on the record that was missing either.
Show the hint
Work out how often the resolver is willing to ask the question again, then count how many of the runs fall inside each of those windows.

Design the zone, then fit it in a datagram

Hard
An organisation needs six things: the bare domain examate.in to serve a site that lives behind edge.cdnprovider.net; www to reach the same place; mail delivered to two servers with one preferred; a text proof of domain ownership for a third-party service; a reverse lookup for 203.0.113.25; and the zone itself to be answerable. Give the record type for each, name the one requirement that cannot be met with a standard record type and say what real providers do instead, and name the one record that must be created in a zone the organisation does not control. Then, given a 512-byte UDP payload with no EDNS(0), a 12-byte header, a question section of 16 bytes for examate.in. A, and 16 bytes per compressed A record in the Answer section, work out how many A records fit.
Follow-up
One requirement collides with a rule about what may coexist at a single name, and the collision only happens because of which name it is. One record is not yours to create at all. The byte count is also not 512 divided by 16, because two sections are already spent before the first answer is written.
Show the hint
Ask what else is obliged to exist at the apex of any zone, and then ask what a record in an Answer section actually repeats of the name it belongs to.