Author: ytianle

DNS⚓︎

The largest read-only mainly distributed query system in the internet.

Overview⚓︎

From the transport layer, we have TCP/UDP protocols to construct reliable/unreliable connections between two machines with IP addresses. However, to create a new connection with a remote process, we need to know the IP address of that machine¹. Remembering IP addresses for every website or service we want to access is impractical for humans. (Unless you want to use 172.217.16.206 to access Google every time. 😅)

DNS (Domain Name System) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It translates human-readable domain names (like www.example.com) into IP addresses (like 192.0.2.1).

DNS Abstract⚓︎

DNS Hierarchy⚓︎

The DNS system is organized in a hierarchical structure, with different levels of authority. The hierarchy consists of several components:

Root Level: The topmost level of the DNS hierarchy, represented by a dot (.). It contains information about the top-level domains (TLDs).
Top-Level Domains (TLDs): The next level in the hierarchy, which includes generic TLDs (gTLDs) like .com, .org, and .net, as well as country-code TLDs (ccTLDs) like .uk, .jp, and .de.
Second-Level Domains: These are the domain names registered under TLDs, such as example in example.com.
Subdomains: These are additional divisions of a domain, such as www in www.example.com.

DNS Implementation⚓︎

DNS Server Hierarchy⚓︎

The DNS system is implemented as an application layer service, which runs on servers that sit at the network's edge ². Those servers are also organized in a hierarchical manner, similar to the DNS hierarchy itself:

Query Types of Servers⚓︎

There are two main types of queries between servers:

Iterative Query: iteratively queries each DNS server in the hierarchy until it finds the authoritative server for the requested domain.
Recursive Query: recursively queries DNS servers on behalf of the client until it finds the authoritative server for the requested domain.

DNS Resolution⚓︎

In most of real-world applications, both types of queries are used in the DNS resolution process: the client sends a recursive query to the local DNS resolver. Then the DNS resolver performs iterative queries to find the authoritative DNS server for the requested domain:

DNS Resolvers

As you can see from above, when you type a URL into your web browser, your computer always sends a request to a DNS resolver to find the corresponding IP address. The DNS resolver is responsible for querying various DNS servers in a hierarchical manner until it finds the correct IP address and returns it to your computer. Popular public DNS resolvers include:

Cloudflare DNS
Google Public DNS
Amazon Route 53

Caching & TTL

To improve performance and reduce the load on DNS servers, DNS resolvers often cache the results of previous queries on the local machine. Each DNS record has a Time to Live (TTL) value that specifies how long the record should be cached before it is considered stale and needs to be refreshed.

DNS Record types⚓︎

Below images show some common DNS record types and their functions:

DNS in Cybersecurity⚓︎

DNS is security-critical because it determines where trust is established before any application-level protocol is involved.

DNS Attack Vectors (Weaknesses)⚓︎

DNS spoofing / cache poisoning: forged responses redirect users to malicious sites
DNS-based DDoS: reflection and amplification attacks abuse open resolvers
DNS tunneling: covert data exfiltration or command-and-control via DNS queries
Misconfiguration: incorrect records or delegation can take services offline
Trust dependency: compromised DNS can silently redirect users to fake destinations
Eventual consistency: caching and TTL delay changes and incident recovery
Limited observability: DNS failures are often hard to detect and diagnose

DNS Security Controls (Mitigations)⚓︎

DNSSEC: cryptographic validation of DNS responses to prevent spoofing
Rate limiting & Anycast: mitigate DNS-based DDoS attacks
DNS firewalling: block malicious or suspicious domains at the resolver level
Traffic analysis: detect tunneling via query patterns, entropy, and frequency
Operational controls: configuration validation, monitoring, and change management