1. Domain Name System: DNS
Chapter 17
Domain Name System: DNS
Objectives
Upon completion you will be able to:
Understand how the DNS is organized
Know the domains in the DNS
Know how a name or address is resolved
Be familiar with the query and response formats
Understand the need for DDNS
TCP/IP Protocol Suite

2. A domain is a subtree of the domain name space.
Figure Domains
A domain is a subtree of the domain name space.
The name of the domain is the domain name of the
node at the top of the subtree.
TCP/IP Protocol Suite

3. Figure 17.5 Hierarchy of name servers
It is not possible to keep all domain names in one computer,
so they are distributed over many servers.
TCP/IP Protocol Suite

4. Figure 17.6 Zones and domains
What a server is responsible for or has control over is called
a zone. A zone is a contiguous part of the entire tree. The
table the zone stores is called the zone file.
A zone and a domain can be the same, or not.
TCP/IP Protocol Suite

5. The root server is for the entire tree and does not contain any data.
Servers
Root Server
The root server is for the entire tree and does not contain
any data.
Primary Server
Stores a file about the zone for which it is an authority.
It also creates, maintains, and updates the zone file.
Secondary Server
Transfers the complete information about a zone from
another server (primary or secondary). Does not create,
maintain, or update the zone file.
Thus, secondary server is a redundant copy of another
server (more than likely a primary).
When the secondary downloads info from the primary,
it is called a zone transfer.
TCP/IP Protocol Suite

6. Along with the servers, you need a resolver.
The DNS resolver - a DNS client program which runs on a
user’s computer and generates DNS request on behalf of
software programs
This request goes from the resolver to the lowest level
DNS server
TCP/IP Protocol Suite

7. Figure 17.7 DNS used in the Internet
Inverse: used to map an address to a name (in a couple slides)
TCP/IP Protocol Suite

8. Figure 17.8 Generic domains
TCP/IP Protocol Suite

9. Table 17.1 Generic domain labels
TCP/IP Protocol Suite

10. Table 17.1 Generic domain labels (Continued)
TCP/IP Protocol Suite

11. For example, suppose you have an IP address in
Figure Inverse domain
This is used to map an
address to a name. Also
called reverse names.
For example, suppose you
have an IP address in
dotted form. What is its
domain name?
There are separate servers
to handle these (and they
are also hierarchical).
Take IP address (such as
), put it in
form shown to left, then
give to reverse name
server and it will return
the domain name.
TCP/IP Protocol Suite

12. For example, when a user runs an FTP client to contact
Figure Inverse domain
For example, when a user runs an FTP client to contact
a server, the server can obtain the client's IP address
from the incoming TCP connection and then perform
an inverse lookup to map the address into a name.
Some servers do so to restrict access (i.e. the server
compares the client's name to a list of computers
allowed/denied to access the service).
TCP/IP Protocol Suite

13. Figure 17.9 Country domains
TCP/IP Protocol Suite

14. RESOLUTION
Mapping a name to an address or an address to a name is called name-address resolution.
The topics discussed in this section include:
Resolver
Mapping Names to Addresses
Mapping Addresses to Names
Recursive Resolution
Iterative Resolution
Caching
TCP/IP Protocol Suite

15. Users do not interface directly with a DNS resolver
Resolution
In the real world:
Users do not interface directly with a DNS resolver
Instead, web browsers and clients send a request to the
DNS resolver built into the client operating system
The DNS resolver almost always has a cache. If the cache
can provide the answer, problem solved.
If the cache does not have the answer, the request is sent
to a DNS server.
If that DNS server does not have the answer, the request
may be passed on to another level.
TCP/IP Protocol Suite

16. You are at DePaul and you ask for the web page from cs.it.ucla.edu.
Resolution
For example:
You are at DePaul and you ask for the web page from
cs.it.ucla.edu.
Resolver checks its cache. No entry for cs.it.ucla.edu.
Resolver sends query to local DNS server (ISP?)
Local DNS server has no entry.
TCP/IP Protocol Suite

17. Query is sent to .edu server.
Resolution
Query is sent to .edu server.
.edu server recognizes ucla.edu, but not cs.it.ucla.edu.
So .edu server sends query to ucla.edu.
ucla.edu server says it recognizes cs.it.ucla.edu and
here is the IP address: xx.yy.zz.ww
IP address is recursively sent to .edu server’s cache and
all other caches on the way back to DePaul.
TCP/IP Protocol Suite

18. Figure 17.11 Recursive resolution
TCP/IP Protocol Suite

19. Figure 17.12 Iterative resolution
TCP/IP Protocol Suite

20. DNS MESSAGES
The DNS query message consists of a header and question records; the DNS response message consists of a header, question records, answer records, authoritative records, and additional records.
TCP/IP Protocol Suite

21. Figure 17.14 Query and response messages
Question section contains one or more question records.
Answer/Authoritative/Additional sections contain one or more
resource records. See slide 25 and on for descriptions of these.
TCP/IP Protocol Suite

22. Identification - a 16-bit field used by the client to match the
Figure Header format
Identification - a 16-bit field used by the client to match the
response to the query.
Flags - next slide
Number of question records: number of queries in the question
section of the message
TCP/IP Protocol Suite

23. QR: if 0, then query; if 1, then response
Figure Flags field
QR: if 0, then query; if 1, then response
OpCode: if 0, then standard; 1 = inverse; 2 = server status request
AA: answer from authoritative server
TC: response was more than 512 bytes, so it was truncated
RD: client desires a recursive answer
RA: recursion is available (set in response message)
rCode: shows the status of the error in the response (see next slide)
TCP/IP Protocol Suite

24. Table Values of rCode
TCP/IP Protocol Suite

25. 17.7 TYPES OF RECORDS Two types of records are used in DNS.
The question records are used in the question section of the query and response messages.
The resource records are used in the answer, authoritative, and additional information sections of the response message.
TCP/IP Protocol Suite

26. Figure 17.17 Question record format
Query name - this is a variable length field containing
a domain name. The domain name has the format as
shown on the next slide.
TCP/IP Protocol Suite

27. Figure 17.18 Query name format
TCP/IP Protocol Suite

28. Table 17.3 Types This is the second field - the query type
TCP/IP Protocol Suite

29. This is the third field - the query class. This describes
The specific protocol using DNS. Class 1 most common.
Table Classes
TCP/IP Protocol Suite

30. Figure 17.19 Resource record format
Domain name - same as in question record, but since DNS requires
the use of compression everywhere a name is repeated, this field
is a pointer offset to the corresponding domain name field in the
question record. Compression discussed next.
Time to live - how long this answer is valid
TCP/IP Protocol Suite

31. Figure 17.19 Resource record format
Resource data - answer to the query, or the domain name of the
authoritative server, or additional information. Can be:
an IPv4 address
an IPv6 address
a domain name
an offset pointer
a character string
TCP/IP Protocol Suite

32. COMPRESSION
DNS requires that a domain name be replaced by an offset pointer if it is repeated. DNS defines a 2-byte offset pointer that points to a previous occurrence of the domain name or part of it.
For example, in a resource record the domain name is usually a
repetition of the domain name in the question record.
Recall:
TCP/IP Protocol Suite

33. Figure 17.20 Format of an offset pointer
So if this pointer is referring to byte 12 (starting with byte 0, so this
would be the 13th byte): offset pointer =
TCP/IP Protocol Suite

34. Example 1
A resolver sends a query message to a local server to find the IP address for the host “chal.fhda.edu.”. We discuss the query and response messages separately.
Figure shows the query message sent by the resolver. The first 2 bytes show the identifier (1333). It is used as a sequence number and relates a response to a query. Because a resolver may even send many queries to the same server, the identifier helps to sort responses that arrive out of order. The next bytes contain the flags with the value of 0x0100 in hexadecimal. In binary it is , but it is more meaningful to divide it into the fields as shown below:
QR OpCode AA TC RD RA Reserved rCode
TCP/IP Protocol Suite

35. Figure 17.21 Example 1: Query message
Identifier
Flags
# question
records
# answer
records
# auth.
records
# add.
records
Query
name
Question
record
Query
type
Query
class
TCP/IP Protocol Suite

36. Example 1 (Continued)
The QR bit defines the message as a query. The OpCode is 0000, which defines a standard query. The recursion desired (RD) bit is set. (Refer back to Figure for the flags field descriptions.) The message contains only one question record. The domain name is 4chal4fhda3edu0. The next 2 bytes define the query type as an IP address; the last 2 bytes define the class as the Internet.
Figure shows the response of the server. The response is similar to the query except that the flags are different and the number of answer records is one. The flags value is 0x8180 in hexadecimal. In binary it is , but again we divide it into fields as shown below:
QR OpCode AA TC RD RA Reserved rCode
TCP/IP Protocol Suite

37. Example 1 (Continued)
The QR bit defines the message as a response. The OpCode is 0000, which defines a standard response. The recursion available (RA) and RD bits are set. The message contains one question record and one answer record. The question record is repeated from the query message. The answer record has a value of 0xC00C (split in two lines), which points to the question record instead of repeating the domain name. The next field defines the domain type (address). The field after that defines the class (Internet). The field with the value 12,000 is the TTL (12,000 s). The next field is the length of the resource data, which is 4, since the resource data itself is an IP address ( ).
TCP/IP Protocol Suite

38. Figure 17.22 Example 1: Response message
TCP/IP Protocol Suite

39. Example 2
An FTP server has received a packet from an FTP client with IP address The FTP server wants to verify that the FTP client is an authorized client. The FTP server can consult a file containing the list of authorized clients. However, the file consists only of domain names. The FTP server has only the IP address of the requesting client, which was the source IP address in the received IP datagram. The FTP server asks the resolver (DNS client) to send an inverse query to a DNS server to ask for the name of the FTP client. We discuss the query and response messages separately.
TCP/IP Protocol Suite

40. Example 2 (Continued)
Figure shows the query message sent from the resolver to the server. The first 2 bytes show the identifier (0x1200). The flags value is 0x0900 in hexadecimal. In binary it is , and we divide it into fields as shown below:
QR OpCode AA TC RD RA Reserved rCode
The OpCode is 0001, which defines an inverse query. The message contains only one question record. The domain name is in-addr4arpa. The next 2 bytes define the query type as PTR, and the last 2 bytes define the class as the Internet.
TCP/IP Protocol Suite

41. Figure 17.23 Example 2: Inverse query message
TCP/IP Protocol Suite

42. Example 2 (Continued)
Figure shows the response. The flags value is 0x8D80 in hexadecimal. In binary it is , and we divide it into fields as shown below:
QR OpCode AA TC RD RA Reserved rCode
TCP/IP Protocol Suite

43. Figure 17.24 Example 2: Inverse response message
TCP/IP Protocol Suite

44. $ nslookup fhda.edu Name: fhda.edu Address: 153.18.8.1
Example 3
In UNIX and Windows, the nslookup utility can be used to retrieve address/name mapping. The following shows how we can retrieve an address when the domain name is given.
$ nslookup fhda.edu Name: fhda.edu Address:
The nslookup utility can also be used to retrieve the domain name when the address is given as shown below:
$ nslookup in-addr.arpa name = tiptoe.fhda.edu.
TCP/IP Protocol Suite

45. DDNS
The Dynamic Domain Name System (DDNS) updates the DNS master file dynamically.
For example, say TTL is set to 6 hours, then you change your URL/IP address combo.
TCP/IP Protocol Suite

46. ENCAPSULATION
DNS uses UDP as the transport protocol when the size of the response message is less than 512 bytes. If the size of the response message is more than 512 bytes, a TCP connection is used.
Port 53 is used in both cases.
TCP/IP Protocol Suite