DNS

Why it exists

People use names such as www.example.com; IP routers need addresses such as 93.184.216.34. The Domain Name System (DNS) translates between them. It cannot be one file on one machine: billions of names, changes every minute and the need for the service never to stop. DNS is therefore a distributed database run by a hierarchy of name servers, queried by a simple protocol over UDP. It is an application layer protocol whose messages are carried by UDP (UDP and ports).

Prerequisites

You need UDP and port numbers (UDP and ports).

Precise definitions

Names. A domain name is a sequence of labels separated by dots, read from the most specific (left) to the root: www.example.com. A label has at most $63$ bytes, a whole name at most $255$ bytes (quoted). The names form a tree: the root (written as an empty label), then top-level domains (com, org, edu, in, ...), then second-level domains (example.com) and so on.

Zones and name servers. The tree is cut into zones; each zone is managed by an organisation which runs authoritative name servers that hold the records of the zone and the delegation (NS records) of its subzones. Kinds of servers:

• root servers: know the servers of every top-level domain;
• TLD servers (.com, .org, country codes): know the authoritative servers of each registered domain below them;
• authoritative servers of an organisation: have the records for its own hosts;
• the local (recursive) DNS server of an ISP, university or company: the server to which hosts send their queries; it does the searching and caches the results. It is not part of the hierarchy.

Resource records. A record is $(\text{name}, \text{type}, \text{class}, \text{TTL}, \text{data})$ (class is almost always IN, the Internet). Types:

The TTL (time to live) is the number of seconds for which a cache may keep the record.

Messages. Query and response have the same format: a $12$-byte header (identification, flags, counts of questions, answers, authority records and additional records), then the question section, the answer section, the authority section and the additional section. A query goes in a UDP datagram to port $53$ of the server; the response comes back to the sender's port (TCP port $53$ is used for large answers and zone transfers, quoted).

How it works

The message, byte for byte

The query for the address of www.example.com takes $33$ bytes: the header ($12$), the name as length-prefixed labels (3www7example3com0, $17$ bytes) and type and class ($4$). The identification is chosen by the client and is repeated in the reply so that the client can match it. The flags $0100$ say: it is a query ($QR = 0$), recursion is desired ($RD = 1$). The response repeats the question and appends the answer; its name field is the two-byte pointer C0 0C (name compression): the two top bits $11$ mean "pointer" and the remaining $14$ bits give the offset ($12$) of the name already present in the message. The flags $8580$: it is a response, the server is authoritative ($AA = 1$), recursion was desired and is available ($RA = 1$). A real dig program decoded these exact messages (see the notes).

Resolution

A host asks its local DNS server (a recursive query: "get me the answer"). The local server, if it does not have the answer in its cache, asks the hierarchy with iterative queries: each server either gives the answer or a referral ("I do not know, ask this server"):

The sequence for a cold cache: host $\to$ local server; local $\to$ root (referral to the .com servers); local $\to$ .com server (referral to the authoritative server of example.com); local $\to$ authoritative server (the answer); local $\to$ host. Eight messages in all: two for the host's exchange with the local server and two for each of the three servers contacted; in general $2 + 2k$ messages if the local server contacts $k$ servers of the hierarchy. In the fully recursive variant each server queries the next one itself on behalf of the previous one, and the number of messages is the same; the difference is who does the work and where the answer is cached.

Caching

The local server stores answers (for their TTL) and also the referrals (the names of the .com and example.com servers, with a long TTL). This avoids most of the hierarchy:

The first query for www.example.com costs $8$ messages and $130$ ms (with the assumed round-trip times). The same name again is answered from the cache: $2$ messages, $10$ ms. A different host in the same domain (mail.example.com) needs only the authoritative server ($4$ messages); a different domain under .com skips the root ($6$ messages); after $300$ s the answer has expired but the referral to the authoritative server has not, so $4$ messages. Caching is why the root servers are not overwhelmed. The price is that a changed record is seen by others only after the old TTL runs out.

Worked examples

Cheat box

Traps and GATE patterns

Connections

DNS rides on UDP datagrams (UDP and ports), which an application sends with sendto (socket API); a browser resolves the name of a site before it opens the TCP connection of an HTTP request (HTTP). The hierarchy of servers with delegation resembles a tree search (trees).

PYQs

Which one of the following protocols is NOT used
to resolve one form of address to another one?

A user starts browsing a webpage hosted at a
remote server. The browser opens a single
connection to fetch the entire webpage from the
server. The webpage consists of a top-level index
page with multiple embedded image objects.
Assume that all caches (e.g., DNS cache, browser
cache) are all initially empty. The following packets
leave the user's computer in some order.

(i) HTTP GET request for the index page.
(ii) DNS request to resolve the web server's name to
its IP address.
(iii) HTTP GET request for an image object.
(iv) TCP SYN to open a connection to the web
server.

Which one of the following is the CORRECT
chronological order (earliest in time to latest) of the
packets leaving the computer?

Suppose in a web browser, you click on the www .
gate-2023 . in URL. The browser cache is empty.
The IP address for this URL is not cached in your
local host, so a DNS lookup is triggered (by the local
DNS server deployed on your local host) over the 3-
tier DNS hierarchy in an iterative mode. No resource
records are cached anywhere across all DNS servers.
Let RTT denote the round trip time between your
local host and DNS servers in the DNS hierarchy.
The round trip time between the local host and the
web server hosting www.gate-2023.in is also equal
to RTT. The HTML file associated with the URL is
small enough to have negligible transmission time
and negligible rendering time by your web browser,
which references 10 equally small objects on the
same web server.
Which of the following statements is/are CORRECT
about the minimum elapsed time between clicking
on the URL and your browser fully rendering it?

Consider the resolution of the domain name
www.gate.org.in by a DNS resolver. Assume that
no resource records are cached anywhere across the
DNS servers and that iterative query mechanism is
used in the resolution. The number of DNS query-
response pairs involved in completely resolving the
domain name is ___________.

Identify the correct sequence in which the
following packets are transmitted on the network
by a host when a browser requests a webpage from
a remote server, assuming that the host has just been
restarted.

Which one of the following uses UDP as the transport
protocol?

Self-check

Revision card

References