Presentation on Domain Name System

Presentation on Domain Name System

• 1.
  DOMAIN NAME SYSTEM Preparedby: Chinmay Joshi ID: 12IT112
• 2.
  DOMAIN NAME SYSTEM •What is DNS? • Internet Directory Service • A client-server application that maps host names into their corresponding IP addresses • Mapping host names into their corresponding IP addresses is called name resolution or name translation or name mapping or Address Resolution • Why we need to use names instead of IP numbers? • IP addresses are difficult to remember • IP addresses can change • Problem: Network only understands numeric addresses • Solution: • Use alphanumeric names to refer to hosts • Add a distributed, hierarchical protocol (called DNS) to map between alphanumeric host names and IP addresses
• 3.
  HISTORY • Using aname as a more human-legible abstraction of a machine's numerical address on the network predates even TCP/IP • All the way to the ARPAnet era • Back then however, a different system was used, as DNS was only invented in 1983, shortly after TCP/IP was deployed. • With the older system, each computer on the network retrieved a file called HOSTS.TXT from a computer at SRI (now SRI International). • The HOSTS.TXT file mapped numerical addresses to names. • A hosts file still exists on most modern operating systems, either by default or through configuration • Allows users to specify an IP address (eg. 192.0.34.166) to use for a hostname (eg. www.example.net) without checking DNS. • Nowadays, the hosts file serves primarily for troubleshooting DNS errors or for mapping local addresses to more organic names • Systems based on a hosts file have inherent limitations • The obvious requirement that every time a given computer's address changed, every computer that seeks to communicate with it would need an update to its hosts file On Windows: C:WINDOWSsystem32driversetc>
• 4.
  NAME SPACE • IPaddresses are unique Host names must be unique • How to manage this large number of names? • Where ? • Centralized?  inefficient & unreliable why? • Heavy traffic because of requests from all over the world • Failure makes data not available • Hard to maintain • Thus, DNS record database is distributed.
• 5.
  NAME SPACE • Solution: •Each name is made of several parts (hierarchical) • Each part is called a label • Names are defined on tree structure with the root at the top • This is called hierarchical name space • Each node has a label • DNS requires that children of a node (nodes that branch from the same node) have different labels to guarantee uniqueness • This will allow the control of names assignment to be decentralized • A central authority IANA assigns the part of the name that defines the nature of the organization (com, net, org, IN, …) and its name (IEEE, Intel, Microsoft, Google…)
• 6.
  THE DNS NAMESPACE • The Internet is divided into more than 200 top-level domains • Domain: It is sub tree of the domain name space and consists of group of hosts that are under the administrative control of a single entity such as a company or a government agency. • Each domain is subdivided into subdomains • The leaves represent domains that have no subdomains • A leaf domain may contain a single host, or represent a company with thousands of hosts in Top level domains A portion of the Internet domain name space.
• 7.
  DOMAIN  Domain isa sub tree of domain name space  Root node is empty  Domain is divided into sub-domains  Domain name is the domain name of the node at the top of the sub tree Sub- Sub- Sub-
• 8.
  HIERARCHY OF NAMESERVERS • Where the information contained in the domain name space is stored? • DNS is a distributed database system • • • Uses a large number of computers called name servers Organized in a hierarchical way and distributed all over the world No single host has all the exact mappings for all the hosts in the Internet Knows about all names below it Knows about all names below it
• 9.
  DNS QUERY • DNSworks on well known port 53 to serve requests and uses UDP protocol or TCP protocol • DNS Message • Each message has the same generic format with 5 sections. Section Meaning/Use Section 1 Message Header Section 2 The DNS question being asked Section 3 The Resource Record(s) which answer the question Section 4 The Resource Record(s) which point to the domain authority Section 5 The Resource Record(s) which may hold additional information
• 10.
  DNS RECORD TYPES: •DNS Internal types • Authority: NS, SOA, • List names of Name Servers and Start Of Authority/zone. • DNSSEC: DS, DNSKEY, RRSIG, NSEC • Used for DNSSEC • Meta types: OPT, TSIG, TKEY, SIG(0) • Meta Types: Not stored in DNS zones, transfer information between DNS nodes • Indirect: CNAME, DNAME • Indirect types, cause Resolver to change direction of search • Server must have special processing code • Terminal RR: • Address records: A, AAAA, • Informational: TXT, HINFO, KEY, SSHFP … • carry information to applications • Non Terminal RR: MX, SRV, PTR, KX, A6, NAPTR, AFSDB • contain domain names that may lead to further queries.
• 11.
  DNS RECORD TYPES: The“A” Record • The “Address” record • One or more normally defines a host • Contains an IPv4 Address (the address computers use to uniquely identify each other on the internet) • Eg. The record: www In A 127.0.0.1 the example.com domain, defines the host uniquely “www.example.com” to be reachable at the IPv4 Address 127.0.0.1 identifiable as The “CNAME” Record • A CNAME defines an alias • The alias will then be resolved, if another CNAME is encountered then the process continues until an A record is found • Eg. The record: mail CNAME ghs.google.com. In the charusat.ac.in domain, defines the name uniquely “mail.charusat.ac.in” to be and alias to “ghs.google.com” identifiable as
• 12.
  DNS RECORD TYPES: The“MX” Record • An MX record defines the mail servers for a particular domain • Mail exchange records hold the name of hosts, and their priorities, able to deliver mail for the domain. • Eg. The record: mail.example.com MX 10 mail In the example.com, defines the host mail to be the priority 10 mail server for the “example.com” domain The “NS” Record • An NS record defines the authoritative Name servers for the domain. • The “Name Server” records also define the name servers of children domains • Eg. The record: internal NS ns1.example.com In the google.com, defines the host “ns1.example.com” to be a name sever for the “internal.example.com” sub-domain
• 13.
  LEGAL USERS OFDOMAINS • Registrant • Depending on the various naming convention of the registries, legal users become commonly known as "registrants" or as "domain holders" • ICANN holds a complete list of domain registries in the world • For most of the more than 240 country code top-level domains (ccTLDs), the domain registries hold the authoritative WHOIS (Registrant, name servers, expiry dates, etc.). • However, some domain registries, such as for .COM, .ORG, .INFO, etc., use a registry-registrar model • Since about 2001, most gTLD registries (.ORG, .BIZ, .INFO) have adopted a so-called "thick" registry approach, i.e. keeping the authoritative WHOIS with the various registries instead of the registrars
• 14.
  RECURSIVE AND ITERATIVEQUERIES • There are two types of queries: • Recursive queries • Iterative (non-recursive) queries • The type of query is determined by a bit in the DNS query • Recursive query: When the name server of a host cannot resolve a query, the server issues a query to resolve the query • Iterative queries: When the name server of a host cannot resolve a query, it sends a referral to another server to the resolver
• 15.
  LOOKUP METHODS Recursive query: •Server goes out and searches for more info (recursive) root name server 2 • Only returns final answer or “not found” iterated query 3 Iterative query: • Server responds with as much as it knows (iterative) • “I don’t know this name, but ask this server” 7 local dns server 1 typically name server Intermediate Server 5 8 Workload impact on choice? • Local server recursive 4 6 authoritative name server Dns.Google.com does • Root/distant server does iterative requesting host Mail.google.com
• 16.
  DNS QUERY • QNAME:mail.Google.com • QCLASS: IN • QTYPE: A. Root Server Ask com NS mail.Google.com Com Server Ask google.com NS Google.com Server Stub resolver Mail.Google.com A 173.194.115.22 Recursive Resolver Mail.Google.com A 173.194.115.22
• 17.
  1- RECURSIVE RESOLUTION– EXAMPLE (CONTINUED) In the previous example, the mapping will be done as follows: Host contacts the local name server to query for the IP address of host mail.Google.com 1. If local name server does not have the answer in its cache or in its database, it will contact the root name server to query for the IP address of host mail.Google.com 2. If the root name server does not have the answer in its cache or in its database, it will contact the name server responsible for the .com domain (DNS.com) to query for the IP address of host mail.Google.com 3. If (DNS.com) does not have the answer in its cache or in its database, it will contact (DNS.Google.com) which has the IP address for host (mail.Google.com) 4. (DNS.Google.com) will return the answer to (DNS.com) 5. (DNS.com) will return the answer to the root name server 6. The root name server will return the answer to local DNS server. 7. Local DNS server will return the answer to Host.
• 18.
  2- ITERATIVE RESOLUTION– EXAMPLE (CONTINUED) 1- Host contacts the local name server to query for the IP address of mail.Google.com host 2- If local name server does not have the answer in its cache or in its database, it will reply to host with the IP address of the root name server 3- Host will contact the root name server to query for the IP address of mail.Google.com host 4- If the root name server does not have the answer in its cache or in its database, it will reply to host with the IP address of the name server for the (.com) domain which is (DNS.com) 5- Host will contact the name server (DNS.com) to query for the IP address of host mail.Google.com 6- If (DNS.com) does not have the answer in its cache or in its database, it will reply to host with the IP address of the name server DNS.Google.com which is the local name server for domain Google.com 7- Host will contact the name server (DNS.Google.com) to query for the IP address of host mail.Google.com 8- Since name server DNS.Google.com is the local name server for Google.com domain it will reply to host with the IP address for host mail.Google.com
• 19.
  HOW DNS WORKS •A network host is configured with an initial cache (so called hints) of the known addresses of the root name servers. Such a hint file is updated periodically by an administrator from a reliable source. • DNS zone is loaded on authoritative servers, • servers keep in sync using information in SOA RR via AXFR, IXFR or other means. • DNS caches only store data for a “short” time • defined by TTL. • DNS Recursive Resolvers start at “longest match” on query name they have when looking for data, and follow delegations until an answer or a negative answer is received. • DNS transactions are fast if servers are reachable.
• 20.
  SECURITY ISSUES • Somedomain names can spoof other, similar-looking domain names. • For example, "paypal.com" and "paypa1.com" are different names, yet users may be unable to tell the difference when the user's typeface(font) does not clearly differentiate the letter l and the number 1. • DNS responses are traditionally not cryptographically signed, leading to many attack possibilities; • Cache Poisoning • Denial of Service (DoS) • Masquerading • Client Flooding • Information Leakage • Compromise of DNS server’s authoritative data
• 21.
  DNSSEC • DNSSEC worksby digitally signing records for DNS lookup using public-key cryptography. The correct DNSKEY record is authenticated via a chain of trust, starting with a set of verified public keys for the DNS root zone which is the trusted third party. • DNSSEC modifies DNS to add support for cryptographically signed responses • There are various extensions to support securing zone transfer information as well • From the results of a DNS lookup, a security-aware DNS resolver can determine whether the authoritative name server for the domain being queried supports DNSSEC, whether the answer it receives is secure, and whether there is some sort of error. The lookup procedure is different for recursive name servers such as those of many ISPs, and for stub resolvers such as those included by default in mainstream operating systems.