|
1 | 1 | # DNS |
2 | 2 |
|
| 3 | +DNS (Domain Name System) is a system for resolving domain names to IP addresses, Kerberos Realms, and other information. It is currently used in the Computer Systems Lab to provide forward and reverse name resolution as well as location of Kerberos and AFS realms. |
3 | 4 |
|
| 5 | +## Structure |
4 | 6 |
|
| 7 | +DNS is structured as a hierarchical tree. At the root of the tree is a DNS Zone called . or the root zone. The root zone is managed by thirteen nameservers (creatively called a-m.root-servers.net) about half of which are anycasted to locations around the world. |
| 8 | + |
| 9 | +While they form the root of DNS; the root nameservers don't actually know how to answer a query for say www.tjhsst.edu (198.38.16.47). Rather, they know where to go to find the answer. In the case of www.tjhsst.edu, the answer is to go to the EDUCAUSE nameservers which manage the .edu TLD (Top-Level Domain). The .edu nameservers in turn, still don't know the answer, but they know where the answer is, in this case, with [ns1] and [ns2] which are the Authoritative nameservers for the tjhsst.edu domain. Finally, either ns1 or ns2 will tell you that www.tjhsst.edu has the IP 198.38.16.47 (assuming that is the information you were asking for). |
| 10 | + |
| 11 | +### Recursive vs Authoritative Nameservers |
| 12 | + |
| 13 | +There are two types of nameservers that are generally involved in DNS. A single DNS Server can have one or both of these roles although it is considered best practice to separate them for security. |
| 14 | + |
| 15 | +An authoritative nameserver has a database of some type which contains the records for a domain. In general, a domain will have one master nameserver on which the database is updated manually, and one or more slave nameservers which automatically transfer changes from the master. |
| 16 | + |
| 17 | +A recursive nameserver has no knowledge or records of its own, but rather, resolves records for other systems and then caches the response so that it can respond to other queries about the same record without rerunning the lookup sequence outlined above. The amount of time records are cached is controlled by the TTL (Time To Live) which is specified by the Authoritative nameserver for the zone. A higher TTL places less load on the Authoritative nameservers but also means changes take longer to propagate. It is considered good practice to lower the TTL for a domain to around 5 minutes before making major changes to minimize the amount of time a mistake would be cached. |
| 18 | + |
| 19 | +## CSL Layout |
| 20 | + |
| 21 | +Both recursive and authoritative DNS for tjhsst.edu are currently provided by [ns1] and [ns2]. ns1 should always be a physical machine (we learned that the hard way), ns2 can be a VM. The both run ISC BIND (Berkeley Internet Name Daemon), sometimes called `named` which is the name of the daemon. See [DNS/Configuration](configuration.md) for details on the configuration layout and how to make changes. |
| 22 | + |
| 23 | +## Record Types |
| 24 | + |
| 25 | +There are a number of different record types for the various types of information that can be stored in DNS. |
| 26 | + |
| 27 | +### A |
| 28 | + |
| 29 | +One of if not the most common record type, an A record simply maps a domain name to an IP address. |
| 30 | + |
| 31 | +``` |
| 32 | +www.tjhsst.edu. IN A 198.38.16.47 |
| 33 | +``` |
| 34 | + |
| 35 | +One domain name can have more than one A record in which case most DNS servers will alternate which IP address they return. This is called a round-robin and is frequently used for load-balancing. |
| 36 | + |
| 37 | +``` |
| 38 | +mail.tjhsst.edu. IN A 198.38.16.130 |
| 39 | +mail.tjhsst.edu. IN A 198.38.16.131 |
| 40 | +``` |
| 41 | + |
| 42 | +### AAAA |
| 43 | + |
| 44 | +An AAAA record is almost identical to an A record except that it is used for IPv6 addresses instead. |
| 45 | + |
| 46 | +``` |
| 47 | +www.tjhsst.edu. IN AAAA 2001:468:cc0:1600:0:c6ff:fe26:102f |
| 48 | +``` |
| 49 | + |
| 50 | +### PTR |
| 51 | + |
| 52 | +A PTR record functions in the reverse direction to an A record; it is used to map an IPv4 or IPv6 address back to a domain name. PTR records use a special domain (in-addr.arpa for IPv4 and ip6.arpa for IPv6) which is preceeded by the reversed IP address. |
| 53 | + |
| 54 | +``` |
| 55 | +47.16.38.198.in-addr.arpa. IN PTR www.tjhsst.edu. |
| 56 | +f.2.0.1.6.2.e.f.f.f.6.c.0.0.0.0.0.0.6.1.0.c.c.0.8.6.4.0.1.0.0.2.ip6.arpa. IN PTR www.tjhsst.edu. |
| 57 | +``` |
| 58 | + |
| 59 | +### CNAME |
| 60 | + |
| 61 | +A CNAME (Canonical Name) is used to alias one domain record to another. This is frequently used together with apache name-based virtual hosting. IMPORTANT NOTE - unlike many other record types which can share the same record (for example, tjhsst.edu has A, MX, NS, and SOA records), CNAMEs cannot share a record with any other record type and will override any other record defined. This is why tjhsst.edu has an A record for www's IP instead of being CNAME'd to www. |
| 62 | + |
| 63 | +``` |
| 64 | +webmail.tjhsst.edu. IN CNAME www.tjhsst.edu. |
| 65 | +``` |
| 66 | + |
| 67 | +### NS |
| 68 | + |
| 69 | +An NS (NameServer) record is used to delegate control of a subdomain to another nameserver or nameservers. |
| 70 | + |
| 71 | +``` |
| 72 | +tjhsst.edu. IN NS ns1.tjhsst.edu. |
| 73 | +tjhsst.edu. IN NS ns2.tjhsst.edu. |
| 74 | +``` |
| 75 | + |
| 76 | +### MX |
| 77 | + |
| 78 | +An MX record is used to tell sending mailservers where they can find the mailservers for a particular domain. Without MX records, the default assumption is to send mail to the same address as the domain which is frequently not wanted. MX Records contain both a domain name and a priority which can be used to setup a backup mailserver while still ensuring that mail is delivered to the main server if it is up. Mail Servers with equal priority are rotated similar to A record round-robins. |
| 79 | + |
| 80 | +``` |
| 81 | +tjhsst.edu. IN MX 10 casey.tjhsst.edu. |
| 82 | +tjhsst.edu. IN MX 10 smith.tjhsst.edu. |
| 83 | +tjhsst.edu. IN MX 20 ananke.tjhsst.edu. |
| 84 | +``` |
| 85 | + |
| 86 | +### SRV |
| 87 | + |
| 88 | +SRV (Service) records are used to map domain names to the servers and ports which provide a service under that domain name. Microsoft Active Directory for example, uses SRV records heavily to allow clients to locate the various Domain Services. In the CSL, we use SRV records to help systems locate our Kerberos services. Notice that these records do not have the IN (Internet) type. |
| 89 | + |
| 90 | +``` |
| 91 | +_kerberos._tcp.csl.tjhsst.edu. SRV 0 0 88 kdc1.tjhsst.edu. |
| 92 | +_kerberos._tcp.csl.tjhsst.edu. SRV 0 0 88 kdc2.tjhsst.edu. |
| 93 | +``` |
| 94 | + |
| 95 | +### AFSDB |
| 96 | + |
| 97 | +AFSDB records function similar to SRV records specifically for AFS. |
| 98 | + |
| 99 | +``` |
| 100 | +csl.tjhsst.edu. IN AFSDB 1 openafs1.csl.tjhsst.edu. |
| 101 | +csl.tjhsst.edu. IN AFSDB 1 openafs4.csl.tjhsst.edu. |
| 102 | +csl.tjhsst.edu. IN AFSDB 1 haafs2.csl.tjhsst.edu. |
| 103 | +``` |
| 104 | + |
| 105 | +### TXT |
| 106 | + |
| 107 | +TXT records are simply used to store text. These are frequently used to test new record ideas before an official record type is created. For example, many SFP records are still provided as TXT records. |
| 108 | + |
| 109 | +``` |
| 110 | +_kerberos.csl.tjhsst.edu. TXT "CSL.TJHSST.EDU" |
| 111 | +``` |
| 112 | + |
| 113 | +``` |
| 114 | +tjhsst.edu. IN TXT "v=spf1 mx ~all" |
| 115 | +``` |
| 116 | + |
| 117 | +### SOA |
| 118 | + |
| 119 | +The SOA record for a domain provides administrative information for the domain. These include the serial number (used to help slave nameservers know when to update from the master), the default record TTL and expiration time, and the master nameserver address and domain administrator email address. |
| 120 | + |
| 121 | +``` |
| 122 | +tjhsst.edu. 86400 IN SOA ns1.tjhsst.edu. hostmaster.tjhsst.edu. 2013092500 3600 600 1209600 86400 |
| 123 | +``` |
| 124 | + |
| 125 | +[ns1]: ../../../machines/other/pitcairn.md |
| 126 | +[ns2]: ../../../machines/vm-servers/galapagos.md |
0 commit comments