Skip to content
Search

Domain Name System

lastmod 2026-02-05created 2015-01-1565 edits

The Domain Name System (DNS) was developed to translate a host's domain name into the host's network address, or to perform the reverse translation. To find the address of a particular computer (or any networked device), it translates human-readable domain names into numeric identifiers (IP addresses). The Domain Name System is often compared to a "phone book". As the Internet domain addressing scheme used by TCP/IP applications, it is a distributed database system that translates the domain name of a host computer, such as www.example.com, into an IP address such as 192.168.1.0 and provides routing information.

Categories

DNS Servers

  • Berkeley Internet Name Domain (BIND; bind9; bind)
  • PowerDNS (pdns)
  • nsupdate
  • Pi-hole - Pi-hole is mainly used to block ads and tracking, but it also works great as a local DNS server for your network. Setup is simple and it is easy to manage through the web interface.
  • Dnsmasq - Can use the information in the hosts file directly as its DNS configuration file.
  • Unbound - A validating, recursive, and caching DNS resolver from NLnet Labs. It is distributed free of charge as open source under the BSD license.
  • NSD
  • CoreDNS (CNCF) - Often used in container environments.
  • RethinkDNS - Serverless DNS resolver
  • MaraDNS - A simple DNS service for Windows that can be used for service testing

Domain Registr

See Domain name registrar. In short, it is (literally) an agent that registers domains on your behalf.

Tools

DNS subdomain names

Most resource types require a name that can be used as a DNS subdomain name as defined in RFC 1123. This means the name must:

  • contain no more than 253 characters.
  • contain only lowercase alphanumeric characters, - or ..
  • start with an alphanumeric character.
  • end with an alphanumeric character.

RFC 1123 label names

Some resource types require their names to follow the DNS label standard as defined in RFC 1123. This means the name must:

  • contain at most 63 characters.
  • contain only lowercase alphanumeric characters or -.
  • start with an alphanumeric character.
  • end with an alphanumeric character.

RFC 1035 label names

Some resource types require their names to follow the DNS label standard as defined in RFC 1035. This means the name must:

  • contain at most 63 characters
  • contain only lowercase alphanumeric characters or -
  • start with an alphabetic character
  • end with an alphanumeric character

Ports used

UDP port 53

TCP port 53

  • Used for Zone Transfer (used to sync between Master and Slave DNS)
  • Used when the Message is larger than 512 bytes
  • Name servers should avoid using more than at most 7 NS records.
  • Keep A records for the same host to no more than 30. Beyond that, the query is retried over TCP

How to set DNS addresses manually

Use one of the following methods:

DNS Records

A

An A record means that a domain name has one IPv4 Address. It holds the IP address value for a domain (including subdomains and the root). 

dev.test.me -> 123.456.789.123 // 해당 도메인의 IP 주소
test.me -> 987.654.321.123     // 해당 도메인의 IP 주소

AAAA

IPv6 address

MX

MX records are used for mail connections. Changing or deleting the entered information may change or interrupt the service, so be sure to check your mail settings.

TXT

Used to verify email senders and application-specific values

  • If you want to enter an SPF record, enter it in the TXT record field above.
  • Registering an SPF record is recommended to prevent your domain from being blocked as spam.
  • To apply a correct SPF, it is recommended to register the SPF record using the SPF Record wizard. [SPF Record wizard]
  • Correct examples of SPF record values: enter them in the same format as the 2 examples below.
    • v=spf1 include:spf.hiworks.co.kr ~all / v=spf1 ip4:211.243.118.50 ~all
    • TXT records cannot contain @, ^, <, >, ?, or &#96; (apostrophe).

CNAME

CNAME is short for Canonical Name and refers to a way of giving another name to a domain. Think of it as an alias for a domain name. CNAME information is used for mail, blog connections, and so on. 

blog.test.me -> test.me // test.me의 또 다른 도메인명
www.test.me -> test.me  // test.me의 또 다른 도메인명

When configuring, enter it as follows. 

answer CNAME youthful-nightingale-07aa0b.netlify.com.

PTR

Maps an IP address to a domain address

SRV record

Application-specific values that identify servers.

(On Gabia) When setting an SRV record, you must enter . at the end of the target value for it to be set up correctly. 

sipdir.online.lync.com.

SPF

(Not recommended) <- ??? Why? That's what amazon route 53 says

NAPTR

Used by DDDS applications

CAA

Restricts which CAs can issue SSL/TLS certificates for the domain

NS

Name servers for the hosted zone

DS

Delegation Signer, used to establish the chain of trust for DNSSEC

DNSSEC

Because email servers use DNS to route messages, they are vulnerable to security problems within the DNS infrastructure. In September 2014, researchers at CMU found that emails meant to be sent through Yahoo!, Hotmail, and Gmail servers were being routed to malicious mail servers. The attackers were exploiting a decades-old vulnerability in DNS, which does not verify credentials before accepting a response.

The solution is a protocol called DNSSEC, which adds trust by adding authentication to DNS. When a DNS resolver looks up blog.cloudflare.com, the .com name servers help the resolver verify the records returned for Cloudflare, and Cloudflare helps verify the records returned for the blog. The root DNS name servers help verify .com, and the information published by the root goes through rigorous security procedures, including the Root Signing Ceremony.

A gentle introduction to DNSSEC

DNSSEC creates a secure DNS system by adding cryptographic signatures to existing DNS records. These digital signatures are stored in DNS name servers alongside common record types such as A, AAAA, MX, and CNAME. By checking the associated signature, you can verify that a requested DNS record came from its authoritative name server and was not altered en route, as opposed to a fake record injected in a man-in-the-middle attack.

To facilitate signature validation, DNSSEC adds a few new DNS record types:

  • RRSIG - Contains a cryptographic signature
  • DNSKEY - Contains a public signing key
  • DS - Contains a hash of a DNSKEY record
  • NSEC, NSEC3 - For explicit denial of existence of a DNS record
  • CDNSKEY, CDS - For a child zone requesting updates to DS records in the parent zone.

SOA

The DNS 'start of authority' (SOA) record stores important information about a domain or zone, such as the administrator's email address, when the domain was last updated, and how long the server should wait between refreshes.

All DNS zones need an SOA record to conform to IETF standards. SOA records are also important for zone transfers.

Meaning of the trailing period (.)

It is a little-known fact, but fully qualified (unambiguous) DNS domain names have a dot at the end. People who run DNS servers usually know this (if you miss the trailing dot, your DNS configuration may not work), but the general public usually does not. A domain name without a trailing dot is not fully qualified and can be ambiguous. This is documented in RFC 1034, the 1987 DNS specification. 

Since a complete domain name ends with the root label, this leads to a
printed form which ends in a dot.  We use this property to distinguish between:

   - a character string which represents a complete domain name
     (often called "absolute").  For example, "poneria.ISI.EDU."

   - a character string that represents the starting labels of a
     domain name which is incomplete, and should be completed by
     local software using knowledge of the local domain (often
     called "relative").  For example, "poneria" used in the
     ISI.EDU domain.

NXDOMAIN

If you see an error message indicating NXDOMAIN, it means the domain name could not be resolved. Logically, this means the site you are trying to access cannot be browsed.

Extensible Provisioning Protocol (EPP)

In DNS, EPP (Extensible Provisioning Protocol) status codes are response codes of the protocol used for domain registration and management. DNS itself does not return EPP status codes directly, but you can check the EPP status through interaction with the domain registrar.

EPP status codes usually indicate a domain's registration status and can be checked through WHOIS information or the registrar's API.

How to check EPP status codes

You can look up a domain's WHOIS information with the whois command. The EPP status codes for a registered domain may be provided in the WHOIS response. 

whois example.com | grep -i status

Example

Below is an example from Wikipedia. As shown below, the Value differs depending on the domain's TYPE.

NAME

TYPE

VALUE

bar.example.com

CNAME

foo.example.com

foo.example.com

A

192.0.2.23

Fully qualified domain name

A Fully Qualified Domain Name (FQDN) is a term for the complete domain name, including the host name and the domain name.

On CentOS, you can check it with the command below. 

$ hostname --fqdn

Structure

Domain name space

The domain name space is an arrangement of domain names in a tree. Each node in the tree has zero or more resource records. The tree starts at the root zone and is divided into multiple subzones. Each DNS zone is a set of nodes managed by one authoritative nameserver. (A single nameserver can also manage multiple zones.)

Administrative authority can be divided to form new zones. In this case, a part of the existing domain name space is said to be delegated, in the form of a subdomain, to another nameserver. The existing zone then loses authority over the new zone.

Domain name formation

The rules for forming domain names are defined in RFC 1035, RFC 1123, and RFC 2181. A domain name consists of one or more parts (labels), joined together and separated by dots. (e.g. example.com)

How it works

Public DNS

A list of public DNS services.

Google Public DNS
IPv4: 8.8.8.8, 8.8.4.4
IPv6: 2001:4860:4860::8888, 2001:4860:4860::8844
DNS0
A European public DNS for using the Internet safely
https://www.dns0.eu/
  • A free, independent, GDPR-compliant recursive DNS resolver
  • Focused on security to protect citizens and organizations in the EU
  • Uses dns0.eu and the addresses 193.110.81.0 / 185.253.5.0
  • Fast, distributed DNS infrastructure spread across 27 European cities, 55 data centers, and 62 servers
  • Supports DNS-over-HTTPS/TLS/QUIC/HTTP3 and DDR Encrypted Upgrade
  • ZERO server for security-sensitive environments (193.110.81.9, 185.253.5.9): blocks malicious domains at the source using heuristics
    • Newly Registered Domains (NRD): blocks domains registered 30 days ago or less
    • Newly Active Domains (NAD): blocks domains that suddenly become active after being dormant
    • Domain Generation Algorithms (DGA): blocks domains created with domain generation algorithms
    • IDN Homographs: blocks domains that pretend to be another domain by swapping certain characters (e.g. replacing the Latin "e" with the Cyrillic "е")
    • Typosquatting: blocks domains that exploit typos (gooogle.com instead of google.com)
    • DNS Rebinding: automatically blocks DNS responses containing Private IP addresses, preventing attackers from controlling local devices over the Internet
    • Dynamic DNS (DDNS): blocked because dynamic DNS is sometimes used to impersonate other services
    • Cryptojacking: also blocks mining cryptocurrency using other people's devices
    • Parked Domains: blocked because domains parked with a single page often serve suspicious or dangerous content
    • High-risk Top-level Domains (TLD): blocks TLDs favored by attackers, and so on
  • Also provides a separate DNS that filters content to be safe for children (193.110.81.1, 185.253.5.1)
    • Blocks adult websites
    • Filters explicit content in major search engines
    • Blocks adult videos on YouTube
    • Blocks dating websites/apps
    • Blocks mixed-content sites (where only some content is adult)
    • Blocks torrent/piracy sites
    • Blocks most ads
  • Run by a French nonprofit foundation founded by the co-founders of NextDNS

Documentations

RFC 1034
DOMAIN NAMES - CONCEPTS AND FACILITIES
https://www.rfc-editor.org/rfc/rfc1034
RFC 1035
DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION
https://www.rfc-editor.org/rfc/rfc1035

Favorite site

Online Tools

author Zer0 sitemap