In this exercise you'll learn about DNS by using dig to make DNS queries. These are the primary objectives of this exercise:
- Expose the different responsibilities of different members of the DNS hierarchy.
- Explore how different DNS servers respond differently to different DNS queries.
- Familiarize yourself with the different kinds of DNS record types, and distinguish between them.
dig is a command line tool that comes installed on most unix and linux systems, or can be installed with your favorite package manager. If not, you can use this web interface -- but the user experience is much worse so I strongly suggest you use the command line instead.
There are many different kinds of DNS records. The two most important types of record are:
- A and AAAA -- A and quad A records map domain names to IP addresses. A records are for IPv4 addresses and AAAA records are for IPv6 addresses.
- NS -- NS records map domain names to other domain names. Specifically they map a domain name to the name of it's authoritative DNS server.
Lets use dig to explore the differences between these record types. Try the following in your terminal:
dig A google.com
My response looks like this, yours ought to look similar:
; <<>> DiG 9.10.6 <<>> A google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39086
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 68 IN A 172.217.2.238
;; Query time: 13 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Jun 22 15:05:03 PDT 2018
;; MSG SIZE rcvd: 55
What IP address did your DNS resolver tell you to use for google.com?
Your answer here.
You may have a different IP address than I received. Is this expected behavior for DNS? Why or why not?
Your answer here.
If you did get a different IP address, how different is it? Can you spot any similarities to my result?
Your answer here.
What happens if you paste the IP address you received into your web browser's URL bar?
Your answer here.
This line (found near the bottom of the output from dig) is probably different for you:
;; SERVER: 1.1.1.1#53(1.1.1.1).
1.1.1.1 is the IP address of the DNS resolver I am using -- a service provided by CloudFlare.
Use the whois terminal command to determine who is operating your DNS resolver. For example, whois 1.1.1.1 will tell that 1.1.1.1 is an "APNIC and Cloudflare DNS Resolver project"
Who operates your DNS resolver?
Now try this:
dig AAAA google.com
What is the difference between the answer to this query, and the last query?
Your answer here.
Now try this:
dig NS google.com
My results look like this, and yours should look similar:
; <<>> DiG 9.10.6 <<>> ns google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59422
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;google.com. IN NS
;; ANSWER SECTION:
google.com. 6259 IN NS ns1.google.com.
google.com. 6259 IN NS ns2.google.com.
google.com. 6259 IN NS ns3.google.com.
google.com. 6259 IN NS ns4.google.com.
;; Query time: 15 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Jun 22 15:15:27 PDT 2018
;; MSG SIZE rcvd: 111
4 servers are identified by name, ns1.google.com, ns2.google.com, ns3.google.com and ns4.google.com.
What are these servers?
Your answer here.
How can you use dig to determine an IP address for each of these servers?
Your answer here.
Use whois to determine who owns those IP addresses?
Your answer here.
In this exercise, we have been relying exclusively on your "default DNS resolver" to answer questions for us. In the next exercise we will use dig to explore the DNS hierarchy by sending DNS queries directly to root, TLD, and authoritative servers.
An answer key for this exercise can be found here