Introduction to the DNS system Olaf M Kolkman

Introduction to the DNS system Olaf M. Kolkman Okolkman@ripe. net slideset 1 February 2003

Purpose of naming n Addresses are used to locate objects n Names are easier to remember than numbers n n February 2003 2 You would like to get to the address or other objects using a name DNS provides a mapping from names to resources of several types Jump to first page

Names and addresses in general n n February 2003 3 An address is how you get to an endpoint n Typically, hierarchical (for scaling): n 950 Charter Street, Redwood City CA, 94063 n 204. 152. 187. 11, +1 -650 -381 -6003 A “name” is how an endpoint is referenced n Typically, no structurally significant hierarchy n “David”, “Tokyo”, “itu. int” Jump to first page

Naming History n 1970’s ARPANET u Host. txt maintained by the SRI-NIC u pulled from a single machine u Problems F traffic n February 2003 4 and load F Name collisions F Consistency DNS reated in 1983 by Paul Mockapetris (RFCs 1034 and 1035), modified, updated, and enhanced by a myriad of subsequent RFCs Jump to first page

DNS n n n February 2003 5 A lookup mechanism for translating objects into other objects A globally distributed, loosely coherent, scalable, reliable, dynamic database Comprised of three components n A “name space” n Servers making that name space available n Resolvers (clients) which query the servers about the name space Jump to first page

DNS Features: Global Distribution n Data is maintained locally, but retrievable globally u n n February 2003 6 No single computer has all DNS data DNS lookups can be performed by any device Remote DNS data is locally cachable to improve performance Jump to first page

DNS Features: Loose Coherency n The database is always internally consistent u Each version of a subset of the database (a zone) has a serial number F n n February 2003 7 The serial number is incremented on each database change Changes to the master copy of the database are replicated according to timing set by the zone administrator Cached data expires according to timeout set by zone administrator Jump to first page

DNS Features: Scalability n No limit to the size of the database u One server has over 20, 000 names F Not n a particularly good idea No limit to the number of queries u 24, 000 n February 2003 8 queries per second handled easily Queries distributed among masters, slaves, and caches Jump to first page

DNS Features: Reliability n Data is replicated u n Data from master is copied to multiple slaves Clients can query Master server u Any of the copies at slave servers u n Clients will typically query local caches n DNS protocols can use either UDP or TCP u February 2003 9 If UDP, DNS protocol handles retransmission, sequencing, etc. Jump to first page

DNS Features: Dynamicity n Database can be updated dynamically u Add/delete/modify n Modification of the master database triggers replication u Only master can be dynamically updated F Creates February 2003 10 of any record a single point of failure Jump to first page

DNS Concepts n Next slides are about concepts n After this set of slides you should understand u How u Why u The February 2003 11 the DNS is built it is built the way it is terminology used throughout the course Jump to first page

Concept: DNS Names 1 n n The namespace needs to be made hierarchical to be able to scale. The idea is to name objects based on u location (within country, set of organizations, set of companies, etc) u unit within that location (company within set of company, etc) u object within unit (name of person in company) February 2003 12 Jump to first page

Concept: DNS Names 2 How names appear in the DNS Fully Qualified Domain Name (FQDN) WWW. RIPE. NET. n n n February 2003 13 labels separated by dots Note the trailing dot DNS provides a mapping from FQDNs to resources of several types Names are used as a key when fetching data in the DNS Jump to first page

Concept: Resource Records The DNS maps names into data using Resource Records. n Resource Record www. ripe. net. … A 10. 10. 2 Address Resource n February 2003 14 More detail later Jump to first page

Concept: DNS Names 3 ftp www ws 1 ws 2 • disi n www Domain names can be mapped to a tree. sun • • n New branches at the ‘dots’ ripe isi tislabs moon • • • googlen No restriction to the amount net edu com of branches. • February 2003 15 Jump to first page

Concept: Domains n n n Domains are “namespaces” Everything below. com is in the com domain. Everything below ripe. net is in the ripe. net domain and in the net domain. com domain • edu com • isi sun moon ripe • disi ftp • net domain www ws 2 February 2003 16 google tislabs • • ripe. net domain • net www ws 1 Jump to first page

Delegation n Administrators can create subdomains to group hosts u n An administrator of a domain can delegate responsibility for managing a subdomain to someone else u n But this isn’t required The parent domain retains links to the delegated subdomain u February 2003 17 According to geography, organizational affiliation or any other criterion The parent domain “remembers” who it delegated the subdomain to Jump to first page

Concept: Zones and Delegations net zone net edu com • ripe • disi. ripe. net zone February 2003 18 google isi sun tislabs moon disi www ftp ws 2 ws 1 • ripe. net zone • net domain • n Zones are “administrative spaces” Zone administrators are responsible for portion of a domain’s name space Authority is delegated from a parent and to a child • n www Jump to first page

Concept: Name Servers n Name servers answer ‘DNS’ questions. n Several types of name servers u Authoritative servers F master (primary) F slave (secondary) u (Caching) F also caching forwarders u Mixture February 2003 19 recursive servers of functionality Jump to first page

n n n Concept: Name Servers authoritative name server Give authoritative answers for one or more zones. The master server normally loads the data from a zone file A slave server normally replicates the data from the master via a zone transfer slave February 2003 20 master slave Jump to first page

Concept: Name Servers recursive server n n n February 2003 21 Recursive servers do the actual lookups; they ask questions to the DNS on behalf of the clients. Answers are obtained from authoritative servers but the answers forwarded to the clients are marked as not authoritative Answers are stored for future reference in the cache Jump to first page

Concept: Resolvers n n Resolvers ask the questions to the DNS system on behalf of the application. Normally implemented in a system library (e. g, libc) gethostbyname(char *name); gethostbyaddr(char *addr, int len, type); February 2003 22 Jump to first page

Concept: Resolving process & Cache Question: www. ripe. net A ? Resolver 192. 168. 5. 10 root-server Ask net server @ X. gtld-servers. net (+ glue) Caching forwarder (recursive) www. ripe. net A ? gtld-server Ask ripe server @ ns. ripe. net (+ glue) Add to cache www. ripe. net A ? 192. 168. 5. 10 ripe-server February 2003 23 Jump to first page

Concept: Resource Records (more detail) Resource records consist of it’s name, it’s TTL, it’s class, it’s type and it’s RDATA TTL is a timing parameter IN class is widest used There are multiple types of RR records Everything behind the type identifier is called rdata n n n www. ripe. net. Label 3600 IN ttl A 10. 10. 2 rdata type class February 2003 24 Jump to first page

Example: RRs in a zone file ripe. net. 7200 IN SOA ns. ripe. net. olaf. ripe. net. ( 2001061501 ; Serial 43200 ; Refresh 12 hours 14400 ; Retry 4 hours 345600 ; Expire 4 days 7200 ; Negative cache 2 hours ripe. net. 7200 IN IN pinkje. ripe. net. 3600 host 25. ripe. net. 2600 Label February 2003 25 ttl ) NS NS IN IN class ns. ripe. net. ns. eu. net. A A 193. 0. 1. 162 193. 0. 3. 25 type rdata Jump to first page

Resource Record: SOA and NS n n The SOA and NS records are used to provide information about the DNS itself. The NS indicates where information about a given zone can be found: ripe. net. 7200 n February 2003 26 IN IN NS NS ns. ripe. net. ns. eu. net. The SOA record provides information about the start of authority, i. e. the top of the zone, also called the APEX. Jump to first page

Resource Record: SOA Master server Contact address net. 3600 IN SOA Version A. GTLD-SERVERS. net. nstld. verisign-grs. com. ( 2002021301 ; serial 30 M ; refresh 15 M ; retry 1 W ; expiry number 1 D ) ; neg. answ. ttl Timing parameter February 2003 27 Jump to first page

Concept: TTL and other Timers n TTL is a timer used in caches u An indication for how long the data may be reused u Data that is expected to be ‘stable’ can have high TTLs n February 2003 28 SOA timers are used for maintaining consistency between primary and secondary servers Jump to first page

Places where DNS data lives Changes in DNS do not propagate instantly! Might take up to refresh to get data from master Slave Not going to net if TTL>0 Cache server Upload of zone data is local policy Master Registry DB February 2003 29 Slave server Jump to first page

To remember. . . n Multiple authoritative servers to distribute load and risk: u Put n n your name servers apart from each other Caches to reduce load to authoritative servers and reduce response times SOA timers and TTL need to be tuned to needs of zone. Stable data: higher numbers February 2003 30 Jump to first page

What have we learned What are we about to learn n We learned about the architecture: u resolvers, u caching forwarders, u authoritative servers, u timing parameters February 2003 31 Jump to first page