What Is DNS?

The DNS system is an essential part of a functioning internet. Most people use DNS services daily to access their favorite web pages and apps. Think of the DNS as a phone book that stores contact information for every site on the internet.

But how exactly does the DNS work? Let’s dive into the structure of this system, how it works, and how it affects your website.

Key Takeaways

• DNS stands for Domain Name System and works as a directory for the internet.
• The DNS uses domain names to look up IP addresses and send the user to the correct website.
• DNS requests can use up to four servers: DNS recursors, root name servers, TLD nameservers, and authoritative nameservers.
• DNS records store IP addresses and other important information about a domain.
• DNS records are vulnerable to cache poisoning and other security risks, but installing the DNSSEC protocol can help prevent them.

What is DNS?

DNS stands for Domain Name System. It was first developed in 1983 as the internet expanded outside of academic institutions. It contains information for every domain online, sending users to the correct destination on the internet. Every time you type a web address into your browser, it connects to the DNS to send you to that website.

What Are DNS Servers?

There are four types of DNS servers, and they all work together to complete DNS queries. Here’s what each type of DNS server does.

DNS Recursor

The DNS recursor, or recursive resolver, is the first step in the query process. When you type a web address into your browser or connect to your email account, these applications send a query to the DNS Recursor. 

The DNS Recursor server acts as the middleman between the application you’re using and the other three types of DNS servers. It makes sure that the DNS server network finds the correct information, so you end up at the right website.

Root Nameserver

After your domain query goes through the DNS recursor, it is passed down to the root nameserver. This server works like an index to help your browser find your website’s IP address.

There are 13 types of root nameservers. These nameservers contain records for domains in the “root zone.” These include sites with top-level domains such as .com or .org, as well as country code domains such as .uk or .ca.

Most websites fall into the root zone. Once the root nameserver has identified the site’s domain extension, that information is sent to the DNS recursor, which uses it to find the right TLD nameserver. 

TLD Nameserver

After going through the root nameserver, domain query requests are passed on to the TLD, or top-level domain, nameserver.  These servers are grouped together by their domain name extension, such as “.com” or “.org”.

These servers store information for the second-level domain in a web address. For example, if you entered “google.com”, the root nameserver would send you to the server for the .com extension. 

This server contains the domains that end with “.com” The server locates the information for Google’s authoritative nameserver and sends it back to the DNS recursor. 

Authoritative Nameserver

The final step in the process is the authoritative nameserver. The DNS recursor takes the information from the root and TLD nameservers and finds the authoritative nameserver, which is for a specific domain. 

The authoritative nameserver shares the IP address with the DNS recursor. The IP address is then passed on to your web browser and sends you to the correct site. 

DNS Records

DNS records live on the DNS servers and contain information about the domains. There are many different types of DNS records, each containing different pieces of information. There are dozens of different DNS record types – here are some of the most common ones.

Common DNS Issues and Troubleshooting

When DNS records and servers for your domain aren’t configured properly, it can cause issues with your website. Here are some of the most common DNS issues and how to troubleshoot them.

DNS Propagation Delays

DNS propagation is the process of updating a domain’s records in the DNS. When you purchase a new web domain, you’ll be required to start propagation to keep DNS records accurate and up-to-date.

This process takes anywhere from a few minutes to a few days to complete. During this time, the server updates every record associated with your domain. 

When DNS propagation takes too long, users won’t be able to visit your website. However, there are some things you can do to speed up the process. Taking these steps ahead of time can help prevent propagation issues. 

Step 1: Decrease your site’s time-to-live value, or TTL. 

This is the amount of time that your domain stays cached before refreshing. Most sites have a default TTL of 24 hours. If your DNS is propagating while your site is still cached, they will encounter an error message. Lowering the TTL will help your records propagate faster.

Step 2: Flush the cache locally on the devices you’re using and on popular DNS databases.

These databases make it easy to clear your cache manually, which will help visitors access the updated version of your site.

DNS Cache Poisoning and Security Concerns

Cybercriminals often target DNS records as part of their attacks. DNS cache poisoning or DNS spoofing happens when hackers alter your DNS records, placing false information in the cache. 

This means that when someone tries to visit your domain, they’ll be directed to the wrong website.

The best way to avoid these attacks is to implement the DNS Security Protocol, or DNSSEC. This protocol prevents cache poisoning by adding an extra level of verification to the DNS request process. 

Another common DNS attack is DNS tunneling. 

With DNS tunneling, attackers embed malicious programs in their DNS requests. These attacks are difficult to prevent, but implementing a sophisticated firewall and regularly monitoring your DNS queries can help you prevent them.

DNS Security Extensions

DNSSEC is the best way to protect your domain from security threats. DNSSEC is a feature of DNS that authenticates responses to domain lookups. 

Security experts recommend that all domains use this protocol. However, only 4.3% of .com and 5.3% of .net domains have DNSSEC installed.

DNSSEC should be configured across your top-level domain, DNS resolver, and DNS zone. Most web hosts have DNSSEC options on their platforms, but you’ll need to enable them manually. Work with your hosting provider to make sure your site is secure.

Choosing a Reliable DNS Provider

Finding a reliable DNS provider, or web host, is a must when setting up a new domain. There are many DNS providers to choose from, and you’ll need to evaluate your options carefully.