Lesson 4.5: DNS: the internet's phone book

How names become addresses: the DNS hierarchy, resolvers and authoritative servers, the main record types (A, AAAA, MX, TXT, NS, CNAME), caching and TTL, the hosts file that is checked before DNS, and the attacks on name resolution: tampering with the hosts file, spoofed answers, cache poisoning, with DNSSEC and encrypted DNS as defences. In the lab you query the company's records, notice that your laptop and DNS disagree about the web server's address, find the line malware added to the hosts file and remove it.

19 min

You will learn to

Explain what DNS does and how a lookup travels
Name the main record types
Query records with dig
Explain the hosts file and why it's checked first
Recognise and fix a tampered hosts file

Key terms

DNS: The distributed system that translates names like www.northwind.example into IP addresses, and stores other facts about domains.
Domain name hierarchy: Names are read right to left: the root, a top-level domain (.com, .org, .tr, .example), a domain (northwind.example), then names inside it (www).
Resolver and authoritative server: A resolver looks names up on your behalf and caches the answers; an authoritative server holds the official records for a domain.
Record types: A: IPv4 address. AAAA: IPv6 address. MX: mail server. TXT: free text, used for policies like SPF. NS: authoritative servers. CNAME: an alias pointing to another name.
TTL (DNS): How many seconds a resolver may cache an answer.
Hosts file: A local list of name-to-address pairs (/etc/hosts on Linux and macOS, C:\Windows\System32\drivers\etc\hosts on Windows), checked before DNS.
DNS spoofing and cache poisoning: Getting a victim, or a resolver's cache, to accept a false answer, so a real name leads to the attacker's address.

← More ways to look at text: head, tail, wc, sort and uniq · All lessons · Incident response: prepare, detect, contain, eradicate, recover, learn →