DNS recursive query and iterative Query

Senior IT personnel know the root cause of domain name resolution faults and DNS pollution nationwide in January 23.

The Internet emergency center was attacked.

So here we will introduce the DNS server's query principle, that is, recursive query and iterative query.

It briefly describes the whole process of DNS Server Parsing the host www.163.com for the client.

650) this. width = 650; "title =" dns1.jpg "alt =" wkiol1lgjkrdu?qaakjl=z1ta163.jpg "src =" http://www.bkjia.com/uploads/allimg/140207/21552TY9-0.jpg "/>

Root Domain Name Server:Is the most advanced Domain Name Server in the Internet domain name resolution System (DNS). There are 386 root servers worldwide and 13 numbers from A to M. There are two root server images numbered F in Beijing, China. Each of them is I, J, and L. There are five images in total, there are five root server images in Hong Kong: A, F, I, J, and L, all of which are based on Anycast. All the root servers with the same numbers are the same IP address, the 386 root servers only use 13 IP addresses in total, so they can resist distributed denial of service (DDoS) attacks against them ).

Root Domain Name Server LIST:A-m.root-servers.net)

650) this. width = 650; "width =" 194 "height =" 214 "title =" dns.png "style =" width: 251px; height: 257px; "alt =" wKiom1LgpmuwjkANAACjjH6idLg846.jpg "src =" http://www.bkjia.com/uploads/allimg/140207/21552V4P-1.jpg "/>

When a client accesses a site through a domain name, it must have a DNS server resolved to the specified IP address before proceeding to the next step.

Access. After the client initiates an access request, first check the local host file to check whether there is a corresponding IP ing relationship.

Access through the mapped IP address directly; if not, send the request to the preferred DNS server.

Recursive queries are used between the client and the DNS server, while iterative queries are used between DNS servers.

During recursive queries, the requested DNS server is required to respond to the ing between the domain name and IP Address requested by the client;

When performing iterative queries, the requested DNS server does not necessarily have a ing relationship between domain names and IP addresses, or it can be another

The DNS server allows the client to send requests to another DNS server.

The following describes the DNS resolution process based on the instance.

The client initiates an access request www.163.com:

1. Check the local hosts file and find that there is no IP ing between www.163.com IP addresses. Send the request to the local DNS server.

---- Recursive query ----

2. The local DNS server does not contain the authoritative domain of 163.com and does not have the corresponding www record. Therefore, the request is forwarded to the root domain name server.

(If a.root-servers.net .)

3. The root DNS server will return the Server responsible for. com domain resolution (if a.gtld-servers.net.) to the local DNS server,

The local DNS server then sends the request to the.gtld-servers.net

4..com the Domain Name Server can only return the Resolution Server responsible For the 163.com domain (such as ns1.nease.net.) to the local DNS server, local

The DNS server sends the request to ns1.nease.net.

5. The ns1.nease.net. Domain Name Server Returns the IP ing relationship of www.163.com to the local DNS server.

(2-5 process) ---- iterative query ----

6. The local DNS server saves the results to the local cache, keeps the TTL time, and replies the results to the client.

---- Recursive query ---- query ends ----

7. When other clients query www.163.com from the local DNS server again, the local DNS server does not

The domain name server directly reads data from the cache and replies to the client. If the TTL time is exceeded, the local DNS

The server will go through an appeal process from 2 to 6 again.

When the local DNS server queries other servers instead of the client, the client is completelyWait Status.

There are only two types of results returned for Recursive queries: Query success or query failure.

Iterative query, also known as reguide, returns the best query point or host address.

After understanding the above principles, we can easily determine the DNS resolution failure, or even the national DNS pollution problem the day before yesterday.

After understanding the principle, you also need to know the related tools and commands: dig, nslookup, host, etc. Among them, the dig command has the most powerful and flexible functions.

Typical dig commands are shown in figure

Dig @ server name type

@ Server:Domain Name Server

Name:The domain name used to query the requested resource.

Type:Specify the query type, such as A, CNAME, SRV, MX, and SIG. If no type is specified, the default value is.

For example:

By default, DNS uses UDP for query. We use the query option to set it to TCP for query.

[shizhenning@zabbix ~]$ dig @8.8.8.8  163.com +tcp; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 163.com +tcp; (1 server found);; global options:  printcmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36041;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;163.com.                       IN      A;; ANSWER SECTION:163.com.                277     IN      A       123.58.180.8163.com.                277     IN      A       123.58.180.7;; Query time: 54 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Thu Jan 23 13:56:25 2014;; MSG SIZE  rcvd: 57

Query MX records:

[shizhenning@zabbix ~]$ dig @8.8.8.8  163.com MX; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 163.com MX; (1 server found);; global options:  printcmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41000;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;163.com.                       IN      MX;; ANSWER SECTION:163.com.                13741   IN      MX      50 163mx00.mxmail.netease.com.163.com.                13741   IN      MX      10 163mx01.mxmail.netease.com.163.com.                13741   IN      MX      10 163mx02.mxmail.netease.com.163.com.                13741   IN      MX      10 163mx03.mxmail.netease.com.;; Query time: 41 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Thu Jan 23 14:01:02 2014;; MSG SIZE  rcvd: 136

Query CNAME records:

[shizhenning@zabbix ~]$ dig @8.8.8.8  www.163.com CNAME; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 www.163.com CNAME; (1 server found);; global options:  printcmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27024;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;www.163.com.                   IN      CNAME;; ANSWER SECTION:www.163.com.            347     IN      CNAME   www.163.com.lxdns.com.;; Query time: 41 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Thu Jan 23 14:01:54 2014;; MSG SIZE  rcvd: 61

Query DRV records:

[shizhenning@zabbix ~]$ dig @8.8.8.8  163.com SRV; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 163.com SRV; (1 server found);; global options:  printcmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41227;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0;; QUESTION SECTION:;163.com.                       IN      SRV;; AUTHORITY SECTION:163.com.                1800    IN      SOA     ns4.nease.net. admin.nease.net. 20130823 7200 1800 1209600 3600;; Query time: 137 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Thu Jan 23 14:02:46 2014;; MSG SIZE  rcvd: 80

We want to query the whole process of a domain name resolution: (this is an iterative query)

[shizhenning@zabbix ~]$ dig @8.8.8.8  163.com +trace; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 163.com +trace; (1 server found);; global options:  printcmd.                       19586   IN      NS      a.root-servers.net..                       19586   IN      NS      b.root-servers.net..                       19586   IN      NS      c.root-servers.net..                       19586   IN      NS      d.root-servers.net..                       19586   IN      NS      e.root-servers.net..                       19586   IN      NS      f.root-servers.net..                       19586   IN      NS      g.root-servers.net..                       19586   IN      NS      h.root-servers.net..                       19586   IN      NS      i.root-servers.net..                       19586   IN      NS      j.root-servers.net..                       19586   IN      NS      k.root-servers.net..                       19586   IN      NS      l.root-servers.net..                       19586   IN      NS      m.root-servers.net.;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 62 mscom.                    172800  IN      NS      m.gtld-servers.net.com.                    172800  IN      NS      l.gtld-servers.net.com.                    172800  IN      NS      k.gtld-servers.net.com.                    172800  IN      NS      j.gtld-servers.net.com.                    172800  IN      NS      i.gtld-servers.net.com.                    172800  IN      NS      h.gtld-servers.net.com.                    172800  IN      NS      g.gtld-servers.net.com.                    172800  IN      NS      f.gtld-servers.net.com.                    172800  IN      NS      e.gtld-servers.net.com.                    172800  IN      NS      d.gtld-servers.net.com.                    172800  IN      NS      c.gtld-servers.net.com.                    172800  IN      NS      b.gtld-servers.net.com.                    172800  IN      NS      a.gtld-servers.net.;; Received 485 bytes from 198.41.0.4#53(a.root-servers.net) in 134 ms163.com.                172800  IN      NS      ns2.nease.net.163.com.                172800  IN      NS      ns3.nease.net.163.com.                172800  IN      NS      ns4.nease.net.163.com.                172800  IN      NS      ns5.nease.net.163.com.                172800  IN      NS      ns6.nease.net.163.com.                172800  IN      NS      ns1.nease.net.;; Received 238 bytes from 192.55.83.30#53(m.gtld-servers.net) in 137 ms163.com.                600     IN      A       123.58.180.7163.com.                600     IN      A       123.58.180.8163.com.                172800  IN      NS      ns2.nease.net.163.com.                172800  IN      NS      ns5.nease.net.163.com.                172800  IN      NS      ns6.nease.net.163.com.                172800  IN      NS      ns3.nease.net.163.com.                172800  IN      NS      ns4.nease.net.163.com.                172800  IN      NS      ns1.nease.net.;; Received 270 bytes from 114.113.197.12#53(ns2.nease.net) in 34 ms

After understanding the dig command, it is easy to troubleshoot DNS resolution faults.

Domain Name Server cache pollution is just a technology, there is no right or wrong, sometimes we need to deliberately use this technology inside the Enterprise

To meet enterprise needs. For more information about the application scenarios of DNS pollution technology in enterprises, see Introduction to the Domain Name Space Design of active directories.

This article is from "Shi zhenning's technology blog" blog, please be sure to keep this source http://magic3.blog.51cto.com/1146917/1354084