Introduction to DNS query process and DNS Process

Introduction to DNS query process and DNS Process

Reprinted please indicate the source: http://blog.csdn.net/luotuo44/article/details/45545059

DNS (domain name system) is a system that can convert domain names to IP addresses. This allows us to access a website simply by remembering the domain name rather than the IP address. When we enter a URL in the browser, the browser sends a query request to the local DNS server, and the local DNS server returns the IP address of the URL to the browser. Note: more specifically, it is not a local DNS server, but a DNS server configured in a Windows network connection. Generally, we do not configure it. Therefore, this document uses the local DNS server by default.

In addition to the browser, we can also query the IP address of a website through command line. For example, use the nslookup command. You can use the nslookup command to query the IP address of www.weibo.com on Alibaba's public DNS server 223.5.5.5. The final query result is 121.194.0.221.

From the above descriptions and command usage, we can know that the participants from the domain name to the IP address are: DNS Client (browser or nslookup command); DNS server (local DNS server or Alibaba public server ). In fact, another participant is hidden: name server ). There are three participants: DNS Client (domain name systemclient), DNS server (domain name system server), and name server ).

What is the use of name server? What is the difference between it and DNS? To understand this, we must first solve a problem. How does Alibaba public DNS know the Weibo IP address? It remembers, but it does remember (the returned response is a non-authoritative response, which indicates that it is remembered ). But it cannot remember the IP addresses of all websites around the world. What should a user do when querying a website that is not remembered? If we do not know the IP address of a website, we can turn to the DNS server. What about the DNS server? Hey.

You may have heard that DNS is layered. If you do not know it, You can query it at the upper layer. DNS is indeed layered, and there are 13 root name servers around the world ). If Alibaba's public DNS does not know the IP address of a website, it must ask the Root Domain Name Server (or not the Root Domain Name Server. However, the root domain name server cannot record the IP addresses of all web sites around the world (IPv4 may be a bit more likely, but IPv6 may not ). What should I do if the root domain name server does not know the IP address of a website? In fact, although the Root Domain Name Server cannot tell you the IP address of a website, it will provide very useful information to the queryer (that is, Alibaba public DNS server or local DNS server ).

Before continuing to explain the query, we should first introduce the concept of domain because the website address is governed by domain. Domain Name Systems are hierarchical, just like the file directories we normally use. First, it is the root, then the top-level domain (first-level domain), followed by second-level domain, third-level domain ,....... Well-known top-level domains include com, net, org, and cn. The parent domain assigns an identifier (such as cn) to the subdomain. Then, the subdomain cn is solely responsible for the specific allocation of the second-level domains under cn. For cn, well-known second-level domains include com.cn and edu.cn. Of course, edu.cn will be responsible for the allocation of its third-level domain names (for example, one for each university ). One advantage of such layering is convenient management. Is an example of a DNS hierarchy.

Figure 2-5 from DNS and BIND

In addition to domain, there is also an important concept area (zone ). Assume that A is A domain and a has subdomains A and B. If the administrator of domain A authorizes a and B to another person for management, a and B form A zone respectively ). That is to say, from the perspective of A, a and B are zones, but if we only look at a or B, it is A domain. Similar to the tree, a child node of the tree itself is also a tree. The following figure illustrates this point:

Figure from DNS and BIND

Each region has a name server [1] to manage this region. Management includes dividing this domain into smaller subdomains and IP resolution of subdomains (that is, converting a domain name to an IP address ). For a region, the name server of the region is the authority of the region. The Authority can think as follows: the domain name-to-IP translation result provided by the name server in this region is authoritative (in addition to the domain name-to-IP conversion, there are other conversions ).

You can use the nslookup command to query the name server of a region or host, as shown in. -Qt = ns indicates that the type to be queried is name server, and 223.5.5.5 indicates Alibaba's public DNS server.

As you can see, the region (zone) qq.com name server is ns [1-4] .qq.com, and the host www.qq.com is ns-tell.qq.com.

Note that the region and domain are both a range rather than a host. For example, qq.com is not a host, while the host name of qq's Web server is www.qq.com, and v.qq.com is the host name of the video server.

 

With the above introduction, it is much easier to explain the DNS query process to clarify what physical entities exist in DNS.

Use Alibaba 223.5.5.5 as the DNS server to query the IP address of www.qq.com. Assume that the cache of Alibaba DNS server does not contain any records related to www.qq.com during the query.

223.5.5.5 keeps a backup in its own cache, so there are two types of answers: authoritative response and non-authoritative response. If 223.5.5.5 directly reads the returned results from its own cache, it is an unauthoritative response. If the result is obtained from the authoritative name server of the domain name itself, it is the authoritative response.

It is the flowchart of the DNS query Process in "DNS and BIND:

The parser in the figure is equivalent to the browser or nslookup program in the PC. The name server on the left is equivalent to a local DNS server or an Alibaba public DNS server.

Note: each time the Alibaba public DNS server sends a query, the content of the request is www.qq.com, rather than a part of it. This is also shown. This is because www.qq.com is included in the cache of a name server on the way. If you only query qq.com, you may miss [2].

 

It should be noted that there are two types of DNS queries: recursive query and iterative Query [3]. The preceding example shows recursive query. The local DNS server or Alibaba public DNS server in this article completes most tasks. The original query author only needs to wait for the results. In iterative query, if a domain name is queried in the cache of the local DNS server or public DNS server, return the domain name. If no, the name server on the right will tell the query initiator "you can check it there". Of course, an error message can be returned directly.

Recursive query makes it impossible to observe the entire process. In this case, you can use the dig command and use the + trace command to forcibly use iterative query to view the entire process. Shows the entire process. Es New Roman "; mso-bidi-theme-font: minor-bidi; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: AR-SA '> a and B are zones, but if you only look at a or B, then it is a domain again. Similar to the tree, a child node of the tree itself is also a tree. The following figure shows this (@ 223.5.5.5 indicates using Alibaba public DNS ):

 

Refer:

[1] http://en.wikipedia.org/wiki/Name_server#Authoritative_name_server

[2] DNS and BIND, 5th, page 32

[3] http://en.wikipedia.org/wiki/Domain_Name_System#DNS_resolvers