DNS

Lesson 7: DNS

DNS stands for Domain Name System.
It is one of the most important services used on modern computer
networks and the Internet.

When a user enters a domain such as
example.com into a browser, computers do not normally
use the domain name itself to establish the network connection.
The domain must be resolved into an IP address or other DNS information.

DNS performs this translation and also provides information about
services such as email servers, authoritative name servers, aliases,
and reverse address mappings.

1. Why DNS Is Important

Imagine having to remember an IP address every time you wanted to
visit a website. Instead of remembering a domain name such as
example.com, users would have to remember numerical
addresses.

DNS provides a human-friendly naming system that connects names with
network information.

DNS is important because it:

• Translates domain names into IP addresses.
• Helps applications locate network services.
• Supports email delivery.
• Supports reverse IP address lookups.
• Allows organizations to manage domain-based services.
• Provides useful information for security monitoring.

2. Domain Names and IP Addresses

A domain name is a human-readable name used to identify an Internet
resource or service.

Examples include:

• example.com
• www.example.com
• mail.example.com

An IP address identifies a network interface or destination at the
network layer.

For example:

example.com
        |
        v
203.0.113.25

The DNS system can provide the IP address associated with the requested
domain.

3. The DNS Hierarchy

DNS is organized as a hierarchical naming system rather than one giant
database.

The major levels include:

1. Root DNS servers
2. Top-Level Domain (TLD) servers
3. Authoritative name servers

Root Servers

The DNS root is at the top of the hierarchy. Root servers help direct
queries toward the appropriate Top-Level Domain servers.

Top-Level Domain Servers

TLD servers are responsible for domains under extensions such as:

• .com
• .org
• .net
• .ng
• .edu

Authoritative Name Servers

Authoritative DNS servers contain the DNS information for a domain or
zone and provide authoritative answers for records they manage.

4. Recursive DNS Resolvers

A client does not always communicate directly with an authoritative
DNS server.

Instead, the client commonly sends its query to a
recursive DNS resolver.

The resolver performs the work required to obtain an answer and then
returns the result to the client.

A simplified process is:

Client
   |
   v
Recursive Resolver
   |
   v
Root Server
   |
   v
TLD Server
   |
   v
Authoritative Server
   |
   v
DNS Answer

5. DNS Resolution Process

Consider a user visiting:

www.example.com

A simplified resolution process is:

1. The browser or operating system checks available DNS information.
2. If an appropriate cached answer is available, it may be reused.
3. If necessary, the client sends a query to its configured DNS resolver.
4. The recursive resolver searches for the answer.
5. The resolver may contact root, TLD, and authoritative servers.
6. The authoritative server provides the appropriate DNS record.
7. The resolver returns the answer to the client.
8. The client uses the resulting address to communicate with the destination.

6. Common DNS Record Types

Different DNS records provide different types of information.

7. A Records

An A record maps a hostname to an IPv4 address.

www.example.com  →  203.0.113.25

A records are commonly used when an application needs to determine
the IPv4 destination associated with a hostname.

8. AAAA Records

An AAAA record performs a similar function for IPv6.

www.example.com  →  2001:db8::25

IPv6 uses 128-bit addresses, so AAAA records allow DNS to provide
IPv6 destination information.

9. CNAME Records

A CNAME record creates an alias from one hostname
to another hostname.

For example:

blog.example.com
        |
        v
web.example.com

This allows multiple hostnames to reference another DNS name without
having to duplicate the underlying hostname relationship.

10. MX Records

MX means Mail Exchange.

MX records identify mail servers responsible for receiving email for
a domain.

example.com
      |
      +---- MX ----> mail.example.com

MX records normally include a preference value that helps determine
which mail server should be attempted first.

11. NS Records

NS records identify the name servers responsible for
a DNS zone.

They are important when determining which authoritative servers
should answer questions about a domain.

12. TXT Records

TXT records can contain text information associated with a domain.

They are commonly used for domain verification and email security
technologies such as SPF-related policies and other verification
mechanisms.

Security professionals should understand that TXT records can reveal
useful information about an organization’s services and configurations.

13. PTR Records and Reverse DNS

A normal DNS lookup can be described as:

Domain Name → IP Address

A reverse lookup works in the opposite direction:

IP Address → Domain Name

PTR records are used for reverse DNS mappings.

Reverse DNS information can be useful during investigations, although
a reverse lookup does not automatically prove that a particular
organization or person owns an IP address.

14. DNS Caching and TTL

DNS answers are commonly cached to reduce unnecessary queries and
improve performance.

TTL means Time To Live.
It specifies how long a DNS result may normally remain cached before
it should be refreshed.

For example:

TTL: 3600 seconds

A TTL of 3600 seconds represents one hour.

Lower TTL values can allow DNS changes to become visible sooner,
while longer TTL values can reduce repeated DNS queries.

15. Recursive and Iterative Queries

Recursive Query

In a recursive query, the requesting client expects the resolver to
obtain the final answer or report that the answer could not be found.

Iterative Query

In an iterative process, a DNS server can respond with the best
information it currently has, such as a referral to another server.

Understanding the difference helps security students understand how
DNS resolution moves through the hierarchy.

16. DNS Ports and Transport

DNS commonly uses:

• UDP port 53 for many ordinary DNS queries.
• TCP port 53 for operations that require TCP, including certain larger responses and DNS zone transfers.

Modern encrypted DNS technologies can use different transport ports.

• DNS over TLS (DoT) commonly uses TCP port 853.
• DNS over HTTPS (DoH) uses HTTPS, commonly through TCP port 443.

17. DNS Security Risks

DNS is critical infrastructure, so attackers may attempt to manipulate
or abuse it.

DNS Spoofing

DNS spoofing involves providing false DNS information so that a user
or system is directed to an unintended destination.

DNS Cache Poisoning

Cache poisoning attempts to place incorrect DNS information into a
resolver’s cache.

Malicious Domains

Attackers can register or compromise domains used for phishing,
malware distribution, command-and-control infrastructure, or other
malicious activities.

DNS Tunneling

DNS can sometimes be abused to carry data through DNS queries and
responses. This technique is known as DNS tunneling.

Security teams may detect suspicious DNS tunneling by examining query
frequency, domain characteristics, query lengths, unusual subdomains,
and other network indicators.

Fast-Flux Infrastructure

Some malicious infrastructures rapidly change the IP addresses
associated with domain names. This can make infrastructure analysis
more difficult.

18. DNSSEC

DNSSEC means Domain Name System Security
Extensions.

DNSSEC adds cryptographic mechanisms that help validate the authenticity
and integrity of DNS data.

The goal is to allow a resolver to determine whether DNS information
has been properly signed within the DNSSEC chain of trust.

DNSSEC does not mean that all communication with a website is encrypted.
For example, HTTPS is still responsible for protecting web traffic
at the application level.

19. DNS over TLS and DNS over HTTPS

DNS over TLS

DNS over TLS encrypts DNS communication using TLS.
It commonly operates through TCP port 853.

DNS over HTTPS

DNS over HTTPS sends DNS queries through HTTPS.
It commonly uses port 443.

Encrypted DNS can reduce the ability of ordinary network observers
to read DNS requests directly, although it does not make a user
anonymous or eliminate all forms of network monitoring.

20. DNS and Cybersecurity Monitoring

DNS information can be extremely valuable during security monitoring.

Security teams may monitor:

• Requested domains.
• Query frequency.
• Unusual domain names.
• Newly observed domains.
• High-volume DNS activity.
• Requests to known malicious infrastructure.
• Unexpected DNS servers.
• Abnormal TXT or other record usage.
• Repeated failed lookups.

DNS information becomes more useful when combined with endpoint,
firewall, proxy, authentication, and other security logs.

21. DNS Troubleshooting Commands

Windows — nslookup

nslookup example.com

This performs a basic DNS lookup.

Windows — Resolve-DnsName

Resolve-DnsName example.com

Linux — dig

dig example.com

To request an A record:

dig example.com A

To request MX records:

dig example.com MX

Linux — host

host example.com

These tools are useful for troubleshooting and authorized security
investigations.

22. Example DNS Investigation

Suppose a security analyst discovers that a workstation has repeatedly
connected to an unfamiliar domain.

The analyst could investigate:

1. Which domain was requested?
2. What IP address did DNS return?
3. Which DNS server answered the request?
4. How frequently was the domain queried?
5. Was the domain recently created or newly observed?
6. What other systems queried the same domain?
7. What process generated the request?
8. Was there related network or endpoint activity?

A DNS record alone does not prove that a domain is malicious.
Investigators should correlate multiple pieces of evidence before
drawing conclusions.

23. DNS in Web Applications

Web applications can also perform DNS lookups.
PHP provides functions such as
dns_get_record() that can retrieve DNS information.

Example:

<?php

$domain = 'example.com';

$records = dns_get_record(
    $domain,
    DNS_A | DNS_AAAA | DNS_MX | DNS_CNAME
);

if ( $records === false ) {

    echo 'DNS lookup failed.';

} else {

    foreach ( $records as $record ) {

        $type = isset( $record['type'] )
            ? $record['type']
            : 'UNKNOWN';

        $value = '';

        if ( isset( $record['ip'] ) ) {
            $value = $record['ip'];

        } elseif ( isset( $record['ipv6'] ) ) {
            $value = $record['ipv6'];

        } elseif ( isset( $record['target'] ) ) {
            $value = $record['target'];

        } elseif ( isset( $record['host'] ) ) {
            $value = $record['host'];
        }

        echo htmlspecialchars(
            $type . ': ' . $value,
            ENT_QUOTES,
            'UTF-8'
        );

        echo '<br>';
    }
}
?>

The example retrieves selected DNS records and uses
htmlspecialchars() before displaying values in HTML.

24. DNS Security Best Practices

• Use trusted and properly configured DNS resolvers.
• Keep DNS server software updated.
• Restrict unauthorized DNS zone transfers.
• Monitor unusual DNS traffic.
• Use DNSSEC where appropriate.
• Protect DNS administration accounts.
• Monitor changes to important DNS records.
• Use appropriate network segmentation.
• Investigate suspicious DNS patterns.
• Maintain accurate DNS logs.

25. Practical Cybersecurity Exercise

Perform this exercise only on a system or network that you own or have
explicit permission to investigate.

Exercise A — Basic DNS Lookup

Run:

nslookup example.com

Record:

• The DNS server used.
• The returned IP address.
• Any additional information displayed.

Exercise B — DNS Record Investigation

If you have access to Linux and dig, run:

dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com NS
dig example.com TXT

Compare the different record types and explain the purpose of each.

Exercise C — Reverse Lookup

Use a known IP address from an authorized environment and perform a
reverse lookup.

nslookup 8.8.8.8

Explain the difference between the forward and reverse lookup.

26. DNS Investigation Questions

1. What does DNS stand for?
2. Why do computers use DNS?
3. What is the difference between an IP address and a domain name?
4. What is a recursive DNS resolver?
5. What is the role of an authoritative DNS server?
6. What does an A record contain?
7. What is the purpose of an AAAA record?
8. What is a CNAME record?
9. What is the purpose of an MX record?
10. What does a PTR record support?
11. What does TTL mean in DNS?
12. What port is commonly associated with traditional DNS?
13. What is DNSSEC?
14. What is DNS tunneling?
15. How can DNS logs help a security analyst?

27. Key Takeaways

• DNS is the naming system that connects domain names with network information.
• DNS operates through a hierarchical system.
• Recursive resolvers obtain answers for clients.
• Authoritative servers provide authoritative information for DNS zones.
• A and AAAA records provide IPv4 and IPv6 address mappings.
• CNAME, MX, NS, TXT, PTR, SOA, and SRV records serve different purposes.
• DNS caching improves performance and relies on TTL values.
• DNS commonly uses UDP 53 and can also use TCP 53.
• DoT and DoH provide encrypted DNS transport.
• Attackers can abuse DNS through spoofing, cache poisoning, malicious domains, tunneling, and other techniques.
• DNSSEC provides cryptographic validation for DNS data.
• DNS logs are useful sources of cybersecurity evidence.
• DNS investigation should always be performed within authorized scope.

28. Lesson Summary

DNS is one of the foundational technologies behind modern networking
and cybersecurity. It allows users and applications to work with
human-readable names while network communication relies on addresses
and service information.

For cybersecurity professionals, DNS is more than a system for opening
websites. DNS records, queries, responses, caches, and logs can reveal
important information about network activity.

Understanding DNS therefore provides students with a foundation for
network troubleshooting, security monitoring, threat detection,
incident investigation, and secure infrastructure management.