Domain Name System (DNS)

From InboxSys document library
Jump to navigation Jump to search

The Domain Name System is a naming system for the internet. It was originally invented to assign names to IPs, because names are more easy to remember than the numbers in IP addresses. meanwhile, DNS has more purposes than to translate names in numbers only.


DNS is a hierarchical system. On top of the hierarchy-stryucture of a domain name is the toplevel domain (TLD). Examples of toplevel domains are "com", "net", "org", "nl", "berlin" and many more. TLDs are provided by IANA.

In the example "", "com" is the toplevel domain and "example" is the second level domain (SLD) or public suffix domain (PSD). The PSD is also called "organisational domain".

SLD and PSD are not exactly the same thing, because some toplevel domains have a second-level domain included in their hierarchy. One famous example is "".

  • In "", "uk" is the TLD, "co" is the SLD and "example" is the PSD.
  • In "", the TLD is "com" and "example" is the SLD/PSD.

The responsible domain is the domain that's on top of a zone. Any responsible domain can have almost infinite subdomains. In our example "", "" is the responsible domain and "sub" is the subdomain. In "", "" is the responsible domain for all subdomain levels. However, if I create a separate zone for "", then "" is a responsible domain on top of it's own hierarchy (see also #Domain delegation).

Record types

There are various types of records with a variety of functions. The most important ones are:

DNS Record Types
Name Purpose Lookup result example
A Assigns an IPv4 address to a name
$ host -t a has address
AAAA Assigns an IPv6 address to a name
host -t aaaa has IPv6 address fe80::1ff:fe23:4567:890a
MX Assigns mail-receiving hostnames with priorities to a name
$ host -t mx mail is handled by 10 mail is handled by 5
CNAME Causes this domain to be an alias of another domain
$ host -t cname is an alias for
TXT Holds a piece of text
$ host -t txt descriptive text "lorem ipsum"
PTR Reverse DNS assigns a name to an IP
$ host -t ptr domain name pointer
NS Delegates a subdomain to one or more nameservers
$ host -t ns name server name server

A- and AAAA-Record

Those two record types assign IPs to domain names. For example, if my domain name is "" and my website is hosted at "", I need to set an A-Record with the content "" on "".


MX Records assign mail servers (MTAs) to a domain. MX records consist of a domain name and a priority:

  • The domain name should contain an A and/or AAAA record with the IP address of the MTA.
  • The priority is used to prioritise one MTA over another. In the above example, "" has the lowest priority (5) and will be tried first. Only if "" is unavailable, "" is used. When multiple domains in an MX record have the same priority, a random choice is made (round robin).

CNAME Record

CNAME records are aliases. Let's stick with the example from the above table and "" is an alias of "", as you can see from the CNAME record. If we now first query the A-Records and then the MX records for "", this will be the output:

$ host is an alias for has address has IPv6 address fe80::1ff:fe23:4567:890a

$ host -t mx is an alias for mail is handled by 10 mail is handled by 5

A CNAME record ona domain renders A-, MX- and TXT-records on the same domain invalid. In fact, it's recommended to remove all other records once a CNAME record is available.

Common use cases for CNAME records are:

In both use cases, domain delegation could offer a much better solution.

TXT Record

TXT records are records that can hold various pieces of text. The most common use case is for domain verification, whereby a provider provides a code and when this code is later found in a DNS TXT record, domain ownership has been verified. Common use cases in E-Mail are:

SPF records

Main article: Sender Policy Framework (SPF)


$ host -t txt descriptive text "v=spf1 ip4: ip6:fe80::1ff:fe23:4567:890a ~all"

DKIM records

Main article: DomainKeys Identified Mail (DKIM)


host -t txt descriptive text "v=DKIM1; t=s; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0vuPa8g6qdfYLi9TWfbMzFoijdNfJC6/a0uGfIj6fOr+z1fJlOsM1DhKaEaSkNeI0ClKjLx9648CfMl02TxViTvG1Ne2sDsFvGc53NzEd65I2BsPuLpBsHo5zXbZ1ZvLhFm+iOjXlPnD1WlOeQuDhFdIdR+1lWt5aExNwBvIqBr+nYfJt094h9fUwXxMpJ+75GtBdAo3j2nOlWlZtCkWnDmCsXd0j6nNrHz0fO8VqCcJmQsP1ThUgBlO7T3L4PiVg1yHbDpKyTgVb6zHpYt/cXiKmIxVn6nQoDxL9ZfQ2EmVi7hUfMcSoFpWdIpYuOnMmPgPk47J+YZjv4N2X6UpSQIDAQAB"

DMARC records

Main article: Domain-based Message Authentication, Reporting, and Conformance (DMARC)


$ host -t txt descriptive text "v=DMARC1; p=reject;;; rf=afrf; pct=100;"

PTR Record

The reverse lookup is meant to find a name to an IP, instead of the other way around. Because it's not possible to create a DNS zone with an IP, an alias (canonical name) is used for each IP. This alias always has the TLD "arpa", which is reserved for this purpose. IPv4 uses "" and IPv6 uses "".

Each sending IP should resolve recursively to a domain. This domain is the "hostname". Each hostname should resolve to an IP. This IP should be the same sending IP we started from.

Example from Gmail with sending IP 2a00:1450:4864:20::632:

$ host -t ptr 2a00:1450:4864:20::632 domain name pointer

$ host -t aaaa has IPv6 address 2a00:1450:4864:20::632

NS Record

Nameserver records are found on responsible domains. They define which nameserver stores the zone file with resource records for this domain.

Domain delegation

If you create an NS record for a subdomain, this subdomain now is responsible for it's own zone, on top of it's own hierarchy. What used to be a subdomain, is now a responsible domain.

Because of that, with DNS delegation it's possible for - for example - Jake's nameservers (dns[1|2] to host the zone for "", while Andrew's nameservers (dns[1|2] host the zone for "". While Jake still owns "" and all its subdomains, Andrew is now the only person who can set resource records for the subdomain "", until Jake revokes the delegation by removing the NS records from the subdomain.

Useful links