DNS: Not just for network nerds any more!

As recently as ten years ago, the inner workings of the Internet remained a mystery for all but the most foolhardy of people.    Fast forward today, and almost everyone has a mobile phone with Internet connectivity, a blog, a Facebook page, and maybe a dedicated website for themselves and family.

Along with any new technology comes the frustration when something doesn’t work right.  The Internet has become prevalent in nearly everything we do (who watches the Weather Channel now?  Anyone?) and is, in fact, a part of everyday life.   So then, a general understanding of “how things work” isn’t such a bad idea.   After all, you probably know how to check the oil on your car or truck–certainly fill it up with gas–even though you may not understand how the rest of the engine works.

Getting Started with DiG

Being that DNS is involved in nearly every bit of communication on the Internet, it’s a great place to start troubleshooting.   If a web site doesn’t come up, is it because that server is down?  Or is your DNS acting up…maybe theirs?   Well read on!  We’ll show you how to find out.

The primary tool to use in troubleshooting DNS is called DiG, short for the “DNS Information Groper” (seriously).  It is part of the BIND DNS Server software package.   Other than the slightly wonky name, its use as an investigative DNS tool is invaluable.   If you are using an Apple Mac or some type of Linux/Unix variant, DiG is likely already installed (on a Mac, open the Terminal to use it).   If you’re on a Windows host, you can download DiG for Windows, which is roughly the same tool compiled for the Microsoft platform.

Lets fire up dig and perform a quick query to determine if it’s working.   Open up your terminal or command line box, and type the following:

dig google.com. NS

After a very short period of time, you should get results which look similar to the following:

[bdowney@tlfmgt1 ~]$ dig google.com NS

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> google.com NS
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52302
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.            IN    NS

;; ANSWER SECTION:
google.com.        172781    IN    NS    ns2.google.com.
google.com.        172781    IN    NS    ns1.google.com.
google.com.        172781    IN    NS    ns3.google.com.
google.com.        172781    IN    NS    ns4.google.com.

;; Query time: 0 msec
;; SERVER: 172.16.65.90#53(172.16.65.90)
;; WHEN: Tue Sep 13 12:48:38 2011
;; MSG SIZE  rcvd: 100

So what exactly is this telling us?   First, the header shows the DiG version, as well as some basic information.   Above, the header  shows that we performed a Query, there was No Error, as well as your query’s ID.   Furthermore, it shows the flags passed to DiG when it was run (the ones printed are the default),  and finally the enumeration of queries and results returned.   In this case, we sent one query: NS, (“Give me the DNS servers for google.com”) and it returned four distinct answers  (ns1, 2, 3, and 4.google.com).  Finally the bottom portion shows how long the query took (pretty fast in our case!) as well as the DNS server that it obtained the information from.

In our next post, we’ll show you how to use dig to look up different types of DNS “records”, some of which will let you even troubleshoot email problems.

DNS In a Nutshell

The Domain Name System (DNS) is simply a Internet-wide database for associating friendly domain names (example.com) to an IP addresses (1.2.3.4). Over time, other functions such as Domain Keys and SPF for Spam prevention have burdened DNS with a few more responsibilities–but none have fundamentally changed its primary purpose or how the system works.

The Players

To understand the DNS process one must understand the parts involved, and fortunately DNS only has a few.  On the Internet, the DNS system can most generally be segmented into three major parts:

1. Your computer.
2. The Root DNS Servers.
3. All other DNS Servers.

A few important things regarding domain names you should know…

1. The period, or “dot” in domain names is a symbolic character representing a change of authority.  For instance, one server may be responsible for the DNS database containing tlfhosting.com., and yet another might be responsible for linuxrocks.tlfhosting.com. Each time a period is seen by your computer, it knows it has to ask a server for more information.   It could be the same server, or a different one–but it is required to ask nonetheless.
2. Your computer actually “reads” domain names from right-to-left (backwards of how english is read).  Why?  It’s simply trade-off between readability by people and a logical hierarchy that computers need.   Things wouldn’t make much sense to people if we typed .com.tlfhosting.www after all.  It just looks strange, because we read things from left to right.   Yet because of how DNS is structured, your computer needs to read it that way.
3. Every domain name actually has a trailing period.  Notice how we’ve been typing “tlfhosting.com.”?  That’s actually the correct way to type it.  In fact, open a new window in your browser and type www.thelinuxfix.com. (with the trailing period).  Next try www.google.com., or any other domain for that matter.  Normally it isn’t needed, but only becase most software ‘types’ the trailing period for you automatically.  But why the trailing period?  Think of it in context of items #1 and #2 above, and it begins to make sense.

Let’s take a quick look at one of our own second-level domains (we’ll help explain that term in a moment): tlfhosting.com.   Let’s say you’d like to connect to www.tlfhosting.com. to do something–could be a website, telnet, FTP, or anything.  The important point is that to do anything your computer first needs the IP address of www.tlfhosting.com., since it cannot do a single thing with english words!

The Root Servers and TLDs

To get things started, we’ll have to talk about that all-important trailing dot on “www.tlfhosting.com.”

Remember point #2 above.  The first thing your computer sees when trying to translate the domain name is a period (.).  Because of that, it knows a domain is coming next so it will need to ask a DNS server about it.

But wait, which server?  How is it supposed to know where to look if it’s just getting started?

This is where the Root Servers come in.   The Root Servers are represented by the trailing period (.) in google.com. and tlfhosting.com., or any domain for that matter.

As you’ve probably figured out, the Root Servers are then responsible for all top-level-domains (or “TLDs”), such as “net.”, “org.”, “edu.”, and so forth.  They’re called top-level simply because all other domains (like tlfhosting) are under their authority.   So these things are not only busy–they’re very, very important to the operation of the entire Internet!

The Root Servers don’t change much at all.  In fact, most computers are already hard-wired in a programming sense to know who to ask about “com”, “net”, or any of the other TLDs.  In fact, every computer that asks something about any domain name on the Internet at some point or another asked the Root Servers a question. As you can imagine, these are busy little servers.

Now hopefully the term “Second-Level-Domain” should begin to make more sense as well.   If “.com” is a top-level domain, then logically tlfhosting.com is a second-level domain, and thus subdomain.tlfhosting.com would be a third-level domain.  It just goes right-to-left as we were talking about.  Easy as pie!

Keep an eye out for part 2, where we’ll discuss the exact process a computer follows to determine the IP address of any domain.