DNS Deep Dive

How a name becomes an address: the resolvers and servers a lookup passes through, records and TTLs, steering traffic with DNS and where that stops working, message sizes, and how DNS is attacked and protected.

Overview

The Domain Name System (DNS) turns a name such as www.example.com into what a computer needs to reach it, most often an IP address. It is a distributed database: no single server holds every name. The work is split along the dots in a name. The root servers know who runs each top-level domain such as .com, the .com servers know who runs example.com, and example.com's own servers hold its records.

Almost every request in a design starts with a DNS lookup, and DNS is also a tool for steering traffic. It can send users to a nearby region, move a share of traffic to a new version, or stop sending anyone to a region that has failed. Answers are cached everywhere, which makes DNS fast and cheap to run, but it also means a change reaches users only as the old cached copies run out.

The Fundamentals chapter showed DNS as the first hop of a request. This chapter opens that box. The facts come from the RFCs that define DNS, root-servers.org, and the documentation of the services named.

What you will be able to do

  • Walk through a lookup from the app to the authoritative server, and say where each answer is cached and for how long.
  • Choose record types and TTLs, and explain why a CNAME cannot sit at the zone apex and what to use instead.
  • Plan an address change or a failover, and estimate how long it takes to reach everyone.
  • Explain what DNS-based steering can and cannot do, including the resolver-location problem and EDNS Client Subnet.
  • Explain cache poisoning, DNSSEC, encrypted DNS and amplification attacks, and what each defense leaves open.

Key concepts

  • Stub and recursive resolvers
  • Root, TLD and authoritative servers
  • Record types
  • CNAME at the apex
  • TTL and negative caching
  • Weighted, geo and latency routing
  • Health-checked failover
  • Anycast
  • EDNS Client Subnet
  • DNSSEC and encrypted DNS

Interview questions

  • Walk through what happens when a browser looks up www.example.com for the first time.
  • Why can't you put a CNAME at the zone apex, and what do you do instead?
  • You changed an A record an hour ago, but some users still reach the old server. Why, and how would you do it next time?
  • How would you use DNS to fail over from one region to another, and how long would it take?
  • What are the limits of DNS-based load balancing?
  • What is negative caching, and how can it cause an outage?
  • How does DNS cache poisoning work, and what stops it?
  • What is the difference between DNSSEC and DNS over HTTPS?
  • How does a DNS amplification attack work, and how would you protect your DNS servers?
  • Why does DNS use UDP, and when does it switch to TCP?

Sign up free to read the full topic

More System Design topics

Start free on Cariara · Coding problems · System design studio