Now that we've looked at how IP addresses are used to route data, we're now going to see how name resolution works. Name resolution converts friendly computer names into IP addresses. By the end of this module, you'll be able to understand how name resolution works, and understand the purpose and operation of the DNS service. We start the module by looking at the TCP/IP model again. So far, we've covered the purpose of the protocols and the network interface and internet layers. We're still thinking about IP addresses at this stage, but we'll now think about how we find out how we get to the right IP address to connect to when we access things on the network, and this is the job of DNS. Notice DNS is in the application layer. So far, we've talked about using IP addresses to send and receive packets on networks, but do you have a favourite website? Do you know what the IP address of that website is? I'm guessing that you don't, and the reason is, you don't need to know. It would be really difficult if we had to use IP addresses when accessing things on the internet, so instead, we use nice friendly names. Of course, you do know the name of your favourite website. When we use apps on networks to get access to information, we use names to identify the system we want to connect to, for example, www.google.com. Although we tell our app the name of the thing we want to connect to, the device still needs an IP address to send our requests and information in packets, and this is where name resolution is used. Name resolution converts the name we provide in our app to the IP address needed to send packets of data.

Take, for example, if you access Google's web server in your web browsers. If you enter the name www.google.com, name resolution will convert that name into the IP address, so your device can send the packets. The slide shows the way in which a Windows computer will do this. It might be done in a slightly different way on other devices. Firstly, when you type a network address into an app, the app asks the operating system to resolve it to an IP address. Windows computers have a cache, which is an area of memory where they store names that they've already resolved, so they check that first. If the name isn't in the cache, they move on. Now, on the early days of the internet, names were resolved by using a host file. This was a file that stored the name and IP address of everything connected to the internet. Now, imagine having to look after that now. Although we don't really use host files these days, they're still supported. Windows adds anything it has in its host file to its cache, so it doesn't really need to check it, we're still showing it here, so you can understand that anything in there can still be used. If the name and IP address aren't in the host file, the device will then send a query to a DNS server. DNS is the usual way that names are resolved on the internet and DNS is the Domain Naming System. There are lots of components that make up the DNS system. It was designed around a database called the Domain Name Space. This is a hierarchical list of names which starts at the top called the root. Below the root is a list of top-level domains. These have got names representing commercial organisations, non-commercial organisations, countries, and types of businesses.

For example, com is a top-level name, and UK is a top-level name. Below the top-level domains, individuals and organisations can register names through a registrar. Now, anyone can register a name in DNS, as long as it's unique, and this is a tactic that's often used by attackers to create fake sites, or to use email addresses which look like those used by trusted companies. The name that's registered is appended to the top-level domain to form what is known as a fully qualified domain name, for example, Microsoft.com or Google.com. The DNS database contains thousands of unique, fully qualified domain names, and then, below these names, the owner can then create resource records. The most common type of resource record is a host record, and that stores the name of a host connected to the internet. Now, it would be very difficult to make sure that every host connected to the internet had a unique host name, but if we append the host name to the fully qualified domain name, we then get a fully qualified domain name for the host. For example, if Amazon called their web server www, this isn't unique on the internet, but if they use the fully qualified domain name, www.amazon.com, this is unique. So, the DNS system has a way to give everything connected to the internet a unique name.

The next challenge is where this database is going to be stored. The designers of DNS decided that the database should be split into smaller files, which are called zones. The root portion of the database is in its own zone, and each top-level of the database is also in its own, and then, each of the names below are in separate zones.

By splitting the database up into zones, it can be stored and accessed on different servers, which spreads the load. It also means different parts of the database can be managed securely by different people. DNS servers are responsible for storing zones, and they also answer the queries, when devices need to resolve names. When a DNS server stores a zone containing a particular name, it's said to be authoritative for that name. In other words, it's the server that has the answer, and DNS on the internet has more than one server storing its zone. Devices use software known as the DNS client to query DNS servers for names, to get the right IP address, and although it's not required on the internet, DNS can also be set up to resolve names from IP addresses, and this is known as reverse query. Here are some of the common resource records that resolve by DNS. A host record is the most popular, which allows DNS to convert a name into an IP address. A CNAME or Alias record is used when a computer needs to be known by more than one name. Rather than adding a separate host record for each name, an Alias record can be created which points to the host record. MX records are also important on the internet. An MX record identifies the name of servers that handle incoming mail for a given name. So, when an email server on the internet needs to send an email, it asks DNS for the MX record for the email address, to find out where to deliver the email. If you're interested, why not look up some of the others? A typical company network will have its own DNS server, so devices on that network will be set up to send their queries to that server. A recursive query is where the DNS client expects an answer.

So, in our example, the client is sending a recursive query for www.google.com. If the local sever has the zone where the name is stored, it'll simply return the answer. In this case, the local server doesn't have the answer, so what it does is sends an iterative query to another DNS server. An iterative query is where the DNS server asks for the best answer. DNS servers will either send their first iterative queries to the servers that hold the root zone, known as the root servers, or they can be set up to forward the query to a specific server. In standard DNS, the query goes to the root server. When the root server receives the query, in this case, for www.google.com, it won't have the answer. What it does know is what names are directly below and which servers store the zones for those names. So, the root server answers the query by providing the IP addresses of the servers that hold the next zone down. The local DNS server will then send a new iterative query to one of those severs. For example, to a server storing the com zone. That server will also not have the answer, but it sends back the IP address of the servers holding the next zone below. In our example, this'll be the servers that hold the zone for google.com. When the local server than sends its iterative query, it's now arrived at the server which is authoritative for the name, and that server returns the answer. The local server then returns the answer to the client. The answer given to the client is a non-authoritative answer, which means the server got it from somewhere else. DNS servers cache the answers they get. This means that if they're asked to resolve the same name more than once, it can be returned from the cache, without having to go looking for it again.

Some DNS servers are set up to be caching-only servers, which helps speed up the DNS system. Now, imagine what would happen if the DNS service on the internet stopped working. Without name resolution, the internet just wouldn't work, because everything's set up to access resources using names. There are examples of cyber attacks which have brought down parts of the DNS system on the internet. In these cases, the impact has been quite significant, and usually ends in internet services becoming unavailable. DNS can also be attacked and used to redirect devices to fake websites and malicious servers, and there have also been some examples where admins have set up DNS incorrectly. Because DNS is such an important part of networking, it needs to be both efficient and secure. It's now time for another lab session. First, you'll complete Lab 12, and in this lab, you'll set up a DNS system for the Sirius Cyberworks Network. You'll install the DNS service, and then, create a zone to resolve names that end in siriuscyberworks.co.uk You'll also set up the DNS server to forward its unresolved queries to another server. In the zone, you'll create some records and you'll test out your new DNS system. In Lab 13, you're asked to investigate some of the common tools used for testing and troubleshooting TCP/IP networks. You'll need to use our lab computer to do some research about each tool, and then, answer the questions about how they're used. To complete these labs, you'll need to enter the access code. The code is 97849.

Module 3: Name resolution

About