PAGE INDEX

TOPIC

PAGE NO.

1.

INTRODUCTION

4

2.

DNS HISTORY

9

3.

DNS FEATURES

11

4.

DNS NAME HIERARCHY

14

5.

TYPES OF NAME SERVERS

16

6.

ACCESSING A WEB PAGE

20

7.

SENDING A EMAIL

26

8.

TYPE OF DNS QUERIES

30

9.

DNS CACHING

34

10.

DOMAIN NAME REGISTRATION

35

11.

SECURITY ISSUES

37

12.

DNS RESOURCE RECORDS

42

13.

DNS CONCERNS

46

14.

CONCLUSION

49

15.

REFERENCES

50

INTRODUCTION

The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide. An often-used analogy to explain the Domain Name System is that it serves as the "phone book" for the Internet by translating human-friendly computer hostnames into IP addresses. For example, www.example.com translates to 192.0.32.10.

The Domain Name System makes it possible to assign domain names to groups of Internet users in a meaningful way, independent of each user's physical location. Because of this, World Wide Web (WWW) hyperlinks and Internet contact information can remain consistent and constant even if the current Internet routing arrangements change or the participant uses a mobile device. Internet domain names are easier to remember than IP addresses such as 208.77.188.166 (IPv4) or 2001:db8:1f70::999:de8:7648:6e8 (IPv6). People take advantage of this when they recite meaningful URLs and e-mail addresses without having to know how the machine will actually locate them.

The Domain Name System distributes the responsibility of assigning domain names and mapping those names to IP addresses by designating authoritative name servers for each domain. Authoritative name servers are assigned to be responsible for their particular domains, and in turn can assign other authoritative name servers for their sub-domains. This mechanism has made the DNS distributed and fault tolerant and has helped avoid the need for a single central register to be continually consulted and updated.

In general, the Domain Name System also stores other types of information, such as the list of mail servers that accept email for a given Internet domain. By providing a worldwide, distributed keyword-based redirection service, the Domain Name System is an essential component of the functionality of the Internet.

DNS HISTORY

The practice of using a name as a humanly more meaningful abstraction of a host's numerical address on the network dates back to the ARPANET era. Before the DNS was invented in 1983, each computer on the network retrieved a file called HOSTS.TXT from a computer at SRI (now SRI International). The HOSTS.TXT file mapped names to numerical addresses. A hosts file still exists on most modern operating systems, either by default or through explicit configuration. Many operating systems use name resolution logic that allows the administrator to configure selection priorities for available DNS resolution methods.

The rapid growth of the network required a scalable system that recorded a change in a host's address in one place only. Other hosts would learn about the change dynamically through a notification system, thus completing a globally accessible network of all hosts' names and their associated IP addresses.

At the request of Jon Postel, Paul Mockapetris invented the Domain Name System in 1983 and wrote the first implementation. The original specifications appeared in RFC 882 and RFC 883 which were superseded in November 1987 by RFC 1034 and RFC 1035. Several additional Request for Comments have proposed various extensions to the core DNS protocols.

In 1984, four Berkeley students—Douglas Terry, Mark Painter, David Riggle and Songnian Zhou—wrote the first UNIX implementation, which was maintained by Ralph Campbell thereafter. In 1985, Kevin Dunlap of DEC significantly re-wrote the DNS implementation and renamed it BIND—Berkeley Internet Name Domain. Mike Karels, Phil Almquist and Paul Vixie have maintained BIND since then. BIND was ported to the Windows NT platform in the early 1990s.

BIND was widely distributed, especially on Unix systems, and is the dominant DNS software in use on the Internet. With the heavy use and resulting scrutiny of its open-source code, as well as increasingly more sophisticated attack methods, many security flaws were discovered in BIND. This contributed to the development of a number of alternative nameserver and resolver programs. BIND itself was re-written from scratch in version 9, which has a security record comparable to other modern Internet software.

The DNS protocol was developed and defined in the early 1980s and published by the Internet Engineering Task Force.

DNS FEATURES

  1. DNS is a Database:

  1. Global Distribution:

  1. Loose Coherency:

  1. Scalability:

  1. Reliability:

  1. Dynamic Updates:

DNS Name Hierarchy

TYPES OF NAME SERVERS

  1. ROOT NAME SERVERS:

  1. Top-level domain (TLD) servers:

com

Commercial organizations

edu

Educational institutions

gov

Government institutions

int

International organizations

mil

U.S. military institutions

net

Networking organizations

org

Non-profit organizations

  1. Authoritative DNS servers:

  1. Local Name Server:

Accessing a web page

Step 1: Your PC sends a resolution request to its configured DNS Server, typically at your ISP.

Step 2: Your ISPs recursive name server starts by asking one of the root servers predefined in its “hints” file.

Step 3: Your ISPs recursive name server then asks one of the “com” name servers as directed.

Step 4: Your ISPs recursive name server then asks one of the “google.com” name servers as directed.

Step 5: ISP DNS server then send the answer back to your PC. The DNS server will “remember” the answer for a period of time.

ALL STEPS IN ONE:

Sending an Email

Step 1: Your PC sends the e-mail to its configured outbound mail server. A DNS request similar to the previous example is required to find the address of the mail server.

Step 2: Your mail server follows the same intensive process to find the authoritative servers for “example.com”.

Step 3: Ask the “example.com” name server for the list of “Mail eXchangers (MX) for that domain.

Step 4: Select a Mail server and deliver the mail.

TYPES OF QUERIES

Recursive queries

Recursive queries

Iterative  queries

        

DNS CACHING

Domain Name Registration

The right to use a domain name is delegated by domain name registrars which are accredited by the Internet Corporation for Assigned Names and Numbers (ICANN), the organization charged with overseeing the name and number systems of the Internet. In addition to ICANN, each top-level domain (TLD) is maintained and serviced technically by an administrative organization, operating a registry. A registry is responsible for maintaining the database of names registered within the TLD it administers. The registry receives registration information from each domain name registrar authorized to assign names in the corresponding TLD and publishes the information using a special service, the whois protocol.

ICANN publishes the complete list of TLD registries and domain name registrars. Registrant information associated with domain names is maintained in an online database accessible with the WHOIS service. For most of the more than 240 country code top-level domains (ccTLDs), the domain registries maintain the WHOIS (Registrant, name servers, expiration dates, etc.) information. For instance, DENIC, Germany NIC, holds the DE domain data. Since about 2001, most gTLD registries have adopted this so-called thick registry approach, i.e. keeping the WHOIS data in central registries instead of registrar databases.

For COM and NET domain names, a thin registry model is used: the domain registry (e.g. VeriSign) holds basic WHOIS (registrar and name servers, etc.) data. One can find the detailed WHOIS (registrant, name servers, expiry dates, etc.) at the registrars.

Some domain name registries, often called network information centers (NIC), also function as registrars to end-users. The major generic top-level domain registries, such as for the COM, NET, ORG, INFO domains and others, use a registry-registrar model consisting of hundreds of domain name registrars (see lists at ICANN or VeriSign). In this method of management, the registry only manages the domain name database and the relationship with the registrars. The registrants (users of a domain name) are customers of the registrar, in some cases through additional layers of resellers.

Security Issues

DNS was not originally designed with security in mind, and thus has a number of security issues.

One class of vulnerabilities is DNS cache poisoning, which tricks a DNS server into believing it has received authentic information when, in reality, it has not.

DNS responses are traditionally not cryptographically signed, leading to many attack possibilities; The Domain Name System Security Extensions (DNSSEC) modifies DNS to add support for cryptographically signed responses. There are various extensions to support securing zone transfer information as well.

Even with encryption, a DNS server could become compromised by a virus (or for that matter a disgruntled employee) that would cause IP addresses of that server to be redirected to a malicious address with a long TTL. This could have far-reaching impact to potentially millions of Internet users if busy DNS servers cache the bad IP data. This would require manual purging of all affected DNS caches as required by the long TTL (up to 68 years).

Some domain names can spoof other, similar-looking domain names. For example, "paypal.com" and "paypa1.com" are different names, yet users may be unable to tell the difference when the user's typeface (font) does not clearly differentiate the letter l and the numeral 1. This problem is much more serious in systems that support internationalized domain names, since many characters that are different, from the point of view of ISO 10646, appear identical on typical computer screens. This vulnerability is often exploited in phishing.

Techniques such as Forward Confirmed reverse DNS can also be used to help validate DNS results.

USAGE OTHER  APPLICATIONS

The system outlined above provides a somewhat simplified scenario. The Domain Name System includes several other functions:

DNS Resource Records

DNS: distributed db for storing resource records (RR)

www.ibm.com is really

servereast.backup2.ibm.com

Table for Various Type of Resource Records

        

EXAMPLES OF RESOURCE RECORDS

DNS CONCERNS

  1. Load Concerns:

  1. Performance Concerns:

CONCLUSION

The whole process of Presentation Seminar was very helpful and educative for me in terms of the experience which I gained during its preparation. I got to know the real meaning of how a web page is accessed in real life requirements. I am responsible for the success or failure of the presentation. This sense of responsibility could only have been inculcated within me through such an exercise.

Thus, Basically Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. And helps in translation of Domain Names into

their corresponding IP Addresses.

In the end, I am very grateful to all my teachers, friends and the people  who helped me immensely in preparation of this presentation.    

Thank You….

REFERENCES

- 47 -