On this page & study actions
Assessed progress
Sign in and complete the verified MCQs to track mastery.
Unit 6: Application Layer4 min read
The Domain Name System (DNS) is a hierarchical, distributed database system designed to translate human-readable hostnames into machine-readable IP addresses across the Internet. By acting as the directory service for the World Wide Web, it eliminates the need for users to memorize numerical IP configurations, establishing a robust and scalable naming architecture.
To design a reliable mapping service between identifiers and computers, we must establish a controlled mapping protocol. To be unambiguous, the names assigned to machines must be selected carefully from a name space with complete control over the binding between the names and IP addresses.
Historically, name spaces have been categorized into two principal paradigms:
To realize a hierarchical name space, computer networks utilize the Domain Name Space design. Under this specification, names are defined within an inverted-tree structure featuring a single root node at the apex.
(Root) "."
/ | \
/ | \
edu com org
/ | \
berkeley google wikipedia
/ | \
cs maps meta"").sales.apple.com.).sales.apple or simply sales). The local resolver must append default local domain suffixes to complete the name and perform resolution. [ FQDN ] [ PQDN ]
Complete path to root terminated by "." Incomplete path, missing root
"computer.science.edu." "computer.science"Storing the entire global domain name database on a single system is highly inefficient and creates a single point of failure. Instead, the DNS registry database is distributed among thousands of physical computers called Name Servers.
DOMAIN (Logical Subtree) ZONE (Administrative Boundary)
[ Root ] [ Root ]
/ \ / \
[com] [edu] [com] [edu] <-- Managed by Parent
/ \ \ / \
[yahoo] [google] [mit] [yahoo] [google] <-- Delegated ZoneThe administrative duties of the name space are divided among a hierarchy of specialized servers:
a.root-servers.net through m.root-servers.net), distributed globally via anycast routing..com, .net, .org) and country-code domains (.us, .uk, .jp).DNS servers operate under a primary-secondary replication design:
In the global Internet infrastructure, the domain name space is divided into three functional categories:
Internet Tree
/ | \
/ | \
Generic Domains Country Inverse Domain
(gTLDs) Domains (in-addr.arpa)Generic domains group hosts based on their high-level organizational structure or commercial intent.
| Label | Primary Purpose |
| :--- | :--- |
| com | Commercial organizations |
| edu | Educational institutions |
| gov | Government agencies |
| net | Network infrastructure providers |
| org | Non-profit and miscellaneous organizations |
Country-code domains represent geographic and political territories using standardized two-letter abbreviations defined by ISO-3166 (e.g., us for United States, ca for Canada, in for India).
The inverse domain is used to perform reverse resolution (mapping a known IP address to its corresponding domain name).
Because the standard DNS tree is indexed by name, searching for a name by IP would require checking every node in the tree. To solve this, the inverse domain is structured using the special top-level domain prefix in-addr.arpa.
To perform a reverse query on an IPv4 address (such as 131.21.14.8), the octets must be reversed to match the tree's hierarchical structure, resulting in the query target 8.14.21.131.in-addr.arpa..
Mapping a domain name to an IP address (or vice-versa) is called name-address resolution. A client program that requests this mapping is called a resolver.
Resolvers obtain DNS mappings using one of two primary resolution methods:
In recursive resolution, the client sends its query to a local DNS server (recursive resolver). If the local server does not have the mapping in its local cache, it assumes the responsibility of resolving the query. The local server queries intermediate servers step-by-step until it finds the authoritative answer, which it then returns directly to the client.
Client Local DNS Root Server TLD Server Auth Server
| | | | |
|-- 1. Query -------->| | | |
| |-- 2. Query -------->| | |
| |<-- 3. Referral -----| | |
| | | |
| |-- 4. Query ---------------------------->| |
| |<-- 5. Referral -------------------------| |
| | |
| |-- 6. Query ------------------------------------------------->|
| |<-- 7. IP Address --------------------------------------------|
|<-- 8. IP Address ---| |In iterative resolution, the server does not perform subsequent queries. Instead, if it cannot resolve the name directly, it returns the IP address of the next DNS server down the hierarchy. The client resolver must then manually send a new query to that next-hop DNS server.
Client Local DNS Root Server TLD Server Auth Server
| | | | |
|-- 1. Query -------->| | | |
|<-- 2. Referral -----| | | |
| | | | |
|-- 3. Query ------------------------------>| | |
|<-- 4. Referral ---------------------------| | |
| | |
|-- 5. Query -------------------------------------------------->| |
|<-- 6. Referral -----------------------------------------------| |
| |
|-- 7. Query ----------------------------------------------------------------------->|
|<-- 8. IP Address ------------------------------------------------------------------|To reduce network traffic and latency, DNS servers use caching. When a server processes a query, it stores the returned mapping in its local cache. Subsequent requests for that same domain are answered immediately from the cache without querying authoritative servers.
To prevent stale entries, every resource record has a Time-to-Live (TTL). The TTL is a 32-bit integer indicating how many seconds a record can be cached before it must be deleted and refreshed from the authoritative source.
DNS queries and responses use a uniform message format, which is divided into five sections:
+---------------------------------------------+
| Header | (Flags, Transaction ID, and Counts)
+---------------------------------------------+
| Question | (Query Domain, Type, and Class)
+---------------------------------------------+
| Answer (RRs) | (Response Records, present in responses)
+---------------------------------------------+
| Authority (RRs) | (Points to Authoritative Servers)
+---------------------------------------------+
| Additional (RRs) | (Supplemental mapping records)
+---------------------------------------------+The DNS header is bytes long and has the following structured format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |QR| Opcode |AA|TC|RD|RA|Z| R |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Question Count (QD) | Answer Count (AN) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Authority Count (NS) | Additional Count (AR) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The DNS database uses two types of records: Question Records (used to structure queries) and Resource Records (RRs) (used to structure answers).
All resource records in a DNS response share a standard format:
+---------------------------------------------+
| Domain Name | (Variable Length)
+---------------------------------------------+
| Type (16-bit) | Class (16-bit) | (e.g., A, NS, CNAME, MX)
+---------------------------------------------+
| Time-To-Live (32-bit) | (Cache validity duration in seconds)
+---------------------------------------------+
| Resource Data Length | Resource Data | (Mapping value, variable size)
+---------------------------------------------+0x0001).0x001C).0x0002).0x0005).0x000F).The following example shows how these resource records are defined in an authoritative zone file:
; Zone file snippet for kophub.engineering
$TTL 86400 ; Default Time-to-Live (24 hours)
@ IN SOA ns1.kophub.engineering. admin.kophub.engineering. (
2026071501 ; Serial number (YYYYMMDDNN)
28800 ; Refresh interval (8 hours)
7200 ; Retry interval (2 hours)
604800 ; Expire limit (1 week)
86400 ) ; Minimum TTL
@ IN NS ns1.kophub.engineering.
@ IN MX 10 mail.kophub.engineering.
ns1 IN A 192.0.2.1
mail IN A 192.0.2.2
www IN A 192.0.2.100
api IN CNAME www.kophub.engineering.To run reliably on the global web, DNS depends on coordinated administrative registries, dynamic updates, and specific transport layer rules.
To add a new domain to the DNS hierarchy, an entity must register through a registrar—a commercial company accredited by the Internet Corporation for Assigned Names and Numbers (ICANN). The registrar verifies that the requested domain name is unique within its target TLD, charges an administrative fee, and registers the domain's authoritative name servers in the TLD registry.
In traditional DNS, zone files are static; an administrator must manually update them when a host's IP changes. However, when host IP addresses are assigned dynamically via DHCP, static configurations lead to outdated entries.
To solve this, the Dynamic Domain Name System (DDNS) was developed. Under DDNS, when DHCP assigns a new IP address to a client machine, the DHCP server (or the client itself) automatically sends an update message to the primary DNS server, which immediately modifies its zone records.
[ Client Host ] ----1. DHCP Lease Request----> [ DHCP Server ]
^ |
|-- 2. IP Lease Assigned (192.0.2.55) <--------|
| |
+---3. Update (host.kophub.engineering) --------+
|
v
[ Primary DNS Server ]
(Zone file updated dynamically)DNS operates over both User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) on well-known Port 53.
The choice of transport protocol is determined by payload size:
TC=1). When the client receives a packet with TC=1, it immediately opens a TCP connection on port to retrieve the complete response. TCP is also used for zone transfers between primary and secondary servers because it provides reliable, byte-stream transmission of entire zone databases.hostname.domain.com.), while a PQDN is incomplete and omits the root marker.in-addr.arpa) used for reverse IP-to-name lookup.A structured name space designed in an inverted-tree format to ensure global uniqueness and prevent name collisions without central administrative bottlenecking.
The process where a secondary DNS server replicates authoritative zone data from a primary server to maintain high availability and redundancy.
Recursive resolution tasks the local resolver with executing nested queries to return the final mapping, whereas iterative resolution returns referral steps to the querying client.
The fundamental unit of database storage in DNS, containing attributes such as Name, Type (A, MX, NS, CNAME), TTL, and Class.
The mechanism where DNS uses UDP port 53 for standard queries under 512 bytes, transitioning to TCP port 53 for larger payloads and zone transfers.
Test your understanding with 5 questions
In the hierarchical domain name space design, what is the maximum number of levels allowed in the inverted-tree structure, and what is the level designation range?
Which of the following statements accurately describes the operational difference between a Primary DNS Server and a Secondary DNS Server?
Under what specific condition does a DNS transaction transition from using UDP to using TCP on port 53?
What is the primary characteristic of a Fully Qualified Domain Name (FQDN) that distinguishes it from a Partially Qualified Domain Name (PQDN)?
In a recursive DNS resolution process, which entity bears the primary responsibility of performing the subsequent queries to resolve the domain name on behalf of the client?
6 Modules
6 Modules