Domain names
Hierarchy
The hierarchy of domains descends from the right to the left label in the name. There are typically 3 levels in the hierarchy but it can extent to up to 127 levels.
Within the 3 stage hierarchy there is the:
- The first level is the top level domain (.com, .net, .it, .fr, .org).
- Followed by the second level domains (google.com, microsoft.com, greenlight-itc.com)
- Then followed by host names (www.google.com, ftp.microsoft.com, mail.greenlight-itc.com)
Register Domains
Each domain must be unique. You can’t have glhelp.com twice but you can have glhelp.com and glhelp.com.au since they are on different top level domains. There are also regulations in place when registering domains on particular top level domain name. For example:
- .com.au requires you to have a registered business, and you will have to provide an ABN or something similar
- .com doesn’t require anything specific
Name resolution
Name Servers
Name Servers hold DNS records for a particular domain. Each domain has an Authoritative Name Server and a slave/backup Name Server. A Name Server’s job consists of:
- Accepting requests from applications to converts domain names into IP
- Accepting requests from other Name Servers to convert domain names into IP
Name Resolution Process
When your web browser or mail server needs to resolve a domain name to an IP address, your computer or server will contact your primary Name Server (If it’s a computer then it will be what ever the primary DNS server is set to, probably your server or router. If it’s a server then it will be up to which Name Servers IPs are set in the DNS forwarders.)
Two things can happen when the resolution happens (For this example we will use glhelp.com):
- If the Name Server already knows the IP address of the domain then it will just give you the answer.
- If the Name Server doesn’t know the IP address:
- First it will contact a Root Name Server which doesn’t solve the name but instead give the IP address of one of the Top Level Name Servers for .com
- Then your Name Server will contact the Top Level Domain Name Server for glhelp.com. It will return the Name Server for the domain glhelp.com
- Your Name Server will then contact the glhelp.com Name Server which will consult it’s DNS table and give you an IP address
To avoid this lengthy process, Name Servers maintain a cache of previous lookups
DNS Records
Only the most common DNS records are covered.
When changing DNS records remember that it can take up to 24 to 48H to propagate over the internet on other Name Servers
Maps a hostname to an IP
Alias a hostname to another
- MX – Mail Exchanger Record
Defines the destination server for the domain’s emails
- PTR – Pointer Record aka Reverse DNS
Maps an IP address to a hostname
Primarily used to define SPF record and SOA record
Split DNS
Split DNS revolves the issue where external and internal users require access to the same resources using the same DNS name.
Benefits of split DNS
We will look at a scenario where an internal user and an external user wants to access the local mail server using the A record mail.greenlight-itc.com
Without split DNS
The user will resolve mail.greenlight-itc.com to the public IP address of the firewall/router and will it be routed through to the internal mail server
No problems here
The user will resolve mail.greenlight-itc.com to the public IP address of the firewall/router and will it be routed through to the internal mail server.
The problem here is that this connection puts a lot of stress on the firewall as the traffic loops back from the internal interface to external interface and then back to the internal interface of the router then goes to the mail server.
Sometimes this will not work, it depends how the firewall handles these types of traffic.
With split DNS
This time you have on your LAN a Name Server that has DNS records with Private IPs for the domain greenlight-itc.com
The user will resolve mail.greenlight-itc.com to the public IP address of the firewall/router and will it be routed through to the internal mail server
The user will resolve mail.greenlight-itc.com to the private IP address of the mail server and will only communicate to it on the LAN
Diagnose DNS faults
External DNS issues
- Check the DNS records are right
Use DNS lookup websites such as: http://centralops.net/co/ http://www.dnsstuff.com/
- Check that the Name Servers are correct and working
- Check the DNS forwarders
Internal DNS issues
- Check that the DNS services are running (restart them if necesarry)
- Use the nslookup command to check if the name server is resolving correctly
- Open the DNS manager and clear cache, update data files and scavenge stale records