DNS is a critical network service that translates domain names (e.g. www.cisco.com) into IP addresses. Without DNS users would have to remember IP addresses.

Facts

Point	Description
Function	Name lookup: name → IP (and reverse)
Transport	UDP/53 standard; TCP/53 for zone transfers and large answers
Architecture	Hierarchical, distributed database
Security	Vulnerable to spoofing/poisoning → DNSSEC
Operations	Cache reduces latency and load

What does DNS solve?

IP addresses are hard to remember and can change (cloud, load balancing, failover). DNS provides a stable, human-readable name pointing at dynamic IP addresses – changes happen centrally in DNS without touching clients.

How it works, step by step

1. Client (stub resolver) asks its configured DNS server (often delivered by DHCP)
2. The recursive resolver checks its cache – hit → answer, miss → continue
3. Resolver asks the root servers → referral to TLD servers (.com, .dk)
4. TLD → authoritative servers for the domain
5. Authoritative server → final answer (A/AAAA)
6. Answer is cached (respecting TTL) and returned to the client

The client asks recursively; the resolver performs iterative lookups against the hierarchy.

Hierarchy

Level	Example	Function
Root	.	Starts the query
TLD	.com, .dk	Top-level domain
SLD	google.com	Domain name
Subdomain	www.google.com	Host/service

Record types (exam classics)

Record	Purpose
A	Name → IPv4
AAAA	Name → IPv6
CNAME	Alias to another name
MX	Mail servers for the domain
NS	Authoritative name servers
PTR	Reverse lookup (IP → name)
TXT	Text (SPF, DKIM, verification)
SRV	Service location (port/protocol)

Cache & TTL

• Cache lowers latency and DNS traffic; TTL decides how long answers may be cached
• Low TTL → fast changes/failover, more load; high TTL → less load, slower changes

Security

Risk	Explanation	Countermeasure
Cache poisoning	Fake answers get cached	DNSSEC, source-port randomization
Spoofing	Fake replies	DNSSEC, filtering
Open resolvers	Used in DDoS amplification	Restrict recursion
Tunneling	Data hidden in DNS	Monitoring, policy

DNSSEC signs DNS data cryptographically so clients can validate authenticity (integrity + authentication) – it doesn’t change the lookup, only the trust in the answer.

Extra functionality

• Split-DNS: different internal vs external answers · Anycast DNS: same IP everywhere → low latency · Conditional forwarding · Views per client network

Cisco IOS configuration

ip domain-lookup
ip domain-name example.local
ip name-server 8.8.8.8 1.1.1.1
ping www.cisco.com        ! test lookup

! Router as a simple DNS server (lab):
ip dns server
ip host test.example.local 192.0.2.10

Exam summary

• DNS = name → IP via a hierarchical, distributed system · UDP 53 normal, TCP 53 for zone transfer/large answers · know A, AAAA, CNAME, MX, NS, PTR, TXT, SRV · cache + TTL = performance · DNSSEC = integrity/authenticity