DNS Configuration - CompTIA A+ 220-1101 - 2.6

Summary

This script delves into the intricate workings of the Domain Name System (DNS), highlighting its role as a distributed database translating domain names into IP addresses. It outlines the DNS hierarchy, including root servers, top-level domains, and the importance of redundancy for server addresses. The script also covers various DNS record types, such as A, AAAA, MX, TXT, SPF, DKIM, and DMARC, explaining their purposes in email routing, security, and verification. The necessity of a secure and well-maintained DNS configuration is emphasized, with examples of how to manage DNS records through text files or web interfaces.

Takeaways

• 🌐 DNS is a distributed database that translates fully qualified domain names into IP addresses used by networks.
• 📚 There is a hierarchical structure to DNS with multiple servers that include 13 root server clusters and over 1,000 different servers.
• 🌐 Top-level domains (TLDs) are divided into generic TLDs like .com, .org, and .net, and country-code TLDs like .us, .ca, and .uk.
• 🏢 DNS records are organized hierarchically, with a root domain, subdomains for services like mail, and potentially regional subdomains for large networks.
• 🔍 Users can use the 'dig' command or 'nslookup' to query DNS records and see the IP addresses associated with a domain.
• 🔁 DNS provides redundancy by having multiple IP addresses for a single domain to ensure availability even if one IP fails.
• 📝 DNS servers store resource records, which contain various types of data, including IP addresses, mail exchangers, and text information.
• 🛠️ A DNS server's configuration can be edited using a simple text file or through a web-based interface, depending on the service.
• 📑 Common DNS record types include A records for IPv4 addresses, AAAA records for IPv6, MX records for mail exchangers, and TXT records for text information.
• ⏱️ Time to Live (TTL) in DNS specifies how long information is cached before a device needs to request it again from the DNS server.
• 🔒 DNS plays a critical role in email security with records like SPF, DKIM, and DMARC that help verify the origin and integrity of emails.

Q & A

What is DNS and what does it do?

DNS, or the Domain Name System, is the service that translates fully qualified domain names entered into web browsers into IP addresses that networks can understand and use for communication.

Is DNS a standalone server or part of a larger system?

DNS is not a standalone server; it is a distributed database with multiple servers across the internet that work on a hierarchical system to provide translations for domain names.

How many root server clusters are there in the DNS system?

There are 13 root server clusters in the DNS system, which actually consists of over 1,000 different servers.

What are the different types of top-level domains mentioned in the script?

The script mentions generic top-level domains like .com, .org, .net, and country-level top-level domains such as .us, .ca, and .uk.

Can you explain the hierarchy of a fully qualified domain name using the example from the script?

The hierarchy starts with a period at the top, followed by the top-level domain (e.g., .com), then the second-level domain (e.g., .professormesser), and finally the subdomains like www or mail.

What is the purpose of the 'dig' command in the context of DNS?

The 'dig' command is used to perform DNS lookups from the command line, showing a summary of the requested information and the IP addresses associated with a domain name.

What is the significance of having multiple IP addresses for a web server?

Multiple IP addresses for a web server provide redundancy, ensuring that if one IP address becomes unavailable, devices can use any of the other IP addresses to communicate with the server.

What are resource records in the context of DNS?

Resource records are the data entries in a DNS server that contain information such as fully qualified domain names, IP addresses, and other details necessary for the translation between domain names and IP addresses.

Why is it important to have backups when making changes to a DNS server configuration?

Backups are crucial because if a DNS server becomes unavailable or misconfigured, it can prevent the translation between domain names and IP addresses, making websites and services inaccessible.

What are some common types of resource records found on a DNS server?

Common types of resource records include A records (for IPv4 addresses), AAAA records (for IPv6 addresses), MX records (for mail exchangers), and TXT records (for storing text information).

Can you describe the purpose and function of an MX record in DNS?

An MX record, or mail exchanger record, specifies the mail server responsible for accepting email messages on behalf of a domain, ensuring that emails are delivered to the correct server.

What is the role of a TXT record in DNS?

A TXT record in DNS is used to store text information that can be queried by others. It is often used for verification purposes, email security, and providing information for SPF, DKIM, and DMARC configurations.

What is SPF and how does it relate to TXT records?

SPF, or Sender Policy Framework, is a mechanism that uses TXT records to specify which mail servers are authorized to send emails on behalf of a domain, helping to prevent email spoofing.

Can you explain what DKIM and DMARC are and their roles in email security?

DKIM, or Domain Keys Identified Mail, is a method of associating a digital signature with outgoing mail using a public key in a TXT record to validate the authenticity of an email. DMARC, or Domain-based Message Authentication, Reporting, and Conformance, extends SPF and DKIM by specifying how to handle emails that fail validation and generating reports on email validation results.

Outlines

00:00

🌐 Understanding DNS Structure and Hierarchy

The paragraph introduces the Domain Name System (DNS) as a critical service that translates human-readable domain names into IP addresses for network use. It explains that DNS is a hierarchical and distributed database with multiple servers worldwide, including 13 root server clusters and over 1,000 servers, as well as top-level domains (TLDs) like .com, .org, and country-code TLDs like .us and .uk. The script uses professormesser.com to illustrate the DNS hierarchy, showing how subdomains like www and mail fit into the structure. It also discusses the importance of redundancy in DNS with multiple IP addresses for a server and introduces command-line tools like 'dig' and 'nslookup' for querying DNS records. The paragraph concludes with an overview of the types of resource records stored in DNS, emphasizing the system's complexity and the need for careful configuration and backup.

05:00

📝 DNS Record Types and Email Security

This paragraph delves into the specifics of DNS records, starting with address records (A and AAAA) for IPv4 and IPv6, respectively, and explaining how they associate domain names with IP addresses. It discusses the time to live (TTL) setting, which dictates how long information is cached before being refreshed. The paragraph then covers mail exchanger (MX) records, which direct email delivery, and text (TXT) records, which serve various purposes, including email security. It introduces SPF (Sender Policy Framework) records that list authorized email servers to prevent spoofing, and DKIM (DomainKeys Identified Mail) records that provide a digital signature for emails. The paragraph also touches on DMARC (Domain-based Message Authentication, Reporting, and Conformance) records, which dictate actions for unverified emails and provide reporting on email validation. Examples of configuring and querying these records are given, highlighting the importance of DNS in securing and managing email communication.

10:02

🔒 Advanced Email Security with DNS Records

The final paragraph focuses on advanced email security measures implemented through DNS records. It explains the process of creating a text-based DNS record for SPF to authorize email servers and prevent unauthorized use of the domain name in emails. The paragraph also describes the configuration of DKIM records, which involve adding a public key to a DNS TXT record to digitally sign outgoing emails, ensuring their authenticity. DMARC records are introduced as an extension of SPF and DKIM, providing a policy for handling emails that fail validation checks. The script outlines how to create and add DMARC records to a DNS server, emphasizing the importance of defining the disposition of unverified emails and the process of receiving reports on email validation status. The paragraph concludes by illustrating how these DNS-based security measures work together to protect and verify email communications.

Keywords

💡DNS

DNS stands for Domain Name System, which is a critical service that translates human-readable domain names into IP addresses that computers and networks use to communicate with each other. In the video script, DNS is described as a hierarchical and distributed database, emphasizing its importance in the internet's infrastructure. The script explains that DNS is not a single server but a system of multiple servers worldwide, including root servers and top-level domain servers.

💡Fully Qualified Domain Name (FQDN)

A Fully Qualified Domain Name is the complete domain name for a specific website or server, including all its subdomains and the top-level domain. The script uses the example of 'professormesser.com' to illustrate the hierarchy of an FQDN, showing how each part of the domain name contributes to the overall address and how it is used within the DNS system for resolution to an IP address.

💡IP Address

An IP address is a numerical label assigned to devices connected to a computer network that uses the Internet Protocol for communication. In the context of the script, IP addresses are the destination points that DNS translates domain names into, allowing users to access websites by typing a URL into their browser instead of remembering numerical IP addresses.

💡Root Server Clusters

Root server clusters are the top-level of the DNS hierarchy, responsible for managing the traffic to the top-level domains. The script mentions that there are 13 root server clusters, which actually consist of over 1,000 different servers, highlighting the scale and distribution of the DNS infrastructure.

💡Top-Level Domain (TLD)

A Top-Level Domain is the last part of a domain name, such as '.com', '.org', or '.net'. The script explains that there are hundreds of generic TLDs and also country-level TLDs like '.us' or '.uk', which are part of the hierarchical structure of the DNS.

💡dig command

The 'dig' command is a network administration command-line tool used to query DNS nameservers for information about host addresses, mail exchanges, and other DNS records. The script describes how to use the 'dig' command to see the translation process of a domain name to an IP address, as demonstrated with 'dig www.professormesser.com'.

💡nslookup

nslookup is a command-line tool for querying the DNS to obtain domain name or IP address mapping information. The script suggests using 'nslookup' as an alternative to 'dig' for systems that do not support the latter, to perform similar lookups for domain name resolutions.

💡Resource Records

Resource Records are data structures in a DNS database that store information associated with a domain name or IP address. The script explains that these records are essential for the DNS to perform translations and includes various types of records, such as A records, MX records, and TXT records, which are crucial for different functionalities of the DNS.

💡A Record

An A record, or Address Record, is a type of DNS record that maps a domain name to an IP address for IPv4. The script provides an example of an A record for 'www.professormesser.com', showing how the domain name is associated with a specific IP address within the DNS configuration.

💡MX Record

An MX record, or Mail Exchanger record, is a type of DNS record that specifies the mail server responsible for accepting email messages on behalf of a domain. The script explains the importance of MX records in directing emails to the correct server and provides an example of how an MX record points to a mail server within a domain.

💡TXT Record

A TXT record is a type of DNS record that stores text information. The script describes TXT records as being used for various purposes, including verification of domain ownership for services like Stripe and for email security measures such as SPF, DKIM, and DMARC.

💡SPF Record

An SPF record, or Sender Policy Framework record, is a type of TXT record that identifies which mail servers are permitted to send email on behalf of a domain. The script explains how SPF records help prevent email spoofing by specifying authorized mail servers and how they are used in conjunction with other email security measures.

💡DKIM Record

A DKIM record, or DomainKeys Identified Mail record, is a type of TXT record that provides a digital signature for outgoing emails to verify the authenticity of the message. The script describes how DKIM records work with public and private keys to ensure that emails are not tampered with during transit.

💡DMARC Record

A DMARC record, or Domain-based Message Authentication, Reporting, and Conformance record, is another type of TXT record that specifies how email receivers should handle messages that fail SPF or DKIM validation. The script explains how DMARC extends email security by defining policies for unauthenticated messages and provides a method for domain owners to receive reports on email authentication results.

Highlights

DNS is a distributed database that translates domain names into IP addresses.

There are 13 root server clusters with over 1,000 different servers in the DNS hierarchy.

DNS includes generic and country-level top-level domains such as .com, .org, .net, .us, .ca, and .uk.

The DNS hierarchy is visualized starting from the top-level domain down to the fully qualified domain name.

DNS records can be configured for specific structures like subdomains and organizational domains.

The 'dig' command can be used to see the translation process from domain name to IP address.

Redundancy in DNS is achieved by having multiple IP addresses associated with a single domain.

The 'nslookup' command can be used to query the local DNS server for domain IP addresses.

DNS servers contain a large database of resource records for domain name and IP address translations.

DNS configurations can be managed through a simple text file or a web-based interface.

A and AAAA records in DNS are used for mapping domain names to IPv4 and IPv6 addresses, respectively.

The Time to Live (TTL) in DNS specifies how long a record is cached before it is refreshed.

MX records in DNS determine where emails should be delivered by pointing to mail servers.

TXT records in DNS are used for storing text information, often for verification or security purposes.

SPF records in DNS specify authorized email servers to prevent spoofing of domain names in emails.

DKIM records provide a digital signature for emails to verify their origin and authenticity.

DMARC extends SPF and DKIM by determining the disposition of emails that fail validation.

DNS is a critical resource; changes should be made with backups and a clear understanding of configurations.

Transcripts

DNS is the domain name system, and we often

refer to this as the service that

converts the fully qualified domain names that we might

type into our browser to something our networks might

use, like an IP address.

But what you may not realize about DNS

is that this is not simply a standalone server that

provides this resource.

There are multiple servers across the internet that

provide these translations and they

work on a hierarchy across all of the different fully

qualified domain names.

This is also a very distributed database,

because we have many different DNS servers on the internet.

There are 13 root server clusters.

In actuality, this consists of over 1,000 different servers.

There are hundreds of generic top-level domains.

These are the domains that are the .com, the .org, the .net,

and others.

And then there are also country-level top-level

domains, like .us, .ca for Canada,

or .uk for the United Kingdom.

Here's a very simple visual representation

of this hierarchy from the perspective

of professormesser.com.

We'll start at the top with a period.

This designates the end of the fully qualified domain name.

And working backwards, we would have a .com, a .net, a .edu,

and others.

Obviously, professormesser.com would be the next layer

in this hierarchy.

So you can see underneath .com, we have .professormesser.

And of course, there may be multiple servers

at professormesser.com.

If you go to my website, then you're

visiting www.professormesser.com,

but I might have a mail server, which

is mail.professormesser.com.

And in very large networks, you may have organizational domain

names-- for example, east.professormesser.com

and west.professormesser.com.

And in the east, there may be certain servers.

In the west, there might be other servers.

Having this hierarchy allows us to configure a very specific

structure, and this works across every fully qualified domain

name on the internet.

If you'd like to see visually how this translation operates

and your system supports the dig command,

you can run at the command line dig www.professormessor.com.

The results of this command show us

a summary of what we requested.

It shows the information that was sent asking specifically

for an address associated with www.professormesser.com.

And then you can see in the ANSWER SECTION,

there are actually three different IP addresses

associated with my web server, and you

can see those IP addresses are listed here.

The reason there are three different addresses for my web

server is for redundancy.

If one of those IP addresses is no longer available,

your device can use any of these other IP addresses

to communicate back to www.professormesser.com.

If you're not on a system that supports the dig command,

you can use nslookup professormesser.com.

This will go out to your locally configured DNS server

and provide answers for the professormesser.com IP

addresses, and you can see the results

of this query show exactly the same three IP addresses.

Behind the scenes, the DNS server

has a large database that contains fully qualified domain

names, IP addresses, and other details that

can help your systems perform this translation between fully

qualified domain name and IP address.

We refer to these as resource records, and in this video,

we'll look at a number of different types of resource

records that are used on a DNS server.

There are over 30 different record types.

We won't go through all 30 of those in this video.

Those record types might be IP addresses, certificates,

host names, and other details.

As you can imagine, a DNS server is a critical resource.

If a DNS server isn't available, you

can make the request to visit www.professormesser.com,

but there's nothing behind the scenes

to make the translation between the fully qualified domain

name and the IP address.

This is why we tell people, if you're making a change to DNS,

make sure you have very good backups

of the previous configuration and that you

know exactly what you're changing in that DNS server.

Many DNS servers have a very simple configuration file

that's written in text, and this is an example of one

of those DNS configurations.

The section at the top is the Start of Authority Record.

This has some mail exchanger records inside of it,

a list of IP addresses, and fully qualified domain names,

and you've got some canonical or alias

names that you've also assigned inside of this DNS server.

This makes it relatively easy if you

need to make changes to a DNS server's configuration

because you can use any text editor to modify or update

this configuration file.

You might also find that the DNS service that you're using

can provide you with a web-based front end to the configuration,

so instead of understanding all of those different records

and understanding where they go in the configuration file,

you can put them all into a web-based front end

and make your changes from there.

The first record will look at and perhaps one

of the most common records you see in a DNS server

is an address record.

We often refer to these as in A record or a AAAA record.

The A records are address records for IP version 4.

So this a record will have a fully qualified domain

name and the associated IP version 4 address.

The quad A records are for IPv6.

The same thing applies.

We'd have a fully qualified domain name,

and we would associate the IPv6 associated with that domain

name.

Here's an example of an A record that's

on the professormesser.com DNS server.

You can see that I am specifying that www.professormesser.com

is an internet address using the A record,

and the IP address associated with that fully qualified

domain name is 162.159.246.164.

If you're configuring this in a DNS text file,

then you also have the option to add remarks or other comments

on that record line.

If the front end to your DNS server

is in a web-based configuration, it's the same information,

but we've separated out the A record, the hostname, the IP

address, and the time to live for this IP address.

The time to live in a DNS server is

specifying how long an end station will remember

this match between fully qualified domain name and IP

address.

This 15 minute time to live means

that a device will make the request to a DNS server

and store or cache that information for 15 minutes.

After 15 minutes, that information

is removed from the cache, and if this device

needs to communicate back to the www server,

it will need to request, again, the IP address

for that particular record.

Here's the same thing, but from the perspective

of IPv6, where we're configuring a quad A record,

and we have a hostname, an IPv6 address, and, again, a time

to live.

Another important record in a DNS is where all of your emails

should be delivered.

This is a mail exchanger record or an MX record.

To make this work, you would need two separate records

inside of your DNS server.

The first would be the MX record.

You can see the mail exchange record in this server points

to mail.mydomain.name.

To be able to obtain the IP address for mail.mydomain.name,

we would need to look at an A record,

and you can see there is an A record

for the mail.mydomain.name, which is 123.12.41.41,

and it is a Linux server.

DNS servers have many different functions they can provide.

One of those is to stored text information that can then

be used for other purposes.

We would store the text information

in a text record or TXT record.

This is usually public information.

Since people are able to query these text

records on your server, these text records

were originally designed for very informal purposes.

But today, we have very specific uses for a TXT or text

record in our DNS server.

For example, we might use this for verification purposes.

We might be making a configuration change

to our domain, and that domain change

requires that you add something very specific to a text

record in your DNS server.

This is because the DNS server configuration is usually

very secure, and only authorized individuals

would have access to make changes to a DNS server's

configuration.

We also use this text record extensively for email security,

and you'll see in a moment how we're able to add information

to a text record that can help verify

the origination of a particular email.

If you want to see some example of text records,

you can look at the text records that

are on the professormesser.com DNS server.

If you're running dig, you can use dig professormesser.com

and then txt.

And then it will show all of the text records

that I have currently configured on my DNS server.

You can see that I have two currently configured,

one for a stripe verification, and another one that

is used for mailgun.org, which is used to send out my email

messages.

If dig isn't available, you can also

view these using an nslookup.

You would use nslookup-type=txt, and then the domain name such

as google.com or professormesser.com.

You can see when you perform a google.com lookup that Google

has a number of text records on their device, which include

things like a Facebook domain verification, a Google site

verification, and a DocuSign text record.

A common text record you might find

is an SPF record, or a sender policy framework.

This is a list of all of the email servers that

are authorized to send messages using your fully

qualified domain name.

This was created to help prevent others

from spoofing your fully qualified domain name

and sending email as if you would send it yourself.

A mail server receiving an email that

says it was from professormesser.com

will query the professormesser.com DNS server,

retrieve this SPF record in the DNS server,

and be able to determine is this something that really

came from an authorized host?

Here's the same process for creating a text-based DNS

record, and you can see, you just

paste in the text that is associated with the record

that you'd like to add.

In this example, you can see that I'm adding the SPF

record into my DNS server, and, again,

I have a TTL of 15 minutes.

We can even take this email security one step further

and provide a digital signature that we can

associate with outgoing mail.

We do this through the use of a DKIM text record,

or Domain Keys Identified Mail.

This is going to be validated by the mail servers

as that message is traversing the network,

and the public key associated with this digital signature

is added to a text record in your DNS server.

Here's the same configuration for that DKIM record,

except we're making the configuration

change in this web-based front end, and you can see,

it's a large bit of text that is the public key for all

of the digital signatures that have been sent from my domain.

Now that we have a way to verify messages that have been sent

and to digitally sign messages that are being sent,

we need some way to determine what we do with those messages

if the verification fails.

We would use DMARC for that purpose.

This is the Domain-based Message Authentication Reporting

and Conformance.

This is an extension of the SPF and DKIM processes

that we've already seen, except DMARC takes the extra step

to determine the disposition that

should be used when someone receives a message that

can't be validated.

You might create a DMARC record on your DNS server that

says, if a message is not validated,

simply accept it, or maybe send it to a spam folder,

or simply reject the email entirely.

The mail servers behind the scenes

keep track of how many mail messages have been validated

and how many have failed the validation,

and then you can receive a report that shows exactly how

many messages were able to get through based on the SPF

or DKIM configuration.

And here's an example of adding one of those DMARC text records

to your DNS.

You can see that the content specifies

what to do with the email messages

and where to send the report so that you can examine how

your mail has been distributed.