DNS. A Massively Distributed Database. Justin Scott December 12, 2018

Transcription

1 DNS A Massively Distributed Database Justin Scott December 12, 2018

2 What is DNS? Translates Hostnames to IP Addresses

3 What is DNS? Example:

4 What is DNS? Example:

5 What is DNS?

6 But there s so much more

7 Agenda How did we get here? What does DNS store? How can we query it? Interesting use-cases.

8 How did we get here? A bit of history.

9 There is no Internet

10 October 29, 1969 ARPANet created with four hosts UCLA s Network Measurement Center Stanford Research Institute (SRI) University of California-Santa Barbara University of Utah

11 Connecting by name is much easier than connecting by numbers.

12 HOSTS.TXT Each computer has its own HOSTS.TXT file mapping names to addresses. There is no central authority or standard.

13 September 20, 1971 RFC #226 STANDARDIZATION OF HOST MNEUMONICS First standard list of hostnames and numbers proposed by Peggy Karp with 20 hosts listed. She suggests six character hostnames.

14 September 20, 1971 RFC #226 STANDARDIZATION OF HOST MNEUMONICS

15 September 22, 1971 RFC #229 STANDARD HOST NAMES Jon Postel updates the list with 40 hostnames and suggests eight-character names.

16 October 12, 1971 RFC #247 Proferred [sic] Set of Standard Host Names Peggy Karp lists 44 hosts with a standardized, eight-character site-machine name format.

17 December 12, 1973 RFC #597 Host Status Formal host listing is updated with 81 named hosts on the network. Managing all these HOSTS.TXT files is hard.

18 December, 1973 RFC #606 Host Names On-line Suggests a central authority to maintain and distribute a standard HOSTS.TXT file.

19 TEN Years Later

20 November, 1983 RFC #882 DOMAIN NAMES - CONCEPTS and FACILITIES Paul Mockapetris invents DNS.

21 Design Goals Uniform Reliable Efficient Distributed

22 What Does DNS Store? More than you might think

23 More Than Just Addresses Resource Record Types: A Address (IPv4; most common) MX Mail Exchanger (originally MF and MD) NS Name Server SOA Start of Authority CNAME Canonical Name (alias to another name) TXT Arbitrary Textual Data AAAA Address (IPv6; quad-a ) Others There are about 40 active RR Types

24 Example Zone Data example.com. SOA ns1.example.com. admin.example.com. ( ; Serial ; Refresh (3h) 3600 ; Retry (1h) ; Expire (1w) 3600) ; Neg. Cache TTL NS NS MX 10 MX 20 TXT v=spf1 a:mail.example.com A jeff CNAME the-boss.gointerject.com. mail A mail AAAA 2001:db8:85a3:0:0:8a2e:370:7334 ns1 A ns2 A www A www A

25 How Can We Query It? Just follow the tree

26 DNS Tree Structure Like a B-Tree in a database. Branches = Domain Registrars Leaves = Domain Names and Hosts

27 Anatomy of a Domain Name Example: www serverlogic com = hostname = second-level domain = top-level (generic) domain

28 Let s Follow the Tree Queries run from the least specific name to the most specific name. com is the least specific zone, so we ll start there.

29 But There s Something Missing

30 Every Tree Needs a Root! Every domain name shares the same name space, beginning with the root domain. The root is invisible and represented as a blank (null) domain, or simply the last dot.

31 Root Hints Every DNS server starts with a static list of hints as to where to find the root servers. Updated at startup. 13 Root Servers, named A-M, are run by large organizations. (Verisign, Cogent, NASA, US-DOD, etc.). Each of the 13 root servers is actually multiple servers peppered around the world using IP anycast routing. See:

32 Roots Close to Home

33 Query Demo Start with a root hint:

34 Run NSLOOKUP (Windows) Set server to and query:

35 DIG is Another Option

36 We got a Referral The server we asked couldn t answer our question, but referred us farther down the tree to other servers. In this case, a list of hosts at gtld-servers.net. These servers are authoritative for the general top-level domains (com, net, org, etc.).

37 Google s.dev Example Google runs the.dev top-level domain and has a subsidiary called Charleston Road Registry that manages that name space.

38 Let s Ask a GTLD Server Query b.gtld-servers.net at for

39 Another Referral We got referred to A DNS server at ns.opusnet.com. Let s ask them [ ] for an answer

40 This has all happened before It will all happen again

41 Lookup New CNAME Host Because we got a CNAME as the answer to our last question, we have to start over at the root for the new hostname at live-serverlogic.pantheonsite.io: Ask ROOT -> a0.nic.io [ ] Ask > ns-852.awsdns-42.net [no hint] [Repeat process to look up that host, resolves to ] Ask >

42 ServerLogic really wants us to work for that Address record we asked for

43 Lookup New CNAME Host Start over (again) at the root for the new hostname at fe4.edge.pantheon.io: Ask ROOT -> a0.nic.io [ ] Ask > ns-148.awsdns-18.com [no hint] [Repeat process, look up that host, resolves to ] Ask > Referral to ns-644.awsdns-16.net [no hint] [Repeat process, look up that host, resolves to ] Ask >

44 Asking NSLookup Confirms Sending the query to a recursive server brings back the same chain of aliases and address result:

45 Other Record Types? We can ask the server for whatever RR we want. How about MX records for mail routing?

46 Other Record Types? We can ask the server for whatever RR we want. How about MX records for mail routing?

47 That seems like a lot of work! There s an easier way!

48 Recursive Name Servers Large servers run by your ISP which do the heavy lifting for you. They cache a lot of information to speed up response times and reduce load on DNS overall. Specified by your TCP/IP settings, usually set automatically using DHCP by the network.

49 Recursive Name Servers Your computer asks them a question and they return from cache, or go out to the root and follow the tree on your behalf to get the answer (and cache it for others). You can decide what recursive name server to use

50 Alternative Name Servers A third-party recursive name server can speed up query responses or provide additional security, domain filtering, etc. * May break local network name resolution.

51 Alternative Name Servers CloudFlare > Google DNS > Quad9 > OpenDNS >

52 Alternative Name Servers Recursive caching servers are built for speed. They peer with large ISPs to reduce query response times.

53 CloudFlare vs. Google From Comcast in Vancouver, WA

54 CloudFlare vs. Comcast

55 Alternative Name Servers

56 Security Through Name Filtering Step 3 is new They check a blacklist of known bad domains and refuse to answer the query if found. Source:

57 Interesting Use Cases DNS tricks for fun and profit.

58 DNS Realtime Blacklists Used by mail server operators to block connections from known sources of spam.

59 DNS Realtime Blacklists Mail server generates a hostname based on the IP address of the remote mail server and queries for the resulting hostname.

60 DNS Realtime Blacklists Good Remote Server: Query: zen.spamhaus.org

61 DNS Realtime Blacklists Bad Remote Server: Query: zen.spamhaus.org

62 DNS Realtime Blacklists Spamhaus Return Codes:

63 HOSTS Override Remember HOSTS.TXT? It s Still There

64 HOSTS Override Windows: c:\windows\system32\drivers\etc\hosts Linux & Mac: /etc/hosts

65 HOSTS Override Typically need administrator or root access to edit. Format: <IP> <Hostname> Example:

66 HOSTS Override Typically need administrator or root access to edit. Format: <IP> <Hostname> Example:

67 Chrome.localhost Google Chrome browser will auto-resolve any.localhost domain to Example: Great for local web development and testing. Proposed as an Internet standard by Google. See:

68 Side Note About Localhost Most people know that is the loopback address. It loops traffic back inside the network stack to your own computer. Useful for local testing and development.

69 Side Note About Localhost Most people don t know that ANY IPv4 address beginning with 127 is included in the loopback address space. This means that also loops back to your own computer. Can be useful for separating local development resources. See RFC #6890 Special-Purpose IP Address Registries at

70 Reverse DNS DNS can also resolve IP addresses back to hosts. Remember that format for realtime blacklists? <ip.reversed>.<blacklist.domain> Example: zen.spamhaus.org

71 Reverse DNS There is a special domain we can query using the same format to get a host name from an IP address. <ip.reversed>.in-addr.arpa Example: in-addr.arpa

72 Reverse DNS IP: Query: in-addr.arpa * Note we query for the PTR record type here, not for an A record.

73 Reverse DNS Mail servers usually check for a reverse DNS entry matching the HELO/EHLO signal from the remote mail server as a security check against spammers.

74 DNS in Docker Docker overrides certain files that control the network within a bridged container: /etc/hostname /etc/hosts /etc/resolv.conf

75 DNS in Docker By default, Docker will set the Container to use the same DNS resolver(s) used by the host system (non-localhost addresses). If there aren t any, it will append the Google public servers at and

76 DNS in Docker For hosts to talk to one another you d need to use the link= parameter to create a named alias which would then be inserted into each container s /etc/hosts file for resolution. This is considered legacy so I won t cover it here. The preferred approach now is user-defined networks within Docker.

77 DNS in Docker For user-defined networks, Docker containers have a special stub resolver. The Docker host runs its own DNS Server for user-defined networks. It s at

78 Service Discovery SRV records act like MX records, but for any service that needs to be found. Windows Active Directory uses these to locate things like domain controllers.

79 Service Discovery Domain Controllers are listed in Windows DNS: _ldap._tcp.dc._msdcs.example.local

80 Service Discovery Domain Controllers are listed in Windows DNS:

81 Service Discovery If you re joined to a Windows domain that isn t delegated from a public domain name, don t change the DNS resolver or things will break. This should be locked down by Group Policy anyway if you re on a corporate network

82 And so much more Dynamic DNS and DHCP Registration DNSSEC Secure DNS Records DNS Attacks and Defenses Botnet command and control Amplification attacks Onion routing and name resolution

83 But we re out of time...

84 Thanks! Justin Scott -- IT Specialist Operated DtDNS from IT Director at Smart Communications Special thanks to Oregon SQL for inviting me!