DNS (Domain name System)

The Domain Name System (DNS) is a network service that allows devices to resolve domain names into IP addresses. It enables users to access network services using names, while the network itself operates using numerical IP addressing.

The Problem DNS Solves

When you access a website, you naturally use a name.

You type name such as youtube.com because name are easy for humans to remember and understand.
Network devices do not communicate using names. Routers and hosts rely on IP addresses to identify destinations and forward traffic across the network.

Figure 1 – Humans use names, devices use IP addresses

This creates a fundamental mismatch:

• Humans think in names.

• Networks operate using IP addresses.

Before any communication with a remote service can begin, this gap must be resolved. The name you use must first be associated with an IP address that the network can reach.

Until this happens, no data can be exchanged and the network cannot forward traffic to the destination. This is the problem DNS is designed to solve.

Now that you understand the problem DNS must solve, let’s look at how DNS works at a high level.

Imagine you are using PC1 and want to watch a video on YouTube. You type youtube.com in the search bar and press Enter. From your point of view, this feels simple and natural because you only need to remember the name of the website, not its IP address.

Figure 2 - Domain Name System (DNS) Topology

However, IP devices do not work this way. They cannot communicate using names and instead require IP addresses to identify destinations on the network. Before any communication with YouTube can occur, the domain name must first be resolved to an IP address.

Sending the DNS Query

At a high level, DNS resolution follows a clear and ordered sequence:

• PC1 starts with a domain name, not an IP address.

• PC1 contacts a DNS server to ask for the IP address associated with that name.

Figure 3 – DNS query sent by the PC to the DNS server to resolve youtube.com

Receiving the DNS Response

• The DNS server processes the request and looks up the corresponding IP address.

• The DNS server replies to PC1 with that IP address.

Figure 4 – DNS response returning the IP address of youtube.com to the PC

• Once PC1 receives the IP address, it can communicate directly with the YouTube server.

• From this point on, the network forwards traffic using the IP address, not the domain name.

The key idea in this section is the order of events. Communication with the remote service cannot begin until the domain name has been resolved into an IP address.

In the next section, you will see what the PC actually asks for when it sends a DNS request.

In the previous section, you saw that PC1 must contact a DNS server before it can communicate with youtube.com. At this stage, PC1 is not sending any data to YouTube yet. It is asking a simple question to a DNS server.

When PC1 sends a DNS request, it only knows the domain name. It does not know any IP address associated with youtube.com, so it needs the DNS server to provide that information.

Figure 5 – The DNS Query

At this point, the question asked by PC1 is straightforward:
"What is the IP address of youtube.com?"

IPv4 and IPv6 Resolution

A DNS server can return different types of information depending on what the client is requesting. In modern networks, a PC may be able to communicate using IPv4, IPv6, or both.

To handle this, DNS uses different record types.

• An A record is used to obtain the IPv4 address associated with a domain name.

• An AAAA record is used to obtain the IPv6 address associated with a domain name.

These records do not change how DNS works conceptually. They only specify which type of IP address the client wants to receive from the DNS server.

At this stage, the important idea is what the PC is asking for, not how the exchange looks on the network.

In the next section, you will observe these DNS requests and responses directly on the network.

Now that you understand what the PC asks for in a DNS request, let’s observe how this exchange appears on the network.

By default, DNS uses the User Datagram Protocol (UDP) and communicates on port 53. Using UDP allows DNS queries and responses to be lightweight and fast, which is important because DNS resolution happens frequently on the network.

With this in mind, let’s look at how DNS resolution actually appears in a packet capture.

Observing the DNS Queries and Responses

Look at the first DNS packets in the capture.

PC1 sends a DNS query asking for information related to youtube.com. This query corresponds to the request discussed earlier, where the PC asks the DNS server for IP address information associated with a domain name.

Figure 6 – DNS A record resolution for youtube.com

In this capture, you can see a DNS query of type A for youtube.com, followed by the DNS response.
This response contains the IPv4 address associated with youtube.com, which PC1 can use to reach the destination using IPv4.

After this exchange, PC1 sends another DNS query for the same domain name.

Figure 7 – DNS AAAA record resolution for youtube.com

This second query is of type AAAA and is followed by a DNS response containing the IPv6 address associated with youtube.com. This provides PC1 with the IPv6 information for the same destination.

At this stage, PC1 has received both the IPv4 and IPv6 addresses associated with youtube.com. It can now use the appropriate address to communicate with the remote service.

In the next section, you will see how this information is stored locally so that DNS resolution does not need to occur every time the same domain name is accessed.

In the previous section, you saw that PC1 received the IPv4 and IPv6 addresses associated with youtube.com.