Alibaba Cloud DNS:Basic concepts

Two classification dimensions of DNS

DNS can be classified along two dimensions:

Domain hierarchy

Domain names use a hierarchical tree structure for naming. Each host or router connected to the Internet has a unique hierarchical name. A domain name consists of a sequence of labels separated by dots (periods).

Examples

• .com is a top-level domain;

• aliyun.com is a second-level domain (also known as a registered domain or apex domain);

• example.aliyun.com and www.aliyun.com are subdomains, also called third-level domains;

• test.example.aliyun.com is a subdomain of a subdomain, also called a fourth-level domain.

DNS server hierarchy

The DNS resolution process involves four levels of DNS servers:

Each level of the domain hierarchy has its dedicated name server, with the root name server at the top. Each layer of name servers stores the IP addresses of lower-level name servers, enabling step-by-step queries.

DNS resolution process

The domain name resolution process when a user accesses a website through the domain example.com is as follows:

1. The user enters example.com in the browser and the browser initiates a query request to the local DNS server. If the local DNS server has cached resolution data, it directly returns the IP address corresponding to example.com to the browser, and the process jumps to step 9. If no cached data is found, the process continues to step 2.

2. The local DNS server queries the root name server.

3. The root name server returns the address of the .com TLD name server to the local DNS server.

4. The local DNS server sends a query request for example.com to the .com TLD name server.

5. The .com TLD name server returns the address of the authoritative name server for example.com to the local DNS server.

6. The local DNS server sends a query request to the authoritative name server.

7. The authoritative name server returns the IP address corresponding to example.com to the local DNS server.

8. The local DNS server returns the IP address to the browser.

9. The browser accesses the website server using the IP address.

10. The website server returns the webpage content.

Recursive query

Recursive query means the recursive DNS server completes the entire query process on behalf of the client. Each step is handled by the recursive server, which returns the final result directly to the client. For example:

• The client submits a request to the local DNS (recursive DNS server) asking for the IP address of www.example.com.

• If the recursive server does not know the answer, it sequentially queries the root name server, TLD server, and authoritative name server, following each step until it obtains the final answer.

• The client only needs to wait for the recursive server to provide the final resolution result.

Characteristics

• The client sends a single query and waits for a single response.

• The recursive server carries a relatively high load because it must complete the entire query process.

• This is the most common method used between clients and local DNS servers.

Common applications

• Regular users, PCs, and browsers: Use only recursive queries and do not process iterative queries.

• Local DNS servers (such as your broadband carrier's DNS, public DNS like 8.8.8.8, or a company intranet DNS): Typically take on the role of recursive resolution and initiate iterative queries to upstream servers (root, TLD, and authoritative DNS).

• Public DNS servers: Act recursively for end users and iteratively for upstream DNS servers.

Iterative query

Iterative query means the DNS server provides the querying server with the best reference it has. If the server does not have the answer itself, it tells the querying server where to ask next, and the querying server continues the process. For example:

• The local DNS server queries the root name server for the IP address of www.example.com. The root name server does not return the IP address directly; instead, it responds with a referral: "Query the TLD server." The root name server is performing iterative resolution.

• The local DNS server then queries the TLD server, which responds with another referral: "Query this authoritative name server." The TLD server is performing iterative resolution.

• This continues step by step until the authoritative server is found and the final result is returned to the local DNS server.

Characteristics

• The querying server sends a query at each step of the resolution chain.

• Each server carries a relatively low load, as it only returns a referral rather than completing the full query.

Common applications

• Root name servers, TLD servers, and authoritative name servers.

• Self-built DNS servers for enterprises, schools, and other organizations.

• Public DNS servers: Act recursively for end users and iteratively for upstream DNS servers.

DNS record

DNS records define how a domain name is resolved. Once you add a domain to Alibaba Cloud DNS, you need to configure its DNS records to specify where the domain points, such as an IPv4 address, an IPv6 address, another domain name, or a mail server address. When the domain is accessed, the DNS system returns the target address based on these records, mapping the domain name to its designated destination.

DNS cache

A DNS cache stores resolution data close to the client that made the request. DNS data can be cached at any level in the query hierarchy. Caching reduces the number of recursive queries and decreases query latency, allowing users to obtain results faster.

TTL

Time to Live (TTL) tells the local DNS resolver how long a resolution result can be cached. When the TTL expires, the resolver removes the record from its cache. If a user requests the same domain name again after expiration, the resolver must perform a new query.

IPv4/IPv6 dual stack

A dual IP stack, or dual stack, allows a system to use both the IPv4 and IPv6 protocol stacks simultaneously. The two protocol stacks run in parallel.

DNS query flood attack

A DNS query flood attack is a type of denial-of-service (DoS) attack where an attacker uses multiple compromised machines to send a massive volume of domain name queries to a target DNS server. If the number of queries per second exceeds the server's processing capacity, legitimate resolution requests may time out, impacting service availability.

DNSSEC

Domain Name System Security Extensions (DNSSEC) uses digital signatures to ensure the authenticity and integrity of DNS responses. DNSSEC can effectively prevent attacks such as DNS spoofing and cache poisoning, protecting users from being redirected to malicious sites and increasing trust in the Internet.

EDNS client subnet

EDNS (Extension Mechanisms for DNS) Client Subnet is a DNS extension protocol submitted by Google that allows a recursive DNS resolver to pass the client's IP address information to an authoritative DNS server.

URL forwarding

URL forwarding, also known as URL redirection, is a technique that uses special server settings to redirect requests for one domain name to another existing website.

Application terminal

Refers to terminal devices and application services used for network access, including but not limited to mobile terminals, IoT devices, and mobile applications.

DNS over HTTPS (DoH)

Encrypts DNS request traffic. Alibaba Cloud Public DNS provides DNS resolution through TLS-encrypted HTTP connections as specified in RFC 8484.

DNS over TLS (DoT)

Encrypts DNS request traffic. Alibaba Cloud Public DNS provides DNS resolution through TLS-encrypted TCP connections as specified in RFC 7858.