DNS Protocol Referenz
Referenz für DNS: records, resolution, caching, und Sicherheit extensions (DNSSEC, DoH, DoT).
Record Types and Resolution
DNS maps names to values using typed records: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail exchange), TXT (text), NS (nameserver), SOA (start of authority). Resolution starts at root servers, proceeds through TLD to authoritative servers. Recursive resolvers cache results based on TTL values. The EDNS0 extension allows larger UDP payloads and DNSSEC. Negative caching stores NXDOMAIN responses. DNS uses UDP port 53 by default, falling back to TCP for large responses.
- A/AAAA
- IP address records
- CNAME
- Canonical name alias
- MX
- Mail exchange
name -> IPname -> namename -> server + prefSecurity Extensions
DNSSEC adds cryptographic signatures (RRSIG, DNSKEY, DS) to authenticate responses and detect tampering. DNS over TLS (DoT, port 853) and DNS over HTTPS (DoH) encrypt queries for privacy. DNS over QUIC is emerging. NSEC/NSEC3 records prove non-existence of names. Trust anchors validate the chain from root to zone. DNS rebinding attacks exploit browser DNS caching. Split-horizon DNS serves different answers internally vs externally.
- DNSSEC
- Signed responses
- DoH/DoT
- Encrypted transport
- NSEC3
- Non-existence proof
chain of trustprivacyprevents zone walking