The Internet address is the numeric IP address, for example, 61.135.169.125is one of Baidu's official website address, if each visit Baidu will need to enter the IP, it is estimated that today the Internet is not out of obscurity stage.
In the history of the network, beginning indeed is the direct use IP addresses to access the remote host. Early each networked computers are using host files (which are commonly called hosts file) to configure and address resolution, then more and more networked machine, update and synchronize it becomes a big problem host file. Then, in 1983, Paul Mockapetris invented the Domain Name System and Domain Name Service, in January 1, 1985, the world's first domain name nordu.net was only successful registration.
Domain names are easier to remember than an IP address, just essentially provides easy to remember aliases for digital Internet resources, as instituted in Beijing "Palace Museum" to know it refers to the "Jingshan Front Street, Dongcheng District No. 4" of the big Like the yard. If the IP address as a phone number, that the domain name system is the address book. Our information is stored in the address book of friends and family, by name each time to find someone to call, contacts will find out the phone number associated with it, then dial in the past. We may remember how much less than the full phone number, but the name of the contact is certainly remember.
Since the "domain name" is just an alias, a name which alone we can not have access to the correct address, the domain name can only resolve to the actual network addresses, network access to be successful. This analytical work by a dedicated "Domain Name System" (Domain Name System, referred to as DNS) to complete, DNS is one of the core Internet infrastructure services.
DNS is how to complete
DNS resolution is the process of what look like? Before starting this question, let's take a look at the hierarchy of domain names.
The domain name hierarchy
In discussing the domain name, we often hear people say, "top-level domain" "level domain," the concept of "second-level domain," and so on, what level domain name is how divided it?
-
Root domain. Or in Baidu, for example, through a number of domain name resolution tool, we can see that Baidu official domain name is displayed as
www.baidu.com., careful people will notice, there is a final here., this is not a bug, but the tail of all domain names have a root domain.www.baidu.comThe real domain name iswww.baidu.com.rootabbreviated towww.baidu.com., but also because the root domain name.rootis the same for all domain names, it is usually omitted, eventually becomes our common look. -
The next level is called the root domain TLDs (top-level domain, abbreviated TLD), also known as a domain name, such as the common .com / .net / .org / .cn and so on, they are the top-level domain.
-
Then the next is called a second-level domain (second-level domain, abbreviated as SLD), such baidu.com. This is the highest level we were able to buy the domain name and registration.
-
Under sub-domains, is the host (Host), it may also be referred to as a third-level domains, such www.baidu.com, thereby down substantially additional domain is the N-stage one before the N-1 level domain.
In summary, the common domain name hierarchy is as follows:
主机名.次级域名.顶级域名.根域名
# ie
www.baidu.com.root
复制代码Generally we buy a domain name is to buy a second-level domain (SLD) of management rights (such as leancloud.cn), with the right management we can arbitrarily set three, four domain names.
Domain name resolution process
Is a tree structure, different levels of the hierarchy to resolve the domain name corresponds, DNS domain name system from a different domain name server, the whole process is a "hierarchical" in.
Hierarchical DNS system is the first layer of the root name servers, root name servers worldwide IPv4 only 13 units (names are A to M), 1 Ge-based root servers in the United States, and the remaining 12 were supplemented by the root servers, they responsible for managing domain information around the world. Here is the top-level domain root server server, database management domain name that is relevant national institutions, such as the China Internet Network Information Center (CNNIC). And then again the next level of authoritative name servers and ISP's cache server.
A domain name must first be resolved after the root of the database, in order to go to the top-level domain name server for resolution, which is somewhat similar to the case to ask the way of life.
Assuming that Beijing has set up a special "Road Advice Bureau", which is set up by the Secretary, the Minister, the Director, Staff, several levels of civil servants, different departments, departments, staff responsible for answering questions in different areas of the road. People here have a common feature, believe in "a good memory as bad written" philosophy, would like to record the information they learned to the notebook. But one thing unfortunately, they write with ink only one, called "magic ink" early write writing strong, then slowly fades after one hour it will completely disappear. Road Advice Bureau door and a guard uncle, all of them need to ask him to convey through and respond to the public and can not enter the office building.
If people come to Mr. A guard asks Grandpa address "Beihai Park", guard uncle would look at his notebook, there is no one asked to see the room before Beihai Park, and if not, he would go inside to call for help Secretary . The Secretary said that the North Sea is the Xicheng District, you ask the minister responsible for road information Zhao Xicheng it. Guard uncle went to ask the Minister Zhao, Zhao minister about the investigation, said the address you money to ask the Commissioner responsible for the core area of the bar. Director guard uncle and give money to fight the last phone, the money, the Commissioner said this address, I do not grasp ah, you ask about the clerk in charge of Jingshan Area Komago it. Sun guard uncle grew up there finally know Beihai Park address, he hastened to mind their own little book, and the results tell the people Mr. A. Then within an hour, if there are people coming to ask Mr. B Beihai Park, then guard uncle directly with the results recorded on notebook replied. Of course, if people ask Ms. C over other addresses, guard uncle would make inquiries deal with Mr. A process go again up.
Examples of hierarchical queries
Now let's look at a practical example. If we enter in a browser https://news.qq.com, the browser that will be extracted from the received URL in the domain name field (news.qq.com), then pass it on to the DNS client (operating system) to resolve.
First, we explain the local DNS configuration (that is, /etc/resolv.conf file, which specifies the address of the local DNS server, Windows system may vary):
$ cat /etc/resolv.conf
nameserver 202.106.0.20
nameserver 202.106.196.115
复制代码Then we look at using this tool to dig it news.qq.com analysis results (which is part of the Chinese explanation):
$ dig news.qq.com
; <<>> DiG 9.10.6 <<>> news.qq.com
这是 dig 程序的版本号与要查询的域名
;; global options: +cmd
;; Got answer:
以下是要获取的内容。
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47559
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
这个是返回应答的头部信息：
1. opcode：操作码，QUERY 代表查询操作；
2. status: 状态，NOERROR 代表没有错误;
3. id：编号，在 DNS 协议中通过编号匹配返回和查询；
4. flags: 标志，含义如下:
- qr：query，查询标志，代表是查询操作
- rd：recursion desired，代表希望进行递归查询操作;
- ra：recursive available，代表查询的服务器支持递归查询操作;
5. QUERY 查询数，与下面 QUESTION SECTION 的记录数一一对应；
6. ANSWER 结果数，与下面的 ANSWER SECTION 的记录数一一对应；
7. AUTHORITY 权威回复数，如果查询结果由管理域名的域名服务器而不是缓存服务器提供的，则称为权威回复。
0 表示所有结果都不是权威回复；
8. ADDITIONAL 额外记录数；
;; QUESTION SECTION:
;news.qq.com. IN A
查询部分,从左到右部分意义如下:
1、要查询的域名；
2、要查询信息的类别，IN 代表类别为 IP 协议，即 Internet。
3、查询的记录类型，A 记录(Address)代表要查询 IPv4 地址。
;; ANSWER SECTION:
news.qq.com. 136 IN CNAME https.qq.com.
https.qq.com. 476 IN A 125.39.52.26
回应部分，从左到右各部分意义：
1、对应的域名
2、TTL，time to live，缓存时间，单位秒，代表缓存域名服务器可以在缓存中保存的期限。
3、查询信息的类别
4、查询的记录类型，CNAME 表示别名记录，A 记录(Address)代表 IPv4 地址。
5、域名对应的 ip 地址。
;; Query time: 56 msec
;; SERVER: 202.106.0.20#53(202.106.0.20)
查询使用的服务器地址和端口,其实就是本地 DNS 域名服务器
;; WHEN: Thu Jul 11 15:59:37 CST 2019
;; MSG SIZE rcvd: 65
查询的时间与回应的大小，收到 65 字节的应答数据。
复制代码Can see from this response, we get the results are not authoritative reply, but the local DNS server to the response from the cache.
Next we add a parameter in the dig command +traceto see the complete classification query process:
$ dig +trace news.qq.com
; <<>> DiG 9.10.6 <<>> +trace news.qq.com
;; global options: +cmd
. 432944 IN NS g.root-servers.net.
. 432944 IN NS k.root-servers.net.
. 432944 IN NS b.root-servers.net.
. 432944 IN NS h.root-servers.net.
. 432944 IN NS i.root-servers.net.
. 432944 IN NS f.root-servers.net.
. 432944 IN NS d.root-servers.net.
. 432944 IN NS e.root-servers.net.
. 432944 IN NS j.root-servers.net.
. 432944 IN NS l.root-servers.net.
. 432944 IN NS c.root-servers.net.
. 432944 IN NS m.root-servers.net.
. 432944 IN NS a.root-servers.net.
;; Received 228 bytes from 202.106.0.20#53(202.106.0.20) in 45 ms
这些就是神秘的根域名服务器，由本地 DNS 服务器返回了所有根域名服务器地址。
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
;; Received 1171 bytes from 192.36.148.17#53(i.root-servers.net) in 57 ms
这里显示的是 .com 域名的 13 条 NS 记录，本地 DNS 服务器向这些顶级域名服务器发出查询请求，
询问 qq.com 的 NS 记录。
qq.com. 172800 IN NS ns1.qq.com.
qq.com. 172800 IN NS ns2.qq.com.
qq.com. 172800 IN NS ns3.qq.com.
qq.com. 172800 IN NS ns4.qq.com.
;; Received 805 bytes from 192.48.79.30#53(j.gtld-servers.net) in 331 ms
这里显示的是 qq.com 的 4 条 NS 记录，由 j.gtld-servers.net 这台服务器最先返回。
然后本地 DNS 服务器向这四台服务器查询下一级域名 news.qq.com 的 NS 记录。
news.qq.com. 86400 IN NS ns-cnc1.qq.com.
news.qq.com. 86400 IN NS ns-cnc2.qq.com.
;; Received 180 bytes from 58.144.154.100#53(ns4.qq.com) in 37 ms
这里显示的是 news.qq.com 的 NS 记录，它们是由上面的 ns4.qq.com 域名服务器返回的。
然后本地 DNS 服务器向这两台机器查询 news.qq.com 的主机名。
news.qq.com. 600 IN CNAME https.qq.com.
https.qq.com. 600 IN A 125.39.52.26
;; Received 76 bytes from 223.167.83.104#53(ns-cnc2.qq.com) in 29 ms
这是上面的 ns-cnc2.qq.com 返回的最终查询结果：
news.qq.com 是 https.qq.com 的别名，而 https.qq.com 的 A 记录地址是 125.39.52.26
复制代码The actual flow inside the local DNS server is equivalent to the guard uncle, the equivalent of root name servers Secretary comrade, rest and so on. Queries between the client and the local DNS server is called a recursive query, the query between the local DNS server and other domain name server is called iterative query.
Type the domain name record
Domain name server is able to know information mapping domain names and IP addresses, because we submitted the domain records in the Domain Name service provider there. After purchasing a domain name, we need to set the domain name service provider where the DNS records, domain name service provider to these records is pushed to the authoritative domain name server, domain name so that we can enter into force.
In setting the domain name record time, you will encounter "A record" different types "CNAME" and so on, which is the result of DNS do when we met earlier. These types What does it mean, what is the difference between them? Next we look at the common record types.
-
A record . A (Address) records used to directly specify the host name (or domain name) corresponding IP address. Host name is the domain name prefix common are the following:
www: After resolving the domain name is
www.yourdomain.comgenerally used for website addresses.@: Direct resolve the main domain name.
*: The Pan-resolution, refers to * .yourdomain.com resolve to the same IP.
-
CNAME record . CNAME stands for Canonical the Name , commonly known as an alias record. If you need to point the domain name to another domain name, and then provide the IP address of another domain name, you need to add a CNAME record.
-
MX records. Mail exchange record, the domain will be used as end points corresponding to the email message server for processing.
-
NS record. Domain name server records, if you need the target domain name to other DNS servers, you need to add NS records.
-
AAAA record. It specifies the host name (or domain name) of the corresponding IPv6 address is not used.
-
TXT record. You can fill in anything, the length limit of 255. The vast majority of TXT record is used to make an SPF record (anti-spam), MX record's role is to send a letter indicating a domain mail server what. SPF role of the contrary, it indicates to recipients with the MX, which is the result of a domain mail server will send a message of acceptance.
-
Explicit URL. Address from a 301 redirect (also called "permanent transfer") to another address, when you need to add explicit URL record.
-
Hidden URL. 302 jump from one address (also called "temporary jump") to another address, you need to add a hidden URL record. It is similar to the dominant URL, the difference lies in the hidden URL does not change the domain name in the address bar.
Fill in all kinds of records, we will encounter a special settings - TTLsurvival time (Time To Live).
TTLIt represents resolution records in the DNS server cache time, length of time in seconds, typically 3600 seconds. For example: In access news.qq.comtime, if not in the DNS server's cache in the record, it will send a request to a server NS, after obtaining the record, the record will be stored on a DNS server TTLlength of time, in a TTLvisit within the validity period news.qq.com, DNS the cache server directly returned earlier records.
DNS intelligent analytic
The main job is complete DNS domain name to IP mapping, but it is not simple to check the extent of the dictionary you can handle. Set in DNS resolution time, we have some additional requirements, such as:
- A domain name will resolve to multiple IP
For example, when a website we have more than one front-end machine, you want users to access, you can randomly dispersed onto these machines to increase the carrying capacity of the site. One solution is to set up multiple A records for the same domain name, were assigned to a different IP.
- According to a feature request to resolve the differences in the various different IP (Intelligent Analytical)
In fact, the domestic Internet architecture complex than we imagined, basically cut a plurality of parallel networks of different operators, only a fixed number of nodes in the network will have these parallel cross. For example interconnection between Telecom and China Unicom through "national Internet backbone point Direct" access, we are now a total of three batches of building a national Internet backbone Direct points:
1. The first put into use in 2001: Beijing, Shanghai, Guangzhou
2. The second batch of 2014 and put into use: Chengdu, Zhengzhou, Wuhan, Xi'an, Shenyang, Nanjing, Chongqing
3. The third installment of 2017 and put into use: Hangzhou, Guiyang / Gui'an, Fuzhou
Education Network is still only connect through North Canton three points. Such network topologies, DNS resolution to bring new challenges.
Traditional DNS resolution does not determine the source of visitors, will randomly select one of the IP address back to the visitors. If we allow China Unicom IP telecommunications users use to access the site, it is better to use natural result of quick access to the IP telecommunications. The intelligent DNS resolution will determine the source characteristics of visitors, unique visitors returned to a different IP address, resolve to reduce latency and improve network access speed. For example, a well-known domestic DNS service providers can not only distinguish between network operators, you can also set different analytical lines according to the visitor's geographic location, and even search engine can also set a specific resolution addresses.
- A difference between recording and CNAME
As previously explained, A record is to resolve a domain name into an IP address and a domain name CNAME record is to resolve a domain name to another, similar to the function. But CNAME equivalent to adding between domain names and IP address of an intermediate layer, can bring a great deal of flexibility, especially when you want to use but not own the domain name of those times.
For example, we use CDN services, service providers available to us is a CNAME address, we can put your own domain name is bound to this address, so if the IP address of the service provider after the replacement, and we own the domain name resolution is not You need to make any changes, as long as the service providers adjust analytical results CNAME address, all users are not aware of the switch.
From the beginning of the end of 6, LeanCloud launched a new binding custom domain feature full support for developers to set their own API, files, cloud engine domain name, it is also dependent on the characteristics of CNAME records to achieve.
DNS poisoning and security challenges
DNS is the first commercial large-scale distributed systems, although it seems to have very complete, but the actual use, especially in the domestic complex network environment, we will continue to face many problems.
As a product of the early Internet, DNS uses UDP connectionless protocol while lowering costs but also to ensure efficient communications, but not too much to consider security issues. Since it is expressly intended use UDP port 53 to communicate, the DNS resolver is the sole criterion to identify the source port number is the random data packet sent by itself, if the port number is considered correct responses match, authentication source without. It also brings problems such as DNS spoofing, DNS Cache pollution, DNS amplification attacks, while giving some regional operators to bring "business opportunities."
For this reason the industry put forward the DNSSec (Domain Name System Security Extensions, also known as "DNS Security Extensions") mechanism, the use of cryptographic methods allow the client to verify the identity of the source domain, and check the integrity of the response from the DNS domain name server records, and verify that has been tampered with during transmission, so a series of measures to ensure the security of data communications. Readers interested in this aspect, we can focus our follow-up article.