YanoSec
Progress0 of 152 lessons complete

Course / 06 Web basics / Lesson 01 of 08

DNS: resolver, authoritative server, A, AAAA, CNAME

Estimated time: 15 min reading · 15 min activity

A browser can use a name such as note.lab.invalid while the network needs an IP address. DNS, the Domain Name System, stores records about names so a client can ask for the information it needs. You will read a small DNS table and follow an alias without sending a query.

A DNS record has a name, a type that describes the kind of information, and data. An A record holds an IPv4 address; an AAAA record holds an IPv6 address. A CNAME record makes one name an alias for another name, its target. The target’s address records supply the address.

The resolver in the worked table is software that obtains DNS answers for a client. An authoritative server publishes records for a zone, an administered part of the DNS name space. These are fictional records. The .invalid ending is reserved for deliberately invalid names, and the IP addresses come from documentation ranges. Read them as supplied evidence rather than addresses to contact. The earlier Networks stage supplies the difference between IPv4 and IPv6; the DNS record type tells you which family the data represents.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Use the complete printed cards with paper or a text editor for notes. No account, external target, or installation is required. A local HTML file can be read as source; that reading does not perform an HTTP exchange. The curl lesson gives a separate optional loopback-lab procedure.
Without a lab
The cards provide the names, byte counts, requests, responses, and stored records needed for the activity. Make a prediction and compare with the supplied reasoning; a practical run can wait. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, normally HTTPS or a local preview. Saving additionally needs usable browser storage.

After this lesson you can:

  • Distinguish a resolver that asks from an authoritative server that publishes a zone.
  • Match an A record to IPv4 and an AAAA record to IPv6 on a printed card.
  • Keep a CNAME on the alias name and the address records on the target name.

01Example

The worked table has two addresses for note.lab.invalid. Read the type column before choosing an address. alias.lab.invalid points to that target with a CNAME. The table is a model of published records, not output from a DNS command.

note.lab.invalid    A      192.0.2.10
note.lab.invalid    AAAA   2001:db8::10
alias.lab.invalid   CNAME  note.lab.invalid

The resolver asks. The authoritative server for lab.invalid publishes the zone.
A is the IPv4 record. AAAA is the IPv6 record.

02Resolver and authority

A resolver is software that obtains DNS answers on behalf of a client. It may answer from a cache, a stored copy of earlier information, or ask other DNS servers. An authoritative server publishes the records for a zone, an administered part of the DNS name space. Here the zone is lab.invalid.

Following alias.lab.invalid means following its CNAME target, note.lab.invalid, then choosing the target’s A or AAAA record. In these cards the alias has only the CNAME; the target has the address records. Do not attach an A or AAAA address to the same alias name.

A cached answer has a time to live, or TTL, that limits how long the resolver may reuse it. An address can change while a previous answer is still cached. These fictional tables supply no measured TTL. Also, obtaining an address does not demonstrate that a service is listening on a port: DNS and the later connection are separate steps.

Follow resolver/authority roles, CNAME target and target A/AAAA records without inventing an actual DNS lookup.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

Resolver: asksAsking role.
Authoritative server for lab.invalid: publishesPublishes the lab.invalid zone.
  1. Resolver: asks → Authoritative server for lab.invalid: publishesAsk about alias.lab.invalidExample data only; no actual lookup.
  2. Authoritative server for lab.invalid: publishes → Resolver: asksalias.lab.invalid CNAME note.lab.invalidCNAME names a target, not an address copied onto the alias.
  3. Resolver: asks → Authoritative server for lab.invalid: publishesAsk for note.lab.invalid AThe resolver asks for the target’s IPv4 record.
  4. Authoritative server for lab.invalid: publishes → Resolver: asksnote.lab.invalid A 192.0.2.10A supplies the target’s documentation IPv4 address.
  5. Resolver: asks → Authoritative server for lab.invalid: publishesAsk for note.lab.invalid AAAAThe resolver asks for the target’s IPv6 record.
  6. Authoritative server for lab.invalid: publishes → Resolver: asksnote.lab.invalid AAAA 2001:db8::10AAAA supplies the target’s documentation IPv6 address.

The resolver asks the authority for the supplied alias.

Follow the explanation

  1. The resolver asks the authority for the supplied alias.
  2. The CNAME points alias.lab.invalid to note.lab.invalid; it is not itself an address.
  3. The target’s A record supplies IPv4 192.0.2.10.
  4. The target’s AAAA record supplies IPv6 2001:db8::10.
Read every state and value

1. The resolver asks the authority for the supplied alias.

Messages shown
Ask about alias.lab.invalid
Current message
Ask about alias.lab.invalid
Policy decisions
None
Participant roles
Actor: Resolver: asks; Text: Asking role. · Actor: Authoritative server for lab.invalid: publishes; Text: Publishes the lab.invalid zone.

2. The CNAME points alias.lab.invalid to note.lab.invalid; it is not itself an address.

Messages shown
Ask about alias.lab.invalid · alias.lab.invalid CNAME note.lab.invalid
Current message
alias.lab.invalid CNAME note.lab.invalid
Policy decisions
None
Participant roles
Actor: Resolver: asks; Text: Follows the named target. · Actor: Authoritative server for lab.invalid: publishes; Text: Publishes CNAME alias → target.

3. The target’s A record supplies IPv4 192.0.2.10.

Messages shown
Ask about alias.lab.invalid · alias.lab.invalid CNAME note.lab.invalid · Ask for note.lab.invalid A · note.lab.invalid A 192.0.2.10
Current message
note.lab.invalid A 192.0.2.10
Policy decisions
None
Participant roles
Actor: Resolver: asks; Text: Receives the target A answer in this model. · Actor: Authoritative server for lab.invalid: publishes; Text: Publishes note.lab.invalid A 192.0.2.10.

4. The target’s AAAA record supplies IPv6 2001:db8::10.

Messages shown
Ask about alias.lab.invalid · alias.lab.invalid CNAME note.lab.invalid · Ask for note.lab.invalid AAAA · note.lab.invalid AAAA 2001:db8::10
Current message
note.lab.invalid AAAA 2001:db8::10
Policy decisions
None
Participant roles
Actor: Resolver: asks; Text: Receives the target AAAA answer in this separate modeled choice. · Actor: Authoritative server for lab.invalid: publishes; Text: Publishes note.lab.invalid AAAA 2001:db8::10.
Follow resolver/authority roles, CNAME target and target A/AAAA records without inventing an actual DNS lookup.

03Read the IPv6 answer

Use the fresh activity names shelf.lab.invalid and short.lab.invalid. The transcript supplies a resolver’s requested information and the fictional published answer. Cover the check line until you have chosen the data and traced the alias.

Original fictional zone card for lab.invalid. This card is not a dig transcript.
Names use the .invalid suffix. Addresses are documentation values.

Worked names
Name                Type   Data
note.lab.invalid    A      192.0.2.10
note.lab.invalid    AAAA   2001:db8::10
alias.lab.invalid   CNAME  note.lab.invalid

alias.lab.invalid holds only the CNAME. The address records sit on note.lab.invalid.
A resolver asks. The server that is authoritative for lab.invalid publishes this zone.
A cached copy can be older than this card. No TTL was measured, so none is printed.

Download the worked zone card

Original fictional transcript. Not dig output. No query was sent.

Question seen by the resolver
Name: shelf.lab.invalid
Asked for the IPv6 address record

Answer published for that name
shelf.lab.invalid    AAAA    2001:db8::23
shelf.lab.invalid    A       192.0.2.23

Also published
short.lab.invalid    CNAME   shelf.lab.invalid

short.lab.invalid holds only the CNAME. The address records sit on the target name.
Predict which data answers the IPv6 question.
Check: 2001:db8::23

Download the activity transcript

  1. Find the request for shelf.lab.invalid. It asks for an IPv6 address, so inspect the address record for that family.
  2. Copy the data on that row. Compare with the activity check: 2001:db8::23. The other address, 192.0.2.23, belongs to IPv4.
  3. Follow short.lab.invalid to its target shelf.lab.invalid. Explain why the address stays on the target’s row rather than moving to the alias.
  4. Write one limit: this table supports a name-to-address reading, not proof of a working web service. Stop without running a DNS tool or contacting these names.

04Optional challenge

For about ten extra minutes, write the alias chain as short.lab.invalid → shelf.lab.invalid → 2001:db8::23 for the stated IPv6 request. Your explanation should distinguish the alias target, which is a name, from the final address.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

DNS case A: independent published zoneOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Zone: grove.invalid. Authoritative server grove-ns publishes these records. Resolver seek obtains answers for a client and has no usable cached answer.
fern.grove.invalid CNAME leaf.grove.invalid
leaf.grove.invalid A 192.0.2.93
leaf.grove.invalid AAAA 2001:db8::93
Client asks seek for an IPv6 address for fern.grove.invalid.

DNS case B: proposed changeOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Proposed records for the same alias name:
twig.grove.invalid CNAME leaf.grove.invalid
twig.grove.invalid A 192.0.2.94
Use the lesson rule: keep the CNAME on its alias name and address records on the target name.

06Explain your prediction

Optional written self-check: Record resolver, authority, alias target and selected address-family record separately. State that a DNS answer is not evidence that a service is reachable or that testing is permitted.

07Common mistakes

If you choose 192.0.2.23 for the IPv6 request, compare the type column with the requested family before copying the data.

If you put an address on the CNAME alias, trace the target first. The supplied address records belong to shelf.lab.invalid.

If a DNS answer becomes a claim that a web request succeeded, identify the missing connection and request evidence. This fictional table contains neither.

References