Prufy notes
DNS ยท 10 min

DNS in pictures

DNS is a giant distributed lookup table. You ask for a name and a record type, and get an answer that someone, somewhere, is officially in charge of.

How a name becomes an answer

One lookup, start to finishStep through it
You
Resolver
Root
.com
Your DNS host
Step 1 of 9
You ask a resolver
Your computer doesn't know where anything is. It asks a recursive resolver, like Google's 8.8.8.8, to find out.

The cast

Registrar
Namecheap
Sold you the domain. Sets which nameservers it points to.
DNS host
Cloudflare
Answers questions about the domain. Often a different company.
Authoritative server
ada.ns.cloudflare.com
The DNS host's machine holding the real data, right now.
Recursive resolver
Google 8.8.8.8
Does the legwork for everyone else, and caches what it finds.
Zones are boxes inside boxes
The root, run by the root operators
com, run by Verisign
The example.com zone, run by your DNS host
example.com (the apex)www.example.commail.example.com_prufy-challenge.example.com
The apex is the top of a box. A zone cut is where one box hands off to another. To find which box a name is in, you walk upward until a level has nameservers.

Propagation is a myth

Nothing actually propagates. When you save a record, the authoritative server has it almost at once. What takes time is caches expiring. Drag the slider and watch the engine's verdict change.

Scrub through propagationThe verdict below is the real classifier
ns1 (authoritative)
Has the record
ns2 (authoritative)
Has the record
Google (a cache)
Has the record
Cloudflare (a cache)
Has the record
not_found
We can't see the record yet
New records usually appear within a few minutes. We asked Cloudflare directly and it doesn't have this one yet.
Each cache had remembered 'nothing there' from before you added the record. Nothing is travelling. Those memories are just expiring at different times.

Two kinds of response

Every response has a status, called an . What matters is which group it falls in.

A real answer
NOERROR with records
Here's the data
NOERROR, empty (NODATA)
The name exists, with no record of that type
NXDOMAIN
This name doesn't exist
We learned nothing
SERVFAIL
The server couldn't work it out
REFUSED
The server won't answer that
Timeout
No response at all

The records that matter here

TypeHoldsWhy it comes up
TXTFree textThis is the proof. One name can hold many.
NSThe nameservers for a zoneHow we find who's in charge.
CNAMEAn alias for another nameA name with a CNAME can't hold anything else.
A / AAAAIPv4 and IPv6 addressesHow we reach each nameserver.
SOAFacts about a zoneMostly just part of the machinery.

Two ways of asking

  • Classic DNS is unencrypted UDP on port 53. It's how you reach an authoritative server directly, and someone on the path could forge a reply.
  • DNS over HTTPS is a normal encrypted web request to a public resolver. It's tamper-evident, but you're getting that resolver's view, possibly from cache.

Each one covers the other's weakness. That's the heart of the next two chapters.