DNS Flashcards
What is a stub resolver?
Provides recursive resolution fora system
What is a (dns) forwarder?
forwards dns queries to another resolver
What is a authorative name server?
Has auth info on set of zones. Gets queried
What is a TLD nameserver?
auth nameserver for TLD zone
Name the 5 components of an DNS message
Header, Question, Answer, Authority, Additional
Name the 6 most important DNS types?
A - IPv4 AAAA - IPv6 CNAME - domain name NS - Auth name server SOA - Start of zone authoritz MX - Mail eXchange
What is a DNS zone?
Content of a contiguous section of the domain space bounded by administrative boundaries. Each zone is in a separate file with entries called Resource Records.
- Starts with SOA record, ends with next SOA record
What are delegations on DNS?
NS record pointing to authoritive NS for zone
What are glue records?
Records in parent zone that resolve FQDN of NS for child zone.
Non authoritive records in parent zone
What problem can arise if the NS records points to an IP address
it might not be reachable
What problem can arise if there is a typo in the domain name?
Domain highjacking might be possible. Or domain name is not registrable -> reliability issue
What is lame delegation?
NS record pointing to host without DNS service or without authoritive infomation
What is Trusted Computing Base (TCB)?
Set of components critical to a systems security.
In DNS, a TCP consists of all zones in the delegation path for this zone.
Name the 2 requirements for name server resilience
- NS which provide redundant service for the data in zone
- Servers must be placed at both topologically and geographically dispersed
Where do we continue?
DNS Slide 80
Which transport protocol does edns use?
It uses tcp as fallback if packets are too large
Name 3 protocols that should enhance the security of dns?
Dnssec - auth & integrety
Dns enc: encryption (dns over tls) DoH
Qname minimization: protects privacy of client & reduces info sent to server
What does dnssec add to the dns queries
Signs dns records with pub keys. Chain of trust from root auth server
Rrsig (resource record sign)
Dnskey: pubkey
Nsec/nsec3: next sec record
What are pros and cons of dns enc?
\+ Client traffic encrypted - internal dns can be overwritten ? Faster? ? Prevents censorship? ? Prevents collection - not at resolver level
How does qname work?
It sends the exact qname only to root ns. Subsequent recursion lookups only resolve the Label for each auth ns.
