Configuring DNS Servers
The primary purpose of Domain Name System (DNS) is to resolve host names to IP addresses. If you’re planning on taking the Security+ exam or Network+ exam, you should have a basic understanding of DNS servers. For example, can you answer this question?
Q. You need to reboot your DNS server. Of the following choices, which type of server are you MOST likely to reboot?
A. Unix server
B. Apache server
C. BIND server
D. Web server
More, do you know why the correct answer is correct and the incorrect answers are incorrect?
The answer and explanation is available at the end of this post.
Understanding DNS
Systems are constantly querying DNS, though it is usually transparent to users. As an example, imagine that you want to visit http://blogs.getcertifiedgetahead.com/. You enter the URL into your web browser or click a link on a page and your system queries a DNS server for the site’s IP address. Figure 3.2 shows what is occurring between your system and DNS. DNS uses UDP port 53 for these types of queries.
DNS servers host data in zones, which you can think of as a database. Zones include multiple records, including the following:
- A. A record (also called a host record). This record holds the host name and IPv4 address and is the most commonly used record in a DNS server. A DNS client queries DNS with the name using a forward lookup request, and DNS responds with the IPv4 address from this record.
- AAAA. This record holds the host name and IPv6 address. It’s similar to an A record except that it is for IPv6.
- PTR. Also called a pointer record. It is the opposite of an A record. Instead of a DNS client querying DNS with the name, the DNS client queries DNS with the IP address. When configured to do so, the DNS server responds with the name. PTR records are optional so these reverse lookups do not always work.
- MX. Also called mail exchanger. An MX record identifies a mail server used for email. The MX record is linked to the A record or AAAA record of a mail server.
- CNAME. A canonical name, or alias, allows a single system to have multiple names associated with a single IP address. For example, a server named Server1 in the domain GetCertifiedGetAhead.com might have an alias of FileServer1 in the same domain.
Most DNS servers on the Internet run Berkeley Internet Name Domain (BIND) software and run on Unix or Linux servers. Internal networks can use BIND, but in Microsoft networks, most DNS servers use the Microsoft DNS software.
Occasionally, DNS servers share information with each other in a process known as a zone transfer. In most cases, a zone transfer only includes a small number of updated records. However, some transfers include all the records in the zone. DNS servers use TCP port 53 for zone transfers. In contrast, name resolution queries use UDP port 53.
It’s easy to overlook the amount and value of information available in a DNS server. However, if attackers are able to access zone data on an internal DNS server, they can map out an entire network. It lists all the names and IP addresses, and identifies some specific servers such as mail servers. Because of this, DNS administrators configure DNS servers to use secure zone transfers to prevent unauthorized modifications of zone data, and to prevent unauthorized zone transfers.
Remember this
DNS zones include records such as A records for IPv4 addresses and AAAA records for IPv6 addresses. DNS uses TCP port 53 for zone transfers and UDP port 53 for DNS client queries. Most Internet-based DNS servers run BIND software on Unix or Linux servers, and it’s common to configure DNS servers to only use secure zone transfers.
Q. You need to reboot your DNS server. Of the following choices, which type of server are you MOST likely to reboot?
A. Unix server
B. Apache server
C. BIND server
D. Web server
Answer is C. Berkeley Internet Name Domain (BIND) is a type of Domain Name System (DNS) software commonly used on the Internet and in some internal networks, so a BIND server is a DNS server.
BIND runs on Unix servers, but not all Unix servers are BIND servers.
Apache is a type of web server software that runs on Unix and Linux systems.
You might also like to view the blog post about DNS Attacks.