nameserver: DNS

A nameserver, also called a DNS server, is an essential part of the infrastructure of the internet. It stands for Domain Name System and ensures that people do not have to remember a series of numbers to visit websites, but can simply type a name, such as pixzo.nl or google.com. Behind the scenes, the nameserver translates these human-friendly domain names into IP addresses – the real addresses on the internet, such as 192.0.2.1 for IPv4 or 2001:db8::1 for IPv6. Without nameservers, using the internet would be inconvenient and error-prone.

The process begins when a user enters a domain name in a browser. The operating system then asks a nameserver which IP address belongs to that name. This request is called a DNS query. The nameserver searches its cache or configuration for the answer. If it knows it directly, it returns the IP address. If not, it looks it up through a chain of other nameservers, starting with the root servers, then the top-level domain (TLD) servers (such as .com or .nl), and finally the authoritative nameserver responsible for the domain in question.

There are different types of nameservers. The authoritative nameserver contains the official information about a domain, such as which IP addresses belong to which subdomains. This server is configured by the domain administrator and is the source of truth for that domain. In addition, there are recursive nameservers. These act as an intermediary: they receive the query from the client, perform the lookup at the authoritative servers and return the answer. Recursive servers often cache results to increase speed and reduce load on the network.

In Linux systems, communication with nameservers is handled via the resolver. The resolver is not a separate program, but a collection of functions in the C library (glibc) that ensures domain names can be converted to IP addresses. The configuration of the resolver takes place in the file `/etc/resolv.conf`. This file contains a list of nameservers that should be consulted, for example:

``` nameserver 8.8.8.8 nameserver 1.1.1.1 ```

These lines indicate that the system should first consult the Google DNS server (8.8.8.8), and if it does not respond, the Cloudflare server (1.1.1.1). The file `/etc/resolv.conf` is a text file that can be modified manually or automatically, for example by network management tools such as NetworkManager or systemd-networkd.

A modern development in the management of DNS resolution on Linux is `systemd-resolved`. This is a system service that can fulfill the role of both resolver and recursive nameserver. `systemd-resolved` offers an integrated solution for DNS, LLMNR (Link-Local Multicast Name Resolution) and MulticastDNS. It caches DNS answers and performs DNSSEC validation, which means that it checks whether the DNS answers actually come from the correct source and have not been manipulated. `systemd-resolved` communicates with local applications via a D-Bus interface and a special stub resolver on 127.0.0.53.

For troubleshooting DNS problems, various command-line tools are available. One of them is `nslookup`. This program allows users to perform DNS queries interactively or non-interactively. In interactive mode, you can ask multiple questions without restarting the program. In non-interactive mode, it directly returns the result of a single query. `nslookup` can retrieve information about A records (IPv4), AAAA records (IPv6), MX records (mail servers), CNAME records (aliases) and more. The program returns an exit status of 1 if an error occurs, for example on a timeout or an invalid answer.

Another powerful tool is `dig` (Domain Information Groper). `dig` is more flexible and extensive than `nslookup` and is widely used by system administrators. It can perform queries to specific nameservers, request certain record types and show detailed information about the communication between client and server. The output of `dig` is structured in sections: the command, the query, the answer, the authority and the additional information. `dig` supports both IPv4 and IPv6 and can be used to test DNSSEC validation.

In addition, there is `drill`, a tool similar to `dig` but specifically designed for use with DNSSEC. The name is a play on `dig`. `drill` can, like `dig`, retrieve information from DNS servers, but places more emphasis on the security aspects of DNS. It is part of the ldns library and is often used in security research or when testing DNSSEC implementations. By default, `drill` uses the nameservers configured in `/etc/resolv.conf`, unless another server is explicitly specified.

For systems that use `systemd-resolved`, there is the `resolvectl` command. This command allows users to resolve domain names, IP addresses, DNS resource records and services via the `systemd-resolved.service`. `resolvectl` can also be used to check the status of the resolver, view the current DNS configuration or reconfigure the resolver. It is a powerful tool for debugging DNS problems in modern Linux distributions that use systemd.

Another tool is `rndc`, the name server control utility. This program is used to manage a running nameserver, such as BIND. Via `rndc`, administrators can restart the server, clear the cache, request statistics or force zone transfers. `rndc` communicates via a secure TCP connection and uses digital signatures for authentication, preventing unauthorized access.

For testing purposes, there is `ldns-testns`, a simple fake nameserver. This tool is intended for debugging and development. It can give predefined answers to DNS queries, even if those answers are invalid or invalid to parse. This makes it suitable for testing how clients respond to faulty or malicious DNS answers. `ldns-testns` listens by default on IPv4 via UDP and TCP, and can be configured with a datafile containing the desired answers.

`dirmngr` also plays a role in network communication, although not directly as a nameserver. It is a network access daemon for GnuPG and provides access to OpenPGP keyservers, downloading certificate revocation lists (CRLs) and communication with OCSP servers. Although `dirmngr` does not perform DNS queries, it is part of the broader network infrastructure that makes secure communication possible, in which DNS plays a fundamental role.

The configuration of DNS in Linux is therefore an interplay of files, services and tools. The file `/etc/resolv.conf` is still central, but is often managed automatically by systems such as `systemd-resolved` or `NetworkManager`. The choice of tools such as `nslookup`, `dig`, `drill` or `resolvectl` depends on the goal: quick resolution, thorough debugging or testing security.

Nameservers are therefore not just technology, but a fundamental layer in the functioning of the internet. They make using the network accessible, but are also vulnerable to attacks such as DNS spoofing or DDoS. That is why security techniques such as DNSSEC and cached, validated resolution via `systemd-resolved` have become increasingly important. Understanding how nameservers work, and how they can be managed and tested, is essential for anyone who works with servers, networks or hosting.