What is a domain name and how does DNS work?

This article explains what domain names are, how the Domain Name System (DNS) works, and which tools you use for DNS management. Aimed at developers and system administrators who work with DNS records.

Requirements

- Basic knowledge of networks and IP addresses - Access to a terminal with `whois` (version 5.5.7 or newer) and `tsig-keygen` (part of BIND 9.18+) - A registered domain (optional, for testing DNS records)

Steps

1. Understand what a domain name is

A domain name is a readable name that users type into a web browser to access a website. Instead of remembering a series of numbers, such as an IP address, people use domain names like `voorbeeld.nl` or `google.com`. These names are easier to remember and share.

2. Learn how DNS works

DNS is the system that translates domain names into IP addresses. It works like a phone book for the internet. When a user enters a domain name, the computer needs to know which server that name refers to. The process begins on the local computer. If the name is not in the temporary memory buffer (cache), the computer contacts a DNS server to request the information.

3. Know the DNS hierarchy

The DNS system consists of different types of servers: - Root servers: manage the highest layer in the domain name hierarchy and point to TLD servers - TLD servers (Top-Level Domain servers): manage top-level domains such as `.nl`, `.com`, `.org` - Authoritative nameservers: contain the actual DNS records for a specific domain

When a root server has indicated which server manages the `.com` domain, the lookup is forwarded to that TLD server. That server then knows which authoritative nameserver is responsible for the specific domain.

4. Understand the domain name structure

Domain names consist of multiple parts. Take `www.nu.nl`: - `.nl` is the top-level domain - `nu` is the second-level domain, registered by an organization or individual - `www` is a subdomain, often used for web servers (not mandatory)

5. Register a domain name

Register a domain name with a domain registrar. This party manages the link between the domain name and the DNS settings. After registration, you can set DNS records: - A records: for IPv4 addresses - AAAA records: for IPv6 addresses - MX records: for email traffic - CNAME records: for aliases

6. Use `whois` for domain information

The `whois` command retrieves information about a domain name. It shows the owner, registration date, expiration date, and nameservers. This is a client for the whois directory service and searches for information in an RFC 3912 database. The tool automatically selects the correct server for the lookup, depending on the specified domain. If no suitable server is found, it connects by default to `whois.networksolutions.com`.

whois voorbeeld.nl

7. Secure DNS updates with `tsig-keygen`

TSIG (Transaction Signatures) is a security mechanism for dynamic DNS updates, defined in RFC 2845. It ensures that DNS updates are performed securely. The tool `tsig-keygen` generates cryptographic keys for this purpose.

tsig-keygen -a hmac-sha256 mijnsleutel

8. Implement DNS caching

DNS caching speeds up the lookup process for repeated visits. The computer and intermediate servers temporarily store DNS information in a cache. This means the full path from root server to authoritative nameserver does not need to be traversed every time.

Verification

Check whether your DNS works correctly with the following commands:

Check whether a domain name correctly translates to an IP address
dig voorbeeld.nl A</p><p>Check the nameservers of a domain
dig voorbeeld.nl NS</p><p>Check whether TSIG keys are correctly generated
tsig-keygen -a hmac-sha256 testsleutel

If `dig` returns an IP address for your domain, DNS resolution works correctly.

Frequently asked problems

1. DNS changes do not work immediately

DNS changes require propagation time. This can take from a few hours up to 48 hours. Check whether the TTL (Time To Live) of your DNS records is correctly set. A lower TTL speeds up propagation, but increases the DNS load.

2. `whois` returns no result for a certain domain

Not all TLDs support `whois` lookups in the same way. Some TLDs such as `.io` use a separate whois server. Try explicitly specifying the correct server:

whois -h whois.nic.io voorbeeld.io

3. TSIG key is rejected during DNS updates

Check whether the time on your server is correctly synchronized. TSIG uses timestamps for validation. Use NTP (Network Time Protocol) to synchronize the clock. A difference of more than 5 minutes causes rejection.

The DNS system continues to evolve. DNS over HTTPS (DoH) and DNS over TLS (DoT) are gaining ground as secure alternatives to traditional DNS queries. These protocols encrypt DNS traffic and protect against eavesdropping and manipulation. The transition to these new standards is gradual, but the underlying hierarchy of root servers, TLD servers, and authoritative nameservers remains unchanged for now.

← Back to knowledge base