Current network communication mainly uses the TCP/IP protocol, and the foundation of the TCP/IP protocol is the IP address. Therefore, computers in the network can only recognize IP addresses consisting of pure numbers. However, in practical work and daily life, we can access corresponding websites by simply typing a string of easy-to-remember domain names in the browser’s address bar. DNS plays an important role in this process. Next, we will provide a brief introduction to the principles and resolution process of DNS.

1. What is DNS

DNS stands for Domain Name System. DNS is a core service on the internet and is a distributed database used to map domain names to IP addresses. It translates simple and clear domain names into IP addresses that can be recognized by computers, allowing users to access the internet more quickly and conveniently.

The internet connects global resources, and a single domain name server is not enough to support all address translation operations. Therefore, there are multiple sets of domain name servers worldwide working together. As early as 1983, the internet began using a hierarchical tree structure naming method and a distributed domain name system for resolution operations. This both improved the efficiency of domain name resolution and ensured its stability. If a single domain name server in the system fails, it will not significantly affect the normal operation of the entire DNS system.

2. Domain Name Structure

The internet uses a hierarchical tree structure naming method. Any host or router connected to the internet has a unique hierarchical name, known as a domain name.

The structure of a domain name consists of a sequence of labels separated by dots, similar to: “…third-level domain.second-level domain.top-level domain”. Each level of the domain is managed by the domain management organization of the higher level, with the top-level domains being managed by ICANN.

3. Domain Name Servers

DNS domain name servers on the internet are also divided according to hierarchy. Each domain name server only manages a part of the domain system. Based on their roles, domain name servers can be classified into four types:

• Root Domain Servers: These are the highest-level domain name servers and the most important ones. Root domain servers know the domain names and IP addresses of all top-level domain servers. If a local domain name server cannot resolve a domain name, it first seeks help from the root domain server.

• Top-Level Domain Servers: These servers manage all second-level domains registered with them. When a DNS query request is received, they provide a corresponding answer (which may be the final result or the IP address of the next domain name server to query).

• Authoritative Domain Servers: These servers are responsible for a specific zone of domain names. When an authoritative domain server cannot provide the final query answer, it will inform the querying DNS client which authoritative domain server to query next.

• Local Domain Servers: Local domain servers do not belong to the hierarchical DNS structure shown below, but they are crucial to the domain system. When a host sends a DNS query request, the query request is sent to the local domain server. Every Internet Service Provider (ISP) can have a local domain server.

Each domain layer has its own domain name servers, and each layer’s domain name servers know the IP addresses of all domain name servers in the layers below. Therefore, they are interconnected in a tree structure starting from the root domain server. Since all domain name servers know the IP address of the root domain server, it is possible to access the addresses of all domain name servers in the world by tracing from the root server in order.

4. DNS Query Steps

Domain name resolution generally uses recursive queries. The complete domain name resolution process is as follows:

(1) Check Browser Cache

When a user accesses a domain name through a browser, the browser first checks its cache for the IP address corresponding to the domain name (if it has visited the domain before and the cache has not been cleared).

(2) Check System Cache

If the domain name’s IP address is not found in the browser cache, it will automatically check the system’s Hosts file DNS cache for the domain name’s IP address.

(3) Check Router Cache

If the domain name’s IP address is not found in the browser and system caches, it will check the router cache. The above three steps are client-side DNS caches.

(4) Check ISP DNS Cache

If the IP address of the domain name is not found in the client-side caches, the query will go to the ISP DNS cache. For example, if you are using a telecom network, it will check the telecom DNS cache server.

(5) Query Root Domain Servers

If none of the above steps are successful, the query goes to the root servers. There are only 13 root domain servers worldwide: 1 primary root domain server and 12 secondary root domain servers. The root domain server will check the zone file records upon receiving the request. If there is no record, it will provide the IP addresses of the top-level domain servers (such as .com, .cn) within its jurisdiction to the local DNS server.

(6) Query Top-Level Domain Servers

The top-level domain server will check its zone file records upon receiving the request. If there is no record, it will provide the IP addresses of the authoritative domain servers within its jurisdiction to the local DNS server.

(7) Query Authoritative (Primary) Domain Servers

The authoritative domain server will query its cache upon receiving the request. If there is no record, it will query the next-level domain servers and repeat the process until it finds the correct record.

(8) Save Results to Cache

The local domain server saves the returned result to its cache for future use and provides the result to the client. The client can then access the target web server using this IP address. The DNS recursive query process ends here.

The DNS system plays a crucial role in resolving domain names to IP addresses, which is key and fundamental to enabling computer access to the internet. Therefore, the security of DNS resolution is vital for maintaining network stability. Enterprise managers and operators must ensure the security of domain names and domain name resolution, regularly conduct data scans and analyses, enable comprehensive DNS risk monitoring, continuously monitor DNS operating status, and prepare proper emergency backups. Once issues are detected or failures occur, timely responses and solutions are required to minimize DNS failure risks and associated losses.