Unfinished Content This page needs some work; contributions are welcome!
My favourite tool for investigating the DNS is dig, because it produces very clear and detailed output, for example:
$ dig pajhome.org.uk ; <<>> DiG 9.2.1 <<>> pajhome.org.uk ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;pajhome.org.uk. IN A ;; ANSWER SECTION: pajhome.org.uk. 86400 IN A 184.108.40.206 ;; AUTHORITY SECTION: pajhome.org.uk. 86400 IN NS ns0.serve.co.uk. pajhome.org.uk. 86400 IN NS ns0.serve.net.uk. ;; ADDITIONAL SECTION: ns0.serve.co.uk. 103288 IN A 220.127.116.11 ns0.serve.net.uk. 103288 IN A 18.104.22.168 ;; Query time: 370 msec ;; SERVER: 22.214.171.124#53(126.96.36.199) ;; WHEN: Fri Dec 20 17:40:36 2002 ;; MSG SIZE rcvd: 149
Here we have looked for the A record - the IP address corresponding to the domain name. We get this back in the "answer" section, but we also get the "authority" section which specifies the authoritative name servers for the domain. The "additional" section is for efficiency - it saves us looking up the IP addresses of the name servers.
Most of the complexity here is only needed for communication between DNS servers - clients have little need for the details, but they are still present in the protocol. Dig provides a complete readable dump of the packet received.
Dig is available by default on most Unix systems. The easiest way to get it on Windows is to install BIND. To get it to work properly, you need to create a file called
$ dig pajhome.org.uk mx ; <<>> DiG 9.2.1 <<>> pajhome.org.uk mx ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; QUESTION SECTION: ;pajhome.org.uk. IN MX ;; ANSWER SECTION: pajhome.org.uk. 86400 IN MX 5 mail.pajhome.org.uk. ;; AUTHORITY SECTION: pajhome.org.uk. 77100 IN NS ns0.serve.co.uk. pajhome.org.uk. 77100 IN NS ns0.serve.net.uk. ;; ADDITIONAL SECTION: mail.pajhome.org.uk. 86400 IN A 188.8.131.52 ns0.serve.co.uk. 93988 IN A 184.108.40.206 ns0.serve.net.uk. 93988 IN A 220.127.116.11 ;; Query time: 300 msec ;; SERVER: 18.104.22.168#53(22.214.171.124) ;; WHEN: Fri Dec 20 20:15:36 2002 ;; MSG SIZE rcvd: 170
This time we have queried the MX records for pajhome.org.uk. The MX or Mail eXchanger specifies the machine that handles email for the domain. There is only one in my case, but several can be specified. The 5 next to the machine name specifies the priority of that MX record; the lowest priority is tried first, e.g.
;; QUESTION SECTION: ;msnbc.com. IN MX ;; ANSWER SECTION: msnbc.com. 900 IN MX 10 mail1.msnbc.com. msnbc.com. 900 IN MX 20 mail2.msnbc.com. msnbc.com. 900 IN MX 30 mail3.msnbc.com.
Other record types
SOA, NS, CNAME. DNS supports a few other records, for example TXT records containing arbitrary text, but these are rarely used.
Zone filesThe significance of the terminating dot The serial number... how to recover an inadvertently incremented one
Reverse DNSAnd classless redelegation
Efficiencyglue records / glueless domains
Two types of DNS server
Checking zone delegationRelevance of glue records
More interesting one is 'aa' - authoritative answer.
You always get an aa response from a server that is authoritative for that domain. If you query a recursive resolver, you get an aa response if it's not cached, but then non-aa in future.
NominetThe .uk registry