The page that opened for one person only
A DNS lookup turns a name into an address. A machine first checks its own hosts file, then asks a DNS server. Knowing that order is how you fix a name that works on one laptop and not another.
A support engineer gets a call. The shop's web page opens on one laptop and fails on another, on the same network.
The cause is one old line in a small file on the second laptop. It answers for the name before anybody asks the network.
By the end of this lesson
Note
I can use dig to find which record answers for a name.
Key words
| Word | What it means | Example |
|---|---|---|
| Resolver | the part of a machine that looks names up | |
| Hosts file | a short list of names and addresses on the machine itself | /etc/hosts |
| CNAME | a record that says this name is another name | |
| TTL | how many seconds an answer may be kept | 300 |
| NXDOMAIN | the answer that this name does not exist | |
| Zone | the names one DNS server is in charge of | shop.test |
The cells students fill in are left blank in this preview.
A machine looks in two places
Before it asks the network, a machine reads its hosts file. If the name is there, that answer wins. Only then does the resolver ask a DNS server.
A file /etc/nsswitch.conf sets the order. The word files is the hosts file, and dns is the server.
Read the order the machine uses
grep '^hosts' /etc/nsswitch.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look a name up the way programs do
getent hosts localhostShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A DNS server answers from records
A DNS server holds a zone, the names it is in charge of. Each name has records, and each answer carries a TTL, so a resolver may keep it for that long.
Here you start a small server of your own for an invented shop. It listens on port 5300, on this machine only, and holds one zone, shop.test.
Start a practice server for shop.test
sudo dnsmasq --conf-file= --no-hosts --no-resolv --port=5300 --listen-address=127.0.0.1 --bind-interfaces --local-ttl=300 --local=/shop.test/ --host-record=shop.test,10.20.30.40 --host-record=mail.shop.test,10.20.30.50 --cname=www.shop.test,shop.test --mx-host=shop.test,mail.shop.test,10 --txt-record=shop.test,v=demoShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: asking with dig
| You type | It asks | It prints |
|---|---|---|
| dig +short @127.0.0.1 -p 5300 shop.test | The A record | 10.20.30.40 |
| dig +noall +answer ... www.shop.test | The name with its records | A CNAME line, then the A line |
| dig +short ... shop.test MX | Who takes the mail | 10 mail.shop.test. |
| dig +short ... -x 10.20.30.40 | Which name has this address | shop.test. |
The cells students fill in are left blank in this preview.
Ask for the address of shop.test
dig +short @127.0.0.1 -p 5300 shop.testShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Follow the chain from the www name
dig +noall +answer @127.0.0.1 -p 5300 www.shop.testShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask who takes the mail
dig +short @127.0.0.1 -p 5300 shop.test MXShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask which name has an address
dig +short @127.0.0.1 -p 5300 -x 10.20.30.40Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The status says what went wrong
Every answer has a status. NOERROR means the server answered. NXDOMAIN means the name does not exist in a zone the server holds.
REFUSED means the server will not answer for that name at all. Your practice server holds only shop.test and has nowhere else to ask.
Ask for a name that is missing
dig @127.0.0.1 -p 5300 nothing.shop.test | grep statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask for a name from another zone
dig @127.0.0.1 -p 5300 shop.invalid | grep statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think dig and ping look a name up the same way. They do not. dig asks a DNS server and nothing else. Most programs, ping included, read the hosts file first. A name can work in a browser and show nothing in dig.
See the two ways disagree
dig +short @127.0.0.1 -p 5300 localhostShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A lookup goes down label by label
On the internet no single server knows every name. A resolver asks the root, then the server for the ending, then the server for the company.
The lab has no internet, so this table is read and not run. It shows the questions for www.shop.example.
Worked example: looking up www.shop.example
| Step | The resolver asks | The answer |
|---|---|---|
| 1 | A root server | Ask the servers for the ending .example |
| 2 | A server for .example | Ask the servers for shop.example |
| 3 | A server for shop.example | www is 203.0.113.20, kept for 300 seconds |
| 4 | Nobody, for 300 seconds | The resolver answers from its memory |
The cells students fill in are left blank in this preview.
Stop the practice server
sudo pkill -f '[-]-port=5300'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further: the dig header
Run dig @127.0.0.1 -p 5300 shop.test again, with the practice server started, and read the whole header.
Find the flags line and the counts of questions and answers. Then ask for nothing.shop.test and compare the counts. Which one changed?