D. J. Bernstein
Internet publication
djbdns
Frequently asked questions

Orientation


How does DNS work? How does my computer find the IP address of, for example, network-surveys.cr.yp.to?

Answer: Your computer contacts a series of DNS servers around the Internet.

There are several DNS servers with information about network-surveys.cr.yp.to. A central root server at IP address 192.5.5.241 has the following information:

     .:192.5.5.241
     &to:198.6.1.82
The second line is a delegation. It says ``For information about .to, ask the DNS server at IP address 198.6.1.82.'' The DNS server at IP address 198.6.1.82 has the following information:
     .to:198.6.1.82
     &yp.to:131.193.178.181
The second line says ``For information about .yp.to, ask the DNS server at IP address 131.193.178.181.'' The DNS server at IP address 131.193.178.181 has the following information:
     .yp.to:131.193.178.181
     =network-surveys.cr.yp.to:131.193.178.100
The second line gives the IP address of network-surveys.cr.yp.to.

Your computer starts with the root server address in a file on disk. It talks to the root server, then the .to server at IP address 198.6.1.82, then the .yp.to server at IP address 131.193.178.181, and finally it has the answer. It remembers everything that it learned (for a limited amount of time; information changes!) to save time later. All of this work is handled by a DNS cache running on your computer.

To protect against computer failure, there are actually several root servers and several .to servers. Each of the root servers has the following information:

     .:198.41.0.4:a
     .:128.9.0.107:b
     .:192.33.4.12:c
     .:128.8.10.90:d
     .:192.203.230.10:e
     .:192.5.5.241:f
     .:192.112.36.4:g
     .:128.63.2.53:h
     .:192.36.148.17:i
     .:198.41.0.10:j
     .:193.0.14.129:k
     .:198.32.64.12:l
     .:202.12.27.33:m
     &to:128.250.1.21:a
     &to:193.0.0.193:b
     &to:196.7.0.139:c
     &to:206.184.59.10:d
     &to:198.6.1.82:e
     &to:206.86.247.253:f
     &to:148.59.19.11:g
Each of the .to servers has the following information:
     .to:128.250.1.21:a
     .to:193.0.0.193:b
     .to:196.7.0.139:c
     .to:206.184.59.10:d
     .to:198.6.1.82:e
     .to:206.86.247.253:f
     .to:148.59.19.11:g
     &yp.to:131.193.178.181:a
     # or, in BIND master zone-file format:
     # yp.to IN NS a.ns.yp.to
     # a.ns.yp.to IN A 131.193.178.181
Your computer tries the root servers in a random order. When it receives a response from some root server, it moves to the .to servers, and tries them in a random order.
How does reverse DNS work? How does my computer find the host name of, for example, the IP address 208.33.217.122?

Answer: Your computer asks a series of DNS servers about the name 122.217.33.208.in-addr.arpa. The root servers have the following information:

     &33.208.in-addr.arpa:206.228.179.10:c
     &33.208.in-addr.arpa:144.228.254.10:b
     &33.208.in-addr.arpa:144.228.255.10:a
The DNS server at IP address 144.228.254.10 has the following information:
     .33.208.in-addr.arpa:144.228.255.10:a
     .33.208.in-addr.arpa:206.228.179.10:c
     .33.208.in-addr.arpa:144.228.254.10:b
     &217.33.208.in-addr.arpa:209.191.164.20:a
     &217.33.208.in-addr.arpa:206.253.194.65:b
The DNS server at IP address 209.191.164.20 has the following information:
     .217.33.208.in-addr.arpa:209.191.164.20:a
     .217.33.208.in-addr.arpa:206.253.194.65:b
     =mm-outgoing.amazon.com:208.33.217.122

Which programs should I use? I see a bunch of different programs in the djbdns package. Which ones do I need?

Answer: Normally each computer will run the dnscache program as a local DNS cache on the private IP address 127.0.0.1.

As an alternative, one computer can run dnscache as an external DNS cache on a public IP address. Other computers (if authorized) can then use that cache instead of running local caches.

You'll also need to run the tinydns program as a DNS server on any computer to which names have been, or will be, delegated. You don't need tinydns if your host information is provided by your ISP's DNS server.

The final results for a typical department network look like this:

                        on private  and      on public   with this in
     computer  running  IP address  running  IP address  /etc/resolv.conf
     --------------------------------------------------------------------
     unix1     dnscache 127.0.0.1   tinydns  18.25.0.1   127.0.0.1
     unix2     dnscache 127.0.0.1   tinydns  18.25.0.2   127.0.0.1
     unix3     dnscache 127.0.0.1   -        18.25.0.3   127.0.0.1
     unix4     dnscache 127.0.0.1   -        18.25.0.4   127.0.0.1
     unix5     -        127.0.0.1   dnscache 18.25.0.5   18.25.0.5
     doze1     -        127.0.0.1   -        18.25.0.6   18.25.0.5
     doze2     -        127.0.0.1   -        18.25.0.7   18.25.0.5
     doze3     -        127.0.0.1   -        18.25.0.8   18.25.0.5
     doze4     -        127.0.0.1   -        18.25.0.9   18.25.0.5
unix1, unix2, unix3, and unix4 are running local DNS caches. unix1 and unix2 are also running DNS servers; each server is providing the same information about various names that have been delegated to 18.25.0.1 and 18.25.0.2. unix5 is running an external DNS cache, which is shared by unix5, doze1, doze2, doze3, and doze4.

Other servers that you might want to use: pickdns balances HTTP load among a large number of web servers; rbldns publishes lists such as RBL or DUL.


Which programs should I use behind a firewall? I want to limit the number of machines that receive UDP packets from the Internet. I'd also like to have internal *.moon.af.mil host names that aren't visible from the Internet.

Answer: Configure a few external caches. Set up your firewall to allow UDP packets between port 53 on the Internet and ports above 1024 on each external cache. Set up all your computers to use these caches.

Configure a DNS server behind the firewall, separate from your public DNS server. Put your whatever.moon.af.mil names on this server. Configure each external cache to consult this server for moon.af.mil names.

You may also want to run a public reverse DNS wall to provide uninformative host names for all your IP addresses.


Is there really a cash reward for security holes?

Answer: Yes. See cr.yp.to/djbdns/guarantee.html.