The Domain Name System (DNS) is a critical, foundational component of the internet, acting as its distributed phonebook. Its primary function is to translate human-readable domain names (e.g., miro.com) into the numerical IP addresses (e.g., 200.10.10.10) that network routing hardware requires to locate and connect to resources. The system was created to solve the fundamental problem that while humans easily remember names, computers operate exclusively on numbers. What began in the 1980s as a simple, manually updated hosts file became unscalable as the internet exploded in size, necessitating the development of the sophisticated, automated, and hierarchical system in use today. DNS operates on core principles of hierarchy to manage its massive global database and primarily uses the UDP protocol for speed and efficiency. The entire resolution process is designed to be seamless for the end-user, who queries a single DNS resolver that then performs a complex, multi-step "recursive lookup" to find the correct IP address. The system's indispensable nature was starkly demonstrated in the 2016 Dyn attack, where a targeted disruption of DNS services rendered major platforms like Netflix, Spotify, and Amazon inaccessible, proving the assertion that "if there is no DNS there is no internet."

--------------------------------------------------------------------------------

The need for DNS originates from the inherent difference in how humans and computers identify entities on a network. While people find it intuitive to use and remember names, computer networks rely on numerical IP addresses for communication.

• Human Preference: Humans find names, such as miro.com or nicknames like "Rahul," easy to recall and use. This is analogous to parents calling their children by name.

• Computer Requirement: Computers operating on a TCP/IP network identify each other using IP addresses (e.g., 192.168.3.2). Communication between two machines cannot occur without knowledge of the destination IP address. This is analogous to a college administration system that manages thousands of students using unique roll numbers rather than names for efficiency.

In the early days of the internet (circa 1980s), the conflict between human-friendly names and machine-required addresses was solved with a simple text file.

• Function: A file, often called a hosts file, was maintained to create a registry mapping computer names to their corresponding IP addresses.

• Process: Each user would download this file onto their local machine. When they wanted to connect to a computer named "Rahul," their system would look up "Rahul" in the file to find its IP address and then initiate communication.

This manual, file-based approach quickly became untenable as networks grew exponentially.

• Maintenance Burden: A single administrator was responsible for maintaining the master file. With thousands of hosts across growing networks, this became a "miserable" and "painful job." Any addition or change required a manual update.

• Distribution Inefficiency: Every time the file was updated, every computer on the network had to download the new version to stay current.

• Unsustainable Growth: The model was not designed to handle the millions of devices that now constitute the modern internet. It was impossible to put all this information into a single file and depend on a single person or entity to manage it.

This clear inability to scale necessitated the creation of a new, automated, and distributed system—the DNS.

DNS is the complete system solution that replaced the hosts file. Its single most important duty is to resolve a domain name into an IP address.

• The Request: A user's computer (the client) initiates a request by asking the DNS system, "What is the IP address for miro.com?"

• The Response: The DNS system processes this request and replies with the corresponding IP address (e.g., 200.10.10.10).

• The Necessity: Without this IP address, the client's packets cannot be routed across the internet to the correct server. Routers in the network infrastructure do not understand domain names; they only understand IP addresses. DNS provides the essential translation that enables nearly all internet traffic.

To manage a global-scale database of names and IP addresses effectively, DNS is built on two key concepts: hierarchy and the use of the UDP protocol.

Hierarchy is a method of "organizing large information into layers" to make it manageable and easily searchable. This principle is applied directly to the structure of DNS.

• Analogy (Physical Address): Finding a person's physical address follows a hierarchy. One starts from a broad category (Country: India), narrows it down (State: Karnataka), becomes more specific (City: Bangalore), and finally finds the individual.

• DNS Hierarchical Structure:

1. Root Servers: At the top of the hierarchy are the root servers. There are 13 logical root servers distributed globally. They don't know the IP address for miro.com, but they know the location of the servers that manage the next layer.

2. Top-Level Domain (TLD) Servers: This layer consists of servers responsible for specific TLDs, such as .com, .org, and .edu. The .com TLD server, managed by companies like Verisign, knows which servers are responsible for domains ending in .com.

3. Authoritative Name Servers: This is the final layer in the lookup chain. These servers hold the actual records that map a specific domain name (e.g., miro.com) to its IP address.

This layered approach ensures that no single server needs to hold all the information. Queries are efficiently directed down the hierarchy until the correct record is found.

DNS queries primarily use the User Datagram Protocol (UDP), a transport layer protocol that operates differently from the more common TCP.

DNS was designed when network bandwidth was limited, and speed was paramount. UDP's lightweight nature makes it perfect for the simple, transactional query-and-response nature of a DNS lookup.

Instead of forcing the client computer to query each level of the DNS hierarchy individually, the system uses a specialized server called a Recursive Resolver to do the work on the client's behalf. Public resolvers like Google's 8.8.8.8 and Cloudflare's 1.1.1.1 are common examples.

1. Initial Query: A user types miro.com into a browser. The browser and Operating System (OS) check their local caches. If the IP is not found, the OS sends a DNS query to its configured Recursive Resolver (e.g., 8.8.8.8).

2. Resolver to Root: The Resolver, not knowing the answer, contacts a Root Server and asks, "Where can I find the server for the .com TLD?" The Root Server replies with the IP address of the .com TLD server.

3. Resolver to TLD: The Resolver then contacts the .com TLD Server and asks, "Where can I find the authoritative server for miro.com?" The TLD server replies with the IP address of the Authoritative Name Server for miro.com.

4. Resolver to Authoritative Server: The Resolver contacts the Authoritative Name Server for miro.com and asks, "What is the IP address for miro.com?"

5. Final Response: The Authoritative Name Server checks its records and replies with the definitive IP address (e.g., 200.10.10.10).

6. Caching and Reply to Client: The Resolver stores (caches) this IP address for a set period to speed up future requests for the same domain. It then sends the final IP address back to the user's OS. The browser can now use this IP to connect to the miro.com server.

This entire multi-step process, called a recursive lookup, is performed by the resolver. The end client only needs to make a single request and wait for a single answer.

A packet capture tool like Wireshark reveals the structure of DNS messages as they traverse the network, illustrating the principle of encapsulation.

• DNS Query Packet:

◦ DNS Layer: Contains the query itself, such as a standard query for the Type A (IPv4) record of miro.com. A query for a Type AAAA record would request an IPv6 address.

◦ UDP Layer: Encapsulates the DNS query. The destination port is 53, the well-known port for DNS services.

◦ IP Layer: Encapsulates the UDP packet, adding the source IP of the client and the destination IP of the DNS resolver.

• DNS Response Packet:

◦ DNS Layer: Contains the answer to the query, providing one or more IP addresses for miro.com. Multiple addresses are often provided for redundancy and load balancing.

◦ UDP Layer: Encapsulates the DNS response. The source port is now 53, as the packet is originating from the DNS server.

◦ IP Layer: Encapsulates the UDP packet, with the resolver's IP as the source and the client's IP as the destination.

The critical role of DNS was highlighted by a major internet outage in 2016 caused by an attack on a single DNS provider.

• The Target: Dyn, a company that provided authoritative name server services for many major internet platforms, including Amazon, Twitter, Spotify, CNN, and Netflix.

• The Attack: Attackers launched a massive Denial of Service (DoS) attack against Dyn's servers. They flooded the servers with an overwhelming volume of malicious traffic.

• The Impact: The Dyn servers, busy processing the attack traffic, were unable to respond to legitimate DNS queries from users around the world.

• The Result: Although the websites and services of Netflix, Spotify, and others were fully operational, users could not access them. Their browsers were unable to get the required IP addresses, making the services effectively offline for millions. This event served as a powerful real-world demonstration that a functioning DNS is a prerequisite for a functioning internet.