DNS Resolution
CPTS Notes
- Start Here
- General Framework
- Enumeration
- Enumeration with Nmap
- Services
- FTP
- SMB
- NFS
- DNS
- SMTP
- IMAP
- POP3
- Reference
- Port References
- Linux Commands Cheatsheet
- DNS Resolution
- The Mail Pipeline
- SMB & NetBIOS
Background for the DNS cheatsheet. How the protocol works, so the enumeration and attacks make sense.
Resolution
A name resolves from the top down. The client asks a recursive resolver. The resolver asks a root
server for the TLD (.com), the TLD server for the domain’s authoritative server, and that
authoritative server for the record. The resolver caches the answer for its TTL and returns it.
Server roles
| Role | Job |
|---|---|
| Authoritative | Holds the real records for its zones. Its answers are final. |
| Recursive resolver | Answers a client by chasing the query from the root down, then caches it. |
| Caching | Stores answers from other servers for their TTL. |
| Forwarding | Passes queries to another resolver. |
| Root | Top of the tree. Points queries at the right TLD servers. |
Zones and zone files
A zone is the slice of the namespace one server is authoritative for. A zone file lists that zone’s records. Every zone needs one SOA record and at least one NS record. The primary server holds the master copy. Secondary servers copy it.
Zone transfers
A secondary keeps its copy current by polling the primary’s SOA serial on a refresh interval. A higher serial means the zone changed, so the secondary pulls a transfer: AXFR for the full zone, IXFR for the changes. This sync is the mechanism the AXFR attack abuses. A server that transfers to any client, not just its secondaries, hands over the whole zone.
Encryption
Plain DNS is cleartext on UDP 53, so anyone on the path reads the queries. Three protocols encrypt it: DNS over TLS (DoT, port 853), DNS over HTTPS (DoH, port 443), and DNSCrypt.