February 14th, 2021
DNS Terminology: RFC8499 – 2019 “The Domain Name System (DNS) is defined in literally dozens of different RFCs… This document gives current definitions for many of the terms used in the DNS in a single document.”
DOMAIN NAMES - CONCEPTS AND FACILITIES: RFC1034 – 1987, updated by 19 other documents, but not obsolete.
DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION RFC1035 – 1987, updated by 28 other documents, but not obsolete.
The protocol and message format are defined in [RFC1034] and [RFC1035]. These RFCs defined some terms,and later documents defined others. Some of the terms from [RFC1034] and [RFC1035] have somewhat different meanings now than they did in 1987.
This document contains a collection of a wide variety of DNS-related terms, organized loosely by topic. Some of them have been precisely defined in earlier RFCs, some have been loosely defined in earlier RFCs, and some are not defined in an earlier RFC at all.
Note that there is no single consistent definition of “the DNS”. It can be considered to be some combination of the following:
The DNS has three major components:
DOMAIN NAME SPACE and RESOURCE RECORDS
The DOMAIN NAME SPACE and RESOURCE RECORDS, which are specifications for a tree structured name space and data associated with the names. Conceptually, each node and leaf of the domain name space tree names a set of information, and query operations are attempts to extract specific types of information from a particular set.
A query names the domain name of interest and describes the type of resource information that is desired. For example, the Internet uses some of its domain names to identify hosts; queries for address resources return Internet host addresses.
From Wikipedia: DNS
NAME SERVERS are server programs which hold information about the domain tree’s structure and set information. A name server may cache structure or set information about any part of the domain tree, but in general a particular name server has complete information about a subset of the domain space, and pointers to other name servers that can be used to lead to information from any part of the domain tree.
RESOLVERS are programs that extract information from name servers in response to client requests. Resolvers must be able to access at least one name server and use that name server’s information to answer a query directly, or pursue the query using referrals to other name servers. A resolver will typically be a system routine that is directly accessible to user programs; hence no protocol is necessary between the resolver and the user program.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | LENGTH | ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Q| OPCODE|A|T|R|R|Z|A|C| RCODE | QDCOUNT | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ANCOUNT | NSCOUNT | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ARCOUNT | QD | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AN | NS | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AR | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Fig. DNS
ID: A 16 bit identifier assigned by the program that generates any kind of query. This identifier is copied the corresponding reply and can be used by the requester to match up replies to outstanding queries.
Q: A one bit field that specifies whether this message is a query or a response
OPCODE: A four bit field that specifies kind of query
QDCOUNT: specifies the number of entries in the question section (QD)
ANCOUNT: specifies the number of resource records in the answer section (AN)
NSCOUNT: specifies the number of name server resource records in NS section
ARCOUNT: specifies the number of resource records in the additional records section (AR)
A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource information associated with a particular name is composed of separate resource records (RRs). The order of RRs in a set is not significant, and need not be preserved by name servers, resolvers, or other parts of the DNS.
From Scapy documentation
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | RRNAME | TYPE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | RCLASS | TTL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | RDLEN | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | RDATA | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Fig. DNSRR
NAME: a domain name to which this resource record pertains.
TYPE: two octets containing one of the RR type codes. This field specifies the meaning of the data in the RDATA field.
CLASS two octets which specify the class of the data in the RDATA field.
TTL: a 32 bit unsigned integer that specifies the time interval (in seconds) that the resource record may be cached before it should be discarded.
RDLENGTH: an unsigned 16 bit integer that specifies the length in octets of the RDATA field.
RDATA: a variable length string of octets that describes the resource.
From Wikipedia: DNS record types, a few common record types
Queries are messages which may be sent to a name server to provoke a response. In the Internet, queries are carried in UDP datagrams or over TCP connections. The response by the name server either answers the question posed in the query, refers the requester to another set of name servers, or signals some error condition.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | QNAME | QTYPE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | QCLASS | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Fig. DNSQR
QNAME: a domain name represented as a sequence of labels
QTYPE: a two octet code which specifies the type of the query. The values for this field include all codes valid for a TYPE field, together with some more general codes which can match more than one type of RR.
QCLASS: a two octet code that specifies the class of the query.