DNS — How It Works

DNS is a hierarchy, not one giant spreadsheet. Your device runs a stub resolver: a small client that knows only "ask the configured DNS server." That configured server is usually a recursive resolver — ISP DHCP, a home router, a corporate DNS box, or a public resolver you chose. The recursive resolver's job is to chase the question until it has a usable answer, then hand that answer back to you and remember it for a while. Authoritative servers are different. They are the owners of a zone. The authoritative name servers for example.com are the ones allowed to say "this is the A record for example.com" as a source of truth for that zone. They do not wander the internet looking up other people's domains for you. Recursion is hunting. Authority is custody.

A typical lookup (cache empty) looks like this. Stub asks recursive. Recursive, if it has no cached answer, asks a root hint: "who handles .com?" Root points at the .com TLD name servers. Recursive asks .com: "who is authoritative for example.com?" TLD returns NS records. Recursive asks those NS hosts for the name you wanted. Authoritative returns A or AAAA (or CNAME, MX, …). Recursive caches the result for the TTL, then answers your stub. You almost never talk to roots yourself. Your security depends on which recursive you trust. A café that hands out its own DNS over DHCP, a malware "helper" that rewrites your resolver, or a tampered router can all sit in that chair. The rest of the chain can be honest and you still get a poisoned first hop.

An A record maps a name to an IPv4 address. AAAA maps a name to IPv6. Those are the records a browser needs to open a TCP session to a web server. If both exist, modern stacks may try IPv6 first (Happy Eyeballs). When you triage "site down," an A that points at the wrong place is a different incident than "no AAAA and IPv6-only path." CNAME means "this name is an alias; look up that other name instead." CDNs and SaaS love CNAMEs. The security catch: you must follow the chain. The A at the end of the CNAME is where packets go. A dangling CNAME (alias to a name the attacker can register) is a classic takeover pattern — conceptual, not a license to hunt other people's leftovers. MX records name the mail exchangers for a domain, with a preference number (lower is tried first). They do not send mail by themselves; SMTP later uses the MX target's A/AAAA. NS records name the authoritative servers for a zone. If NS is hijacked at the registrar, the attacker becomes the phone book for every name under that zone. That is bigger than one phishing page.

TTL (time to live) is how long a resolver may reuse an answer without asking again. Short TTLs make changes propagate faster and make some attacks slightly less sticky. Long TTLs make the internet cheaper and faster — and they make a bad cached answer last. Your OS has a cache. Your browser may have one. The recursive resolver has a big one. Flushing your laptop does not flush the ISP. Cache poisoning is the idea of tricking a recursive resolver into storing a false A/AAAA (or NS) for a real name. Classic UDP DNS had weak transaction-ID and source-port entropy; Kaminsky-style races are why resolvers now randomize ports and why DNSSEC exists. You do not need the exploit math in this course. You need the operational picture: users typed the correct name and still reached an attacker IP because the directory lied and the lie was cached. Two quieter cousins matter more on a Tuesday. Typosquatting and homograph names (examp1e.com, look-alike Unicode) never poison cache — they wait for a human to query the wrong name, which is a perfectly valid DNS lookup. Rogue DNS (DHCP, malware, a "free VPN" app) answers the right name with the wrong IP. Phishing pages then serve a clone over HTTPS with a valid certificate for the fake name. DNS did its job. The human and the resolver policy failed.

Run these on your Linux VM or WSL. You are querying public documentation names (example.com) or a domain you administer. You are reading local files. You are not changing production DNS, not flooding a resolver, and not capturing anyone else's packets. Write down: the IP you got, whether it was A or AAAA, which server answered, and whether /etc/hosts had a matching line.

getent hosts example.com

nslookup example.com

command -v resolvectl >/dev/null && resolvectl query example.com

command -v resolvectl >/dev/null && resolvectl status | head -n 40

sed -n '1,80p' /etc/hosts

mkdir -p "$HOME/cyberlium-lab"
printf '%s
' '# I read /etc/hosts; I did not rewrite it for this lab.' \
  > "$HOME/cyberlium-lab/dns-notes.txt"
getent hosts example.com >> "$HOME/cyberlium-lab/dns-notes.txt"
chmod 600 "$HOME/cyberlium-lab/dns-notes.txt"

You can now trace a name to an IP, name the recursive vs authoritative roles, read A/AAAA/CNAME/MX/NS as different jobs, and treat cache plus resolver choice as security controls. Typosquatting and rogue DNS are social and configuration attacks that still use "valid" DNS. Next — HTTP vs HTTPS — you will see what happens after the IP is known: a cleartext web conversation versus a TLS-protected one, and why a padlock is not a character reference.