Networking › Module 3 › Lesson 1
DNS — How It Works
How DNS resolves names to IPs—and why attackers target it
Opening
The internet's phone book
You type cyberlium.com, not 93.184.216.34. DNS (Domain Name System) translates human-readable names into IP addresses so browsers and apps know where to connect. When DNS fails, the whole web feels broken—even if the server is fine.
1. How a DNS Lookup Works
When you visit a site, your device asks a resolver (often your ISP or 8.8.8.8) to find the IP: 1. Browser checks local cache (OS and browser). 2. Resolver queries recursive DNS servers up the chain. 3. Authoritative name server for the domain returns the answer. 4. The IP is cached for a TTL (time to live) period. Most lookups complete in milliseconds—but every step is a potential failure or attack point.
2. Record Types: Start with A
DNS stores many record types. The A record maps a hostname to an IPv4 address: cyberlium.com. IN A 93.184.216.34 AAAA records do the same for IPv6. CNAME aliases one name to another. MX points to mail servers. For triage and incident response, A and AAAA records tell you where traffic actually goes.
3. Resolvers and Caching
Your resolver sits between you and the global DNS hierarchy:
Stub resolver
On your device—hands the query to a configured DNS server.
Recursive resolver
Does the legwork: root → TLD (.com) → authoritative server.
Cache
Stores recent answers to speed up repeat lookups and reduce load.
Look up DNS records from the terminaldig cyberlium.com A +short dig cyberlium.com AAAA +short nslookup cyberlium.com
dig cyberlium.com A +short dig cyberlium.com AAAA +short nslookup cyberlium.com
4. Security: Cache Poisoning
DNS was not designed with strong authentication. Cache poisoning (DNS spoofing) tricks a resolver into storing a false answer—for example, mapping yourbank.com to an attacker's IP. Victims then connect to a malicious server while typing the correct URL. Defenses include DNSSEC (signed records), DNS over HTTPS/TLS, and monitoring for unexpected record changes.
Knowledge Check
What does an A record do?
Multiple choice
Knowledge Check
A recursive DNS resolver:
Multiple choice
Knowledge Check
DNS cache poisoning is dangerous because:
Multiple choice