# DNS - End to End Understanding

In this blog post, I will discuss how to set up the connection between your domain and server. I will also try to explain what happens behind the scenes when you visit [example.com](http://example.com), and how exactly your web browser finds the correct server to display the website.

Suppose you have purchased the domain "[example.com](http://example.com)" from a domain provider. How can you configure it so that when someone visits [example.com](http://example.com), it will reach your server?

***You need to configure the DNS records.***

## DNS Records

What are DNS Records? - [https://www.cloudflare.com/en-in/learning/dns/dns-records/](https://www.cloudflare.com/en-in/learning/dns/dns-records/) - DNS records are instructions that live in authoritative DNS servers and provide information about a domain including what IP address is associated with that domain and how to handle requests for that domain.

### A Record / AAAA record

A Record - it's a mapping of the domain to the server's IPV4 address

AAAA Record - it's a mapping of the domain to the server's IPV6 address

*1) Can I have multiple A-record for the same domain?*

Yes, you can. It is called round-robin DNS, and the browser just chooses one of them randomly. It is a well-used method of getting cheap load balancing, but it has cons as well - i.e. one host goes down, users will still try to access it.

*2) Can we point different IP Addresses to subdomains (www.example.com, blogs.example.com, labs.example.com) as well?*

Yes, You can point the subdomain like www, labs etc. to a different IP address.

### CNAME

A DNS CNAME record provides an alias for another domain. Here are the examples where it can help you

1) if Each subdomain points to the same server then you have two choices either write A record for each subdomain or set CNAME which points to the main domain

* [www.example.com](http://www.example.com) → [example.com](http://example.com)
    
* [labs.example.com](http://labs.example.com) → [example.com](http://example.com)
    

The second approach is better to approach - let's say the server IP changes you don’t need to change anything other than A record i.e. [example.com](http://example.com) → 13.203.30.40

2) CNAME record also helps you in redirecting your page to some other website [status.example.com](http://status.example.com) → [example.pageduty.com](http://example.pageduty.com)

### NS Record

Nameserver is the server that stores A, AAAA, and CNAME records for your domain. NS Record helps you set up the right nameserver - Let’s say you are purchasing a domain from google and want to use Cloudflare then you can provide Cloudflare nameserver detail in the google domain. So you are trying to say that for looking for [example.com](http://example.com) detail please ask from Cloudflare nameserver.

## **Now let's understand what happens behind the scene when you hit** [**example.com**](http://example.com)

When a user types [example.com](http://example.com) in a web browser, the browser checks its DNS cache to see if there is already an IP address mapping for the domain name. If there's no cache available, the browser calls the `gethostbyname` syscall to ask the operating system to find the IP address.  
  
The operating system first looks at the `/etc/nsswitch.conf` (nameserver switch) file. It contains the following information:  
`hosts: files dns` - This means that the OS will first look up the /etc/hosts file and then use the DNS protocol if it doesn't find an entry there.  
If the `/etc/hosts` file has an entry `127.0.0.1` [`example.com`](http://example.com) then browser will call the IP address 127.0.0.1. if there is no entry then, it will first request the DNS server specified in the `/etc/resolv.conf` file. (If there's no response from that server, the OS will try the next IP address.)  
  
***So how does the DNS resolver find the IP address?***  
The DNS resolver first looks up its cache, which can be on various network devices. If there's no cache, it goes through the following steps:  
  
The DNS server breaks down "[example.com](http://example.com)" into its parts.

* “.” → Root Server
    
    IP address of root server is known to DNS resolver and now it queries to root server to find the right IP of .com
    
* “.com” → TLD NameServer (top-level domain server)
    
    * DNS resolver now queries to .com server to return IP address of the authoritative nameserver of [example.com](http://google.com)
        

“[example.com](http://google.com)”

* now DNS resolver calls the authoritative nameserver of [example.com](http://google.com) to fetch the IP address of [google.com](http://google.com)
    

In summary, the DNS resolver uses a hierarchical system of servers to find the IP address associated with a domain name.

***Shell Commands to experiments***

```bash
#Run this command in one shell to capture all DNS requests
> sudo tcpdump -s 0 -A -i any port 53
# Make a dig request from another shell
> dig google.com

# tcpdump result
17:55:51.672393 IP 192.168.1.3.60562 > 192.168.1.1.domain: 64183+ [1au] A? google.com. (39)
D.;G*....,.C..E..C....@.4c...........5./W.... .........google.com.......)........
17:55:51.685685 IP 192.168.1.1.domain > 192.168.1.3.60562: 64183 1/0/1 A 142.250.77.238 (55)
...,.CD.;G*...E..SgE@.@.P..........5...?9|.............google.com...................M...)........


# Request made to 192.168.1.1.domain for google.com. 192.168.1.1.domain is the resolver mentioned in /etc/resolv.conf. Response received IP Address of google.com 142.250.77.238

> dig +trace google.com
google.com.   300	  IN	  A	   142.250.193.46
request       ttl   class   type   response

> dig A facebook.com +short
157.240.239.35

> dig AAAA facebook.com +short
2a03:2880:f144:181:face:b00c:0:25de

> dig NS facebook.com +short
b.ns.facebook.com.
a.ns.facebook.com.
d.ns.facebook.com.
c.ns.facebook.com.

> dig www.facebook.com CNAME +short
star-mini.c10r.facebook.com.
```