DNS 101

Kaiser · Sep 5, 2007

This is to expand on the Domain Name Service (DNS) I was talking about via PM for someone on here. Look at DNS like directory assistance on a phone but for IP addresses instead.

Let’s take into the consideration a domain name like this: “mail.yahoo.com”

First, after the com, there is an assumed dot “.” So in all reality to a computer it looks like this: “mail.yahoo.com.”

That extra “.” (dot) stands for “root”, but again no one ever types in so internet browsers automatically assume it is there and appends it automatically when it parses the address bar.

When you type this address in, the computer parses the address field in which you just typed “mail.yaoo.com” and then converts it to “mail.yahoo.com.” as stated previously. It reads the address from right to left and tokenizes the address where the “.” (dots) reside. The computer breaks it down like this:

Root
Com
Yahoo
Mail

Now, there are different DNS servers for each of the different tokens listed above. The first one it renders and resolves is Root. There are Root DNS servers on the Internet which is the first stop. Your computer asks the Root DNS server where the closest and most available Com DNS server is and hands you back the IP address of the closest Com server. At that point it becomes a round robin so to speak as it does the same task all the way down the line until there is only one name left to resolve. So next , it now has the IP of the Com DNS server and your computer now asks the Com DNS server for the Yahoo DNS server’s IP address. The computer realizes that there is only one name left on the stack of tokenized names above which is “Mail”. Since there is only one more name in that tokenized list, it doesn’t ask for another DNS service, it actually asks the Yahoo DNS server to translate the “Mail” into an IP address. Once your computer receives the IP address which happens to be 69.147.112.160. Your computer then tries to contact that address and ask it for a web page which would render the mail.yahoo.com web page.

There are other slightly advanced portions of DNS like recursion. This is not something that everyone needs to know, but nevertheless it is still a portion of DNS resolve. Let me prefix by stating that no Root or second level DNS (example: "com", "net", "org") support recursion. Only at the third level (example "Yahoo") is recursion supported, but still would have to be "turned on" on the thrid level DNS server itself. What is recursion? Say you have a 5 token DNS address like "server1.mail.yahoo.com".

Tokenized looks like this:

Root
Com
Yahoo
Mail
Server1

If recursion is turned on for the yahoo DNS server, instead of it handing back an address of the "Mail" DNS server, it will look up that zone for you, and if there is a separate DNS server for that sub domain, it will ask for the address of "Server1". It will then hand you back the final address of Server1 instead of handing your computer the Mail DNS server address and making your computer ask the Mail DNS server for Server1's IP. Recursion essentially cuts out a step that your computer would normally have to deal with by doing that next step itself and handing your computer the final product which is the IP address you requested.

I can expand further if people want to learn about specific DNS record types like MX records, aliases, etc.

OuchThatHurts · Sep 5, 2007

Kaiser said:
Root
Com
Yahoo
Mail
Server1

Kaiser, I never did know why they did it this way and then switched back to the standard UNIX filesystem /usr/local/etc

Any idea why they did it that way?

I can see this:

| . [root]
| com [top level domain]
| yahoo [domain name]
| mail [sub domain]
| server1 [hostname]
V

It's also confusing too because the domain address goes left to right but drilling down into the directory structure it converts back to left-right using standard UNIX mode front slashes "/".

server1.mail.yahoo.com/http/webdocs/index.asp (correct)

vs.

.com.yahoo.mail.server1.http.webdocs.index.asp (not correct)

You can still put the dot (for instance, mail.yahoo.com. note the "." at the end) into an address like the above and it will still work. Not only do you not have to put in the dot at the end but most of the times you don't need to put in the subdomain either (i.e. mail, www, finance).

For example, just type in yahoo.com and it will resolve just fine.

Kaiser · Sep 6, 2007

Well, OTH, you bring up some good questions that have answers.

As for the "/" and the way it is laid out it is an RFC which means "request for comment". It has nothing to do with Unix. Engineers were smart enough when the started designing infrastructure that they designed functions under an RFC because they realized they did not know everything and someone may have a better solution. Kind of like how the constitution was developed but the design is changed much more rapidly. A humble and smart approach.

You mentioned about how it is confusing. well, it's really not, if you look at it the way the RFC was engineered. In an address, the beginning of the command string until it parses 2 "/" (forward slashes) together is the protocol. So within http//www.yahoo.com the protocol is obviously http and the default port is 80. The browser needs this identifier first or it will default to http if none is given. After that we start to decypher the address UP TO the next "/" which is why the whole thing is not read the same way. After that, the first token is the virtual directory, and all tokens after that are either sub folders or files. Remember the Virtual Directory does not need to be the same exact name as the actual file system directory name itself. It is just the name you specify when you share it out. Further, http does not need to run over port 80. It can be specified in the address. so if yahoo.com ran over port 100 instead you would specify it as such:

http://www.yahoo.com:100/index.asp

The parser knows that when it comes across a ":" and it is AFTER the initial "." after the "//" that it means this will be the port. On the other hand if the parser sees that the ":" comes BEFORE the first "." then it knows it is part of a username and password. This is so that you can embed a username and password in a link so you do not get promted for a usual http or https username & password. To extend this if a "@" comes after the "//", but before the first "." it assumes it is part of a username and password sequence also. So if you had a website locked down via normal means and not via CGI, you would be able to create a link that has a username and password embedded, and specify a certain port as such:

http://username : [email protected]:100/index.asp (without spaces as I had to put spaces at the second ":" so that a smiley would show instead.)

I know you, and I think you made a mistake in your typing because this is not correct:

server1.mail.yahoo.com/http/webdocs/index.asp

I know you know this so but i just figured I'd mention it. For those who do not, this statement says that server1.mail.yahoo.com has a virtual directory called "http" and the subfolder and files underneath of it are "webdocs/index.asp" respectively.

One of the reasons the address is parsed right to left after the "//" is a fundamental one and actually quicker processing. As the parser reads and tokenizes the string the tokens are thrown on to the stack. First in last out or "FILO" is the quickest way for a processor to work. It throws it on the stack like this:

Server1
Mail
Yahoo
Com
Root

Now all things considered what value is at the top of the stack once these are thrown on? ROOT.

Think of it as a stack of pancakes with names. The first pancake you throw on the plate is called "server1". The second "mail", etc. The top pancake is the first you are going to touch so of course its going to be ROOT.

In short if it was the opposite way around, it would have to have 2 stacks to make it first in first out or "FIFO". The first stack would take it the way it was tokenized then it would be transferred to another stack one by one to make it so that it was in correct order. Understand?

This is true for all processing. I know X86 and X64 assembly language and these languages make you realize what the innner workings are all about. They are tough, yes, but once you have them down, there is nothing you cannot do. They put C & C++ to shame for down and dirty close to the processor in the kernel's face code.

For your final interest, the only time you do not have to put a www or the like is when there is a redirector that is involved via host header OR DNS is aliased. There are a couple others outlined as well.

The first route, and you can see this by logging into your mail on my server. I created a virtual directory that has code something like this which is what yahoo or other sites would use. You type in http://yahoo.com and the code for the index of yahoo.com is the following:

<begin code sement>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN">
<HTML><HEAD><TITLE>Yahoo Website</TITLE>
<META HTTP-EQUIV="REFRESH" CONTENT = "0; URL=http://www.yahoo.com">
</HTML>
<end code>

This code redirects you to their webserver which has a host name of "www". this is also used in load balancing with a front end server that automatically detects the usage of each server and sends you to the most available one. for instance you may find that sometimes you get directed to www2.yahoo.com, instead of www.yahoo.com. This is worked out by whatever webserver front end they have. Further more than likely you have to create a host header under what ever webserver you are using. A host header directly identifies what addres you typed in to get to the destination. this allows you to separate code in separate virtual directories via the address that someone types in. That is the only way that the above will work if both yahoo.com and www.yahoo.com reside on the same server. (Well, that is unless you do it the dirty way listed in number 3 below)

The second way to do this is to use a DNS alias. Say you had yahoo.com. You can alias this to www.yahoo.com. So, your main webpage would be served on yahoo.com, yet you have a DNS alias that says if someone types in www.yahoo.com, it will resolve to yahoo.com.

The third way is custom errors. Say your webserver is serving a secure site and it's protocol is obviously https. So the address should be https://mail.yahoo.com. The user on the other hand types in http://mail.yahoo.com instead of "https". The user would normally get a 403 white page error stating that the protocol is wrong or it cannot find the page. For this, you can specify where to go under custom errors. You can say go to **broken link removed** and under that virual directory your would put the code I listed above, but with https://mail.yahoo.com as the destination address. There are also javascript solutions that reparse the original line and replace the http in your command line and replace it with https.

Fourthly (I dont even think thats a word...lol) is as simple as an "*" in DNS. You can define all routes to normal servers on your domain like:

mail.yahoo.com
search.yahoo.com
www.yahoo.com

But what if someone has a typing error? Somthing like "hgjdfsiwag.yahoo.com". You then specify *.yahoo.com to take the user to one of two things. 1. a page that states that this is an invalid web page and would they like to visit your home page with a redirector or a silent redirector that pushes them to www.yahoo.com because that would be the most likely candidate.

I think I touched on most of it here. Feel free to speek up if you dont understand my ramblings. Sometimes I am cryptic.

OuchThatHurts · Sep 6, 2007

Kaiser said:
Well, OTH, you bring up some good questions that have answers.

As for the "/" and the way it is laid out it is an RFC which means "request for comment". It has nothing to do with Unix. Engineers were smart enough when the started designing infrastructure that they designed functions under an RFC because they realized they did not know everything and someone may have a better solution. Kind of like how the constitution was developed but the design is changed much more rapidly. A humble and smart approach.
...

...omeone has a typing error? Somthing like "hgjdfsiwag.yahoo.com". You then specify *.yahoo.com to take the user to one of two things. 1. a page that states that this is an invalid web page and would they like to visit your home page with a redirector or a silent redirector that pushes them to www.yahoo.com because that would be the most likely candidate.

I think I touched on most of it here. Feel free to speek up if you dont understand my ramblings. Sometimes I am cryptic.

Okay. So I got that (or most of it

)

So basically it's really what's between the "//" and the next "/" that defines the host address.

But you said this was incorrect:

server1.mail.yahoo.com/http/webdocs/index.asp (I just used http as a folder because I know that in unix the main web directories are httpd and https)

I screwed up and left out the "d".

In other words

**broken link removed** (this could very well be a legit address

(I just used https because I know that's our SSL port on the Citrix Server)

so we have:

https:// [port 443]
http:// [port 80]
ftp:// [port 21]

and the only reason I know THAT is because we used to have to get to our Citrix server via **broken link removed**

We initially used a non-standard port because I was too cheap to pay for a certificate (I thought it was all BS) but after typing in that alternate port a few hundred times, I saw the light. Plus the encryption.

The cool thing about technology today is that it seems if you know what you're doing, you can skin the same cat a hundred different ways. I have a relative in the IT field. He's got a great job IMO but all he does is bitch. Why are computer dudes always fucking bitching? It's always how M$ sucks, or what a ripoff the iPhone is, or how Java sucks... Maybe I'd bitch too if I had to deal with this shit everyday who knows.

Thanks for typing that up. You'll bring out the computer nerd (or geek?) in me yet. I'm actually not too shabby (well compared to you I suck) but I don't get to play with the cutting edge shit like you do. I think I would really dig that.

Sigmund Roid · Sep 6, 2007

Well, I am learning a lot just reading this post. lol.

I am not nearly as educated in this area as I want to be. Thanks for the help guys.

Kaiser · Sep 6, 2007

OK, I see what you are saying now OTH, I thought you were putting the protocol after the FQDN. The web directories may be named that but they very rarely make a Virtual Directory using httpX as the name anywhere. In other words, the Directory name is different than what they share it out as and call it as a Virtual Directory. The Virtual Directries themselves can be named anything however, as long as they do not have a space.

And yup, between the "//" and the first "/" is the FQDN. (Fully Qualified Domain Name)

VanR__ · Sep 20, 2007

You cisco certified, Kaizer?

Kaiser · Sep 20, 2007

No, I'm not certified in anything. I've just been in it since I was 10. Although I am from the systems side, not the network side, you still have to know a good portion about networking while doing systems. By systems I mean Windows Domains, sevrers, etc. Core infrastructure.