https://media.ccc.de/v/35c3-9674-domain_name_system

Hierarchical decentralized naming system used since 30 years

Whenever you enter a name into your computer, it resolves it to a numerical IP address. This resolution uses the Domain Name System (DNS), which is a hierarchical decentralised naming system used on the Internet. DNS is organised in a way that top-level domain (e.g. .com, .org) are delegated to registrars, which delegate subdomains (e.g. foo.com). This delegation is done as well via the DNS protocol via nameserver (NS) records. Since different types of data are kept in DNS, it can as well be seen as a distributed (and cached!) key-value store - which is fault-tolerant.

I will explain the basic usage of DNS, including stub and recursive resolver, server, various protocol extensions (zone transfer, dynamic updates, authentication, notifications, ...), privacy extensions (query path minimisation, DNS-over-TLS), provisioning let's encrypt certificates. I will talk about attacks (poisoning, amplification, ...) and implementation pitfalls (not get stuck in the recursive resolver). I implemented DNS with above mentioned extensions as minimized MirageOS unikernels over past years.

DNS is used since 1985 for the Internet, and provides useful service for various protocols. Its initial design could not foresee its wide usage 30 years later. DNS is a core dependency of today's Internet usage. Within the MirageOS project we re-develop network protocols, and I was eager to learn about all the details of DNS, a protocol which has been around and will be around for more time since a lot of systems depend on it.

Hannes Mehnert

https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9674.html