How does DNS work? (2002)

https://cr.yp.to/djbdns/intro-dns.html

by 1vuio0pswjnm7 • 2 years ago

16 13 2 years ago

cr.yp.to

"All of this work is handled by a DNS cache running on your computer."

Running on _your_ computer. Not running on Google's computers, Cloudflare's computers, Quad9's (IBM's) computers, OpenDNS's (Cisco's) computers or a computer belonging to some individual running a DNSCrypt proxy.

This is not how HN commenters and many people active in other web forums believe that DNS works. They believe that DNS requires a third party, such as Google, Cloudflare, Quad9, OpenDNS, etc. In recent times, they often call this "upstream".

Thus, there are different answers to the question, "How does DNS work?"

One answer says that the end user is in control. The end user sends the DNS query to the authoritative DNS server.

Another answer says that a third party, an "upstream" provider, a middleman, is in control. The third party sends the DNS query to the authoritative DNS server.

If we asked the people behind "DNS Over HTTPS" how DNS works, which answer would they choose.

Hint: It is not answer #1.

Authoritative DNS servers do not answer DoH queries. Under the DoH scheme, DNS queries sent to authoritative DNS servers are not encrypted. The only queries that are encrypted are recursive queries to a cache running on a computer belonging to a third party, e.g., Google, etc.

DNSCurve, OTOH, allows the end user to send encrypted, non-recursive DNS queries to authoritative DNS servers. DoH cannot do this; DoH is not comparable with DNSCurve.

Plenty of HN commenters understand that HTTP requests sent to Cloudflare's CDN via HTTPS may be decrypted at Cloudflare before they are forwarded to backend servers operated by Cloudflare customers. As such, Cloudflare can see the contents of every HTTP request. In this regard, DoH is similar. The third party "upstream" DNS provider, e.g., OpenDNS, Quad9, Google, Cloudflare, etc. can see the contents of every DNS query.

Whereas when I use a DNSCurve-compatible stub resolver or cache running on my computer to query an authoritative DNS server running behind a CurveDNS forwarder, there are only two parties that see the contents of the query: 1. the operator of the authoritative DNS server and CurveDNS forwarder and 2. the person who sent it: me. No third party, no "upstream", no middleman.

NB. A "recursive cache" is not an authoritative DNS server.

tptacek3• 2 years ago

I don't know what you're trying to say about DoH here, but tons of people who use DoH do so with their own recursive cache servers.

DNSCurve is a dead letter.

zrm3• 2 years ago

DoH typically encrypts the connection between the client and the recursive DNS server, and TLS is reasonably suitable for this because the client is always querying the same server and can keep the connection open or use session resumption. DNSCurve is designed to encrypt the request between the recursive and authoritative DNS server, where the requests go to all different authoritative nameservers and the TLS handshake is correspondingly slow/heavy.

Is there any technical problem with DNSCurve or is it just a technology with low current adoption, like source port randomization before the Kaminsky attack?

Ethee• 2 years ago

Personally, I prefer this explanation: https://www.youtube.com/watch?v=4ZtFk2dtqv0

AJMaxwell• 2 years ago

I learned more about DNS from a cat than I've learned in 15 years of web dev and devops

acheron• 2 years ago

Not that complicated, just a combination of cache invalidation and naming things.

peterfirefly• 2 years ago

Three things that are hard.

zrm3• 2 years ago

The root ('.') is also variously treated as a label or ignored, so beware the off-by-one errors.

block_dagger• 2 years ago

…it doesn’t /s

dang• 2 years ago

How does DNS work? (2002) - https://news.ycombinator.com/item?id=30173559 - Feb 2022 (7 comments)

How does DNS work? (2002)

Related Stories