What happens when a DNS request is made?

CyberBruhArmy
InfoSec Write-ups
Published in
3 min readApr 5, 2024

--

What server types are used in a DNS check?

There are 4 different types of DNS servers involved when performing a DNS check. Each has a different role and may not be needed at all depending on the situation, having all these different server types is what contributes to DNS propagation issues.

Recursive Resolver — The DNS server your device communicates with is called the recursive resolver and is issued to you automatically by your ISP, but can be also configured on your router or individual devices. These DNS severs are ideally located in close geographical proximity to return results as fast as possible. These servers will cache a copy of the DNS results to speed up future DNS lookup requests.

Root Name Server — This type of DNS server is responsible for returning the IP address of the TLD (Top Level Domain) nameserver. For instance, if it is trying to resolve cyberbruharmy.in, the root name server returns the IP of the TLD name server that runs .in domains.

TLD Name Server — This name server returns the authoritative name servers for each domain under the Top Level Domain it’s responsible for. The .in TLD name server will return results for cyberbruharmy.in but not example.org.

Authoritative Name Server — This stores DNS servers’ configuration data for specific domain names.

What happens when a DNS request is made?

Below demonstrates the flow of events when a user requests to visit www.cyberbruharmy.in in their web browser for the first time and does not yet have cached results. As you can see, each step introduces the possibility of a DNS propagation delay.

  1. → You type www.cyberbruharmy.in into your web browser.
  2. → Your device sends a request to your configured recursive resolver.
  3. → The recursive resolver asks the root nameserver for the IP address of the TLD nameserver responsible for .indomains.
  4. ← The root nameserver returns the IP address of the .in TLD nameserver to the recursive resolver.
  5. → The recursive resolver asks the .in TLD nameserver for the address of the authoritative nameserver responsible for cyberbruharmy.in.
  6. ← The .in TLD nameserver returns the IP address of the authoritative nameserver to the recursive resolver.
  7. → The recursive resolver asks the authoritative nameserver for the IP address of www.cyberbruharmy.in.
  8. ← The authoritative nameserver returns the IP address of www.cyberbruharmy.in to the recursive resolver.
  9. ← The recursive resolver returns IP address of www.cyberbruharmy.in to the browser.
  10. → Your browser makes a web request directly to the resolved IP address.

Which DNS record types can be checked?

You can check DNS propagation for common record types including:

  • A — The most common DNS record, used to point a domain to an IP address.
  • CNAME — Also known as alias records, they point to other DNS records. Sometimes used for subdomains like www.
  • MX — Mail Exchanger records are used set email servers and their priority.
  • NS — Name Server records store the authoritative nameserver.
  • TXT — Text records are commonly used for configuration settings such as SPF and DKIM records.

Additional types that can be checked which are usually used in more advanced configurations include: AAAA, CAA, PTR, SOA and SRV.

--

--