DNS Resolution. How does your computer figure out who is www.myfavouritewebsite.com
Tags: tcpip, networking, portprogramming, cybersecurity
Published: 2022-05-23 13:03:01

When you want to make a call to a friend you at least need two things, your friend's name and phone number which are normally stored in a phone book. The most important detail is the phone number which uniquely identifies your friend. Having this information you can easily call them in two ways, search their name in your phone book and call, or directly dial their number. When you visit your favorite websites on the internet, there is not much difference. Each device on the internet including the one hosting your favorite website has a unique identifier just like the phone number known as an Internet protocol address  (IP address). when you want to the website, your browser makes a call to the computer (server)  hosting the site using an IP address as the phone number. Just as you can dial a phone number directly and call you can also directly use a website's IP address. 

The difference between calling your friend and visiting your favorite website is that you don't have to know the unique address of the site unlike calling where you have to know the phone number or explicitly record it in the phonebook. The names of the sites on the internet are known as domain names www.myfavesite.com is a domain name. Your device automatically figures out the correct unique identifier (IP address) through a process known as Domain Name System Resolution (DNS Resolution) illustrated in the diagram below. DNS resolution can be compared to searching a system of phonebooks for the correct phone number but instead searching for an IP address of a site.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mhdoxvr9ts3536db7ny3.png)

Fig 1.1

## How DNS Resolution works.

## Fig 1.1 Step 1 and step 2 (hosts file)

When you type a domain name on a browser or click a link after a google search, the network service in your device first checks whether the IP address of the domain name is recorded locally in a flat file known as the hosts file. This file is always the first step in a DNS resolution, by default the file contains a special IP address 127.0.0.1 known as a loopback address with a domain name localhost which is used to transmit TCP/IP data packets within a computer without going out to the internet. For instance, if www.myfavsite.com IP address was recorded in the local host file, communication between the server hosting the site and the device would automatically begin (steps 11 and 12). The hosts file is located in /etc/hosts in Linux and C:\windows\system32\drivers\etc\hosts in Windows.


## Fig 1.1 Steps 3 and 4

If the domain name is not in the hosts file, the device network service sends a request to a server known as a recursive DNS server (step 3). The server checks whether the IP address record for the domain name is stored in its cache. If it is present, it will return the IP address to the device (step 10). Communication between the device and the server would then proceed (steps 11 and 12). Otherwise, the recursive server sends a request to another server known as a root server (step 4).

Recursive servers are normally provided by an Internet Service Provider(ISP) or availed publicly by organizations. There are a number of publicly available DNS servers, for example, 8.8.8.8 by Google, 1.1.1.1 by Cloudflare, and 208.67.222.222 by OpenDNS. A DNS recursive server address has to be configured in your device whenever you want to connect to the internet. You can change the DNS recursive server in your device whenever you want.


## Fig 1.1 Step 5 (Root Name Server)

After the recursive server sends the request to a root server, the root server examines the domain name and directs the recursive server to the relevant Top-Level Domain server (TLD server) in step 5. A Top Level Domain (TLD) is the last section in a domain name e.g .com, .dev, .io, .org that is assigned by Internet Corporation for Assigned Names and Numbers (ICANN). It represents a group of IP addresses by the purpose or use of the domain. For instance, .gov is for governments, .edu for education and .com is for commercial businesses. There are 12 root servers named alphabetically with more than 1300 instances around the world, for example, root server E which is managed by NASA Ames Research Center. 



## Fig 1.1 Steps 6 and 7(Top Level Domain Server)

Once the root server returns the relevant TLD server, the recursive server makes a request to the TLD server (step 6). The TLD server contains information about IP addresses with the same Top Level Domain names. In our case, the TLD for www.myfavsite.com is .com. After examining the request the TLD will respond to the recursive server with an Authoritative server to contact (step 7).


## Fig 1.1 Steps 8 and 9 (Authoritative Server)

After the TLD name servers respond with a correct Authoritative server to contact, the Recursive server makes a request to the respective Authoritative server (step 8). An authoritative server is usually the last server to be contacted, it contains the IP address for the domain name. The domain name and respective IP address are stored in two types of records, DNS A record and CNAME record. A DNS A record contains the IP address while the CNAME contains another domain name. A good example is when ypu visit  www.facebook.com you will be redirected to web.facebook.com because the authoritative server record is a CNAME record. In our case, we will assume we have a DNS A record for www.myfavsite.com  with an IP address let's say 23.65.75.88. The server will return the IP address to the recursive server (step 9), once the recursive server receives the IP address it will cache the address and then send it to the device (step 10). Finally, communication with myfavsite server will begin (steps 11 and 12) and you can now happily interact with the content of the site.

Authoritative servers are set up by organizations, for example, Microsoft has its own authoritative servers. Network administrators and system administrators are responsible for configuring authoritative servers for their organizations as well as internal DNS recursive servers if need be.