Lesson 2: Resolving Names

The process of resolving names to IP addresses is called name resolution. Name resolution is similar to looking up a name in a telephone book; the name is associated with a telephone number. For example, when you connect to the Microsoft Web site, you use the name, www.microsoft.com. DNS resolves www.microsoft.com to its associated IP address. The mapping of names to IP addresses is stored in the DNS distributed database.

DNS name servers resolve forward and reverse lookup queries. A forward lookup query resolves a name to an IP address. A reverse lookup query resolves an IP address to a name. A name server can only resolve a query for a zone for which it has authority. If a name server cannot resolve the query, it passes the query to other name servers that can resolve the query. The name server caches the query results to reduce the DNS traffic on the network.

The DNS Service uses a client/server model for name resolution. To resolve a forward lookup query, a client passes a query to a local name server. The local name server either resolves the query or queries another name server for resolution.

In Figure 3.3 the client uses the following procedure to query the name server for an IP address of www.microsoft.com:

1. The client passes a forward lookup query for www.microsoft.com to its local name server.
2. The local name server checks its zone database file to determine whether it contains the name-to-IP-address mapping for the client query. The local name server does not have authority for the microsoft.com domain. So it passes the query to one of the DNS root servers, requesting resolution of the host name. The root name server sends back a referral to the com name server.
3. The local name server sends a request to a com name server, which responds with a referral to the microsoft name server.
4. The local name server sends a request to the microsoft name server. The microsoft name server receives the request. Because the microsoft name server has authority for that portion of the domain name space, it returns the IP address for www.microsoft.com to the local name server.
5. The name server sends the IP address for www.microsoft.com to the client.
6. The name resolution is complete, and the client can access www.microsoft.com.

Figure 3.3 Resolving a forward lookup query

When a name server is processing a query, it might be required to send out several queries to find the answer. With each query, the name server discovers other name servers that have authority for a portion of the domain name space. The name server caches these query results to reduce network traffic.

When a name server receives a query result (see Figure 3.4), the following actions take place:

1. The name server caches the query result for a specified amount of time, referred to as Time to Live (TTL).

2. Once the name server caches the query result, TTL starts counting down from its original value.
3. When TTL expires, the name server deletes the query result from its cache.

Caching query results enables the name server to resolve other queries to the same portion of the domain name space quickly.

Figure 3.4 Caching query results

A reverse lookup query maps an IP address to a name. Troubleshooting tools, such as Nslookup, use reverse lookup queries to report back host names. Additionally, certain applications implement security based on the ability to connect to names, not IP addresses.

Because the DNS distributed database is indexed by name and not by IP address, a reverse lookup query would require an exhaustive search of every domain name. To solve this problem, a special second-level domain called in-addr.arpa was created.

The in-addr.arpa domain follows the same hierarchical naming scheme as the rest of the domain name space; however, it is based on IP addresses instead of domain names as follows:

• Subdomains are named after the numbers in the dotted-decimal representation of IP addresses.
• The order of the IP address octets is reversed.
• Companies administer subdomains of the in-addr.arpa domain based on their assigned IP addresses and subnet mask.

For example, Figure 3.5 shows a dotted-decimal representation of the IP address 169.254.16.200. A company that has an assigned IP address range of 169.254.16.0 to 169.254.16.255 with a subnet mask of 255.255.255.0 will have authority over the 16.254.169.in-addr.arpa domain.

Figure 3.5 The in-addr.arpa domain

Name resolution is the process of resolving names to IP addresses. The mapping of names to IP addresses is stored in the DNS distributed database. DNS name servers resolve forward lookup queries. When a client passes a forward lookup query to its local name server, the local name server checks its zone database file to determine whether it contains the name-to-IP-address mapping for the client query. If the local name server does not have authority, it passes the query to one of the DNS root servers, requesting resolution of the host name. The root name server sends back a referral to the com name server, and the local name server sends a request to a com name server, which responds with a referral to a name server that can resolve the forward lookup query. The local name server sends a request to the name server to which it was referred, and since the name server has authority for that portion of the domain name space, it returns the requested IP address to the local name server. The name server sends the IP address to the client, and the name resolution is complete. Name servers cache these query results to reduce the DNS traffic on the network.

In addition to forward lookup queries, DNS name servers resolve reverse lookup queries. A reverse lookup query resolves an IP address to a name. Because the DNS distributed database is indexed by name and not by IP address, a special second-level domain called inaddr.arpa was created. The inaddr.arpa domain follows the same hierarchical naming scheme as the rest of the domain name space; however, it is based on IP addresses instead of domain names.