Basic DNS. DNS can also potentially do the reverse translating a numeric IP address to a fully qualified domain name.

Transcription

1 DNS SERVER

2 Basic DNS DNS is the network service that translates a fully qualified domain name, such as to a numeric IP address, such as Client DNS Server data DNS can also potentially do the reverse translating a numeric IP address to a fully qualified domain name. DNS also map different types of records like MX, TXT, CNAME etc. Page 2

3 DNS Concept Distributed Database to resolve domain name. DNS uses both UDP and TCP protocols for the transport of its queries/zone files. UDP is a connectionless protocol or not a secure protocol. It uses port 53 for both protocols (i.e., ports 53/UDP and 53/TCP for Zone transfer). Common queries such as the translation of a name to an IP address and vice versa are performed by UDP protocol. Page 3

4 DNS Concept Why DNS Servers Required -4 Using BIND (Berkeley Internet Name Daemon) software for running DNS services. It is the most popular software for providing DNS services Slave DNS Types of name servers Authoritative servers master (primary) slave (secondary) (Caching) recursive servers also caching forwarders Mixture of functionality Master DNS Slave DNS Slave DNS Page 4

5 Hierarchy of Name Servers Why DNS Servers Required -5 The structure of the DNS system relies on a tree structure where the higher level Domains called TLD ( TOP Level Domain), All TLD attached to a root node represented by a dot. There are two categories of TLD (Top Level Domains): gtld (generic TLD). gtlds are top level generic domain names offering a classification according to the sector of activity. Ex:.com relates to commercial use..edu relates to educational organizations.gov relates to governmental organizations cctld (country code TLD). Ex: Code Country AU Australia HK Hong Kong JP Japan IN India Page 5

6 DNS Query Resolving Steps Why DNS Servers Required Client ask for from caching server. 2. Caching or Recursive server forward request root server. 3. Root server further sent request to known.in server 4..IN server know the location of nic.in server thus send it further to nameserver of nic.in. 5. Nic.in nameserver gives it answer to the crosponding servers. 6. Finally session esablished with desired server having web site Page 6

7 NIC Authoritative DNS Servers Overview of NIC DNS Servers S No. DNS server Name IP Address Location of the Server 1 NS1.NIC.IN NIC-HQ Delhi 2 NICNET.NIC.IN NIC- HQ Delhi 3 NS6.NIC.IN NIC-HYD DNS Server registered for 3 rd.4 th level of nic.in domains 4 NS8.NKN.IN 2405:8a00:1000::2 NIC- Shastri Park S No. DNS server Name IP Address Location of the Server 1 NS1.NIC.IN NIC-HQ Delhi 2 NS2.NIC.IN NIC- HQ Delhi 3 NS7.NIC.IN NIC-HYD DNS Server registered for gov.in and other URLs 4 NS10.NKN.IN 2405:8a00:1000::2 NIC-Shastri Park Page 7

8 Anycast Caching DNS Servers Multiple nodes configured to accept DNS traffic on single IP address. Traffic from different node may follow separate path. Client INTERNET CLOUD Banglore DELHI Gauhatty Kolkatta Hyderabad In this scenario clients choose a nearby DNS server for their DNS query resolving. Overview of NIC DNS Servers Anycast DNS S No. Location 1 Delhi 2 Bhopal 3 Gandhinagar 4 Kolkatta 5 Bhuvneshwer 6 Gauhatty 7 Hyderabad 8 Banglore 9 Chennai 10 Chandigarh Page 8

9 Benefits of Anycast DNS Server Overview of NIC DNS Servers Automate failover, When an Anycast DNS servers gets down due to power failure or some other reason then route is withdrawn from that server then user query will be resolve from next nearby Anycast DNS server. Thus no need to configure other DNS Decrease latency Improve load distribution Simplify configuration and maintenance Increase resiliency to DoS and DDoS attacks Page 9

10 Protection from malware domains Overview of NIC DNS Servers Using latest BIND (Berkeley Internet Name Daemon ) software, it is an open source DNS software, it is being maintained by ISC (Internet System Consortium). Maintaining a list of malware domains in & as per instruction from NIC Cyber Security Division. These Caching server are announced for NICNET users. Configured DNS RPZ in all caching servers. It is a service which provides reputation information of domains and accordingly prepare a list of URLs which can be blocked. ISC maintain list of RPZ. We are blocking certain domains or URLs as per instruction from Security Division because these domains can damage users data and even can spread virus/worm in the entire Network. Page 10

11 DNS resolving tools Nslookup Dig Host Online sites for testing domain resolving Page 11

12 THANKS Page 12