Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

101–110 of 261 posts

Re: Why is DNS still hard to learn?

#101

Post by throw0101b »

haroldp wrote: post #97
shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

Can you help me find the mistake in my zone file? $ORIGIN example.net. $TTL 900 @ IN SOA ns1.example.com. hostmaster@example.com. ( 20230728001 1800 300 3600 172800 ) @ IN NS 8.8.8.8. @ IN NS 8.8.4.4. @ IN CNAME example.com. @ IN MX 10 172.253.124.27 www IN CNAME example.com

Off the top of my head (haven't had to do zone files for ~2 years):

* hostmaster@example.com -> hostmaster.example.com

* NS records are usually hostnames (not sure if IPs are even valid)

* Ditto for MX records ; also add a period to the end, otherwise example.net will get appended

* Also appending with the www record

See also:

* https://linux.die.net/man/8/named-checkzone

Re: Why is DNS still hard to learn?

#103

Post by throw0101b »

deltarholamda wrote: post #75
shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

>It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. It's relatively straightforward, ignoring all of the potential ways that things can go wonky, e.g. random servers not respecting TTL. But I'll never forget when Firefox put out an update with DNS-over-HTTPS turned on by default. All of a sudden, I was inundated with "Email is gone! Everything is broken!" because we run…

> But I'll never forget when Firefox put out an update with DNS-over-HTTPS turned on by default.

Plenty of DNS old timers / neckbeards (e.g., Paul Vixie) warning that DoH was not a good idea; there was lively discussion on HN at the time.

We used split-horizon DNS as well and I implemented the "disable DoH" canary where I was working at the time.

* https://support.mozilla.org/en-US/kb/configuring-networks-di...

* https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

Re: Why is DNS still hard to learn?

#104

Post by redundantly »

tux1968 wrote: post #98
knome wrote: post #51

Earlier quoted context omitted.

>I don't know what the semicolons before the lines are supposed to convey but they're only making things confusing all of the lines that aren't part of the query answer are prefixed with semicolons. so it's basically a comment character. presumably to ease processing of the data it spits out. You know. So you can `dig google.com | grep -v '^;' | grep . | awk '{ print $5 }'` easily. I can imagine people using it in a…

> dig google.com | grep -v '^;' | grep . | awk '{ print $5 }'` It wasn't really your point, but hopefully you'll forgive me sharing an equivalent one-liner, without grep: dig google.com | awk '/./ && !/^;/ {print $5}'

I believe both you and the parent meant to escape the dot, as to only return lines with a dot in them:

     dig example.com | awk '/\./ && !/^;/ {print $5}'
If it isn't escaped it'll just match on everything.

If matching everything was intended then you don't need it at all:

     dig example.com | awk '!/^;/ {print $5}'
Will strip out the lines beginning with a semi-colon.

However, parsing the output of `dig` this way is not needed. It can be ran to only return the answer, for example:

     dig +noall +answer example.com
Or if you just want the IP for that record:

     dig +short example.com

Re: Why is DNS still hard to learn?

#105

Post by [deleted] »

tux1968 wrote: post #98
knome wrote: post #51

Earlier quoted context omitted.

>I don't know what the semicolons before the lines are supposed to convey but they're only making things confusing all of the lines that aren't part of the query answer are prefixed with semicolons. so it's basically a comment character. presumably to ease processing of the data it spits out. You know. So you can `dig google.com | grep -v '^;' | grep . | awk '{ print $5 }'` easily. I can imagine people using it in a…

> dig google.com | grep -v '^;' | grep . | awk '{ print $5 }'` It wasn't really your point, but hopefully you'll forgive me sharing an equivalent one-liner, without grep: dig google.com | awk '/./ && !/^;/ {print $5}'

[deleted]

Re: Why is DNS still hard to learn?

#106

Post by knome »

redundantly wrote: post #104
tux1968 wrote: post #98

Earlier quoted context omitted.

> dig google.com | grep -v '^;' | grep . | awk '{ print $5 }'` It wasn't really your point, but hopefully you'll forgive me sharing an equivalent one-liner, without grep: dig google.com | awk '/./ && !/^;/ {print $5}'

I believe both you and the parent meant to escape the dot, as to only return lines with a dot in them: dig example.com | awk '/\./ && !/^;/ {print $5}' If it isn't escaped it'll just match on everything. If matching everything was intended then you don't need it at all: dig example.com | awk '!/^;/ {print $5}' Will strip out the lines beginning with a semi-colon. However, parsing the output of `dig` this way is not n…

I was actually just using `grep .` to discard empty lines. The `grep -v '^;'` would have only left lines with answers after it discarded lines starting with `;`. That and the empty lines.

I could have combined `grep -v '^;'` and `grep .` as a nice simple `grep '^[^;]'`

Re: Why is DNS still hard to learn?

#107

Post by TheNewsIsHere »

chefandy wrote: post #56
jeroenhd wrote: post #43

Earlier quoted context omitted.

I think it is hard to learn... using the tools people used to learn DNS with. BIND is great at what it does, but its configuration files suck and its manual is long, terse, and unnecessarily complex sometimes. Dig is powerful, but abbreviates everything like we're on an 80 column terminal. At times Wireshark was a better tool debugging DNS issues than Dig was. Give someone PowerDNS or another modern DNS server and I…

I'd conservatively estimate 90% of the people who make core FOSS software interface decisions haven't had to learn anything technical in an entirely unfamiliar domain where there existing mental models didn't apply in decades. Beyond that, many consider having learned these arbitrary, terse interfaces as a badge of honor, and for some reason thinks that makes them better technologists. I'll bet they'd be even better…

I think of this in the same way I think of documentation. I try to write documentation that is as clear as it is concise and well structured. But sometimes that’s just not realistically possible, and expressing information often _has_ to assume some level of familiarity with the underlying concepts.

I’ve never considered DNS to be a complicated technology, and I’ve never considered that tools like dig and the abbreviations they use need to change much. If there’s something that isn’t clear, it’ll be in the man page, a mailing list, Internet based documentation, StackOverflow, etc.

Personally, I value information density, and I don’t mind terseness at all.

That doesn’t necessarily mean I would design some of this stuff the same way, but after more than a decade using it, I feel like changing it now is just an appeal to futility. A tool like dig more or less looks and works the same today as it did 15 years ago, and there’s value in that kind of stability.

Re: Why is DNS still hard to learn?

#108

Post by redundantly »

knome wrote: post #106
redundantly wrote: post #104

Earlier quoted context omitted.

I believe both you and the parent meant to escape the dot, as to only return lines with a dot in them: dig example.com | awk '/\./ && !/^;/ {print $5}' If it isn't escaped it'll just match on everything. If matching everything was intended then you don't need it at all: dig example.com | awk '!/^;/ {print $5}' Will strip out the lines beginning with a semi-colon. However, parsing the output of `dig` this way is not n…

I was actually just using `grep .` to discard empty lines. The `grep -v '^;'` would have only left lines with answers after it discarded lines starting with `;`. That and the empty lines. I could have combined `grep -v '^;'` and `grep .` as a nice simple `grep '^[^;]'`

Ahh. I was working from memory, I forgot about the empty lines it returns. That's what I get for replying from my phone. :)

However, it's still better to just have the `dig` command return only the necessary information via the +short or +noall +answer flags, rather than parsing the full output.

Re: Why is DNS still hard to learn?

#109

Post by TheNewsIsHere »

antonjs wrote: post #96
josho wrote: post #73

Earlier quoted context omitted.

If you read the article the author points out why it's hard to learn. The concept is easy, but when teaching the concepts we don't include all the details of the modern internet. As an example what are the rules that your browser uses to cache and expire DNS entries? Are those rules consistent between browsers?

And does your browser have settings which bypass or supplement the host's DNS configuration. Secure DNS (DoH etc) is great, but damn that's confusing when you first run across it. Not to mention how phones do it; you can't override a DoH DNS server when connecting to a VPN which offers internal DNS on Android, for instance.

Aren’t all of those concerns out of scope for DNS itself, though? DNS can only give you a TTL, for example, it cannot require you follow it.

Ideally that’s what RFCs are for, but even organizations that pay smart people to come up with clever standards don’t always follow them. Implementations frequently disregard or guess about the things standards cover.

Re: Why is DNS still hard to learn?

#110

Post by paulddraper »

bratgpttamer wrote: post #33
paulddraper wrote: post #18

Earlier quoted context omitted.

"Dropdown and two text boxes" undersells it. Here is the list of several dozen record types: https://www.iana.org/assignments/dns-parameters/dns-paramete...

Sure, but I'm talking about a day-to-day practical level. Most people will only ever need to modify A/CNAME, occasional MX and TXT, and maybe an SOA/PTR. Even the more arcane record types (as far as I've ever used them) are essentially key-value pairs with the record type analogous to a namespace.

AAAA

Also NS is reasonably common.

Post reply on HN