Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

111–120 of 261 posts

Re: Why is DNS still hard to learn?

#111

Post by m3047 »

In a kind of corrollary of Dunning-Kruger, there is often a chasm between what people think DNS is and all of the things it can be. The article points some of that out (stub resolvers, even different implementations of libc); recursive versus authoritative responses; the recursion process; recursive versus authoritative servers.

A lot of deployment implementations are "bottom of the barrel" and aren't correct to begin with, although they work for the intended purpose. There is no checklist for server implementations which I am aware of (I've asked where people should know!). There's a lot of folklore which persists because if it works it's presumed correct.

There's "DNS" and then there's "The DNS", the "one true root" with arbitrary restrictions on the contents of labels. There's political interference with implementations in terms of the "one true root" doctrine, which interferes with marrying a resolver which e.g. queries a control plane and serves an application plane (where they have different roots): there are e.g. notions of forwarded zones, but there is no notion I am aware of of a "always recurse and lie that you're authoritative" zone (you can hack source code to accomplish this of course).

Even MITRE ATT&CK doesn't always get it right. They had it listed that DNSSEC "traffic" had to be examined with SSL tools, until I pointed it out (I didn't get credit). DNSSEC related records are ordinary DNS records, nothing is being encrypted.

I could go on: the experts were wrong on (UDP) frags, anycast...

Re: Why is DNS still hard to learn?

#112

Post by dahfizz »

neilk wrote: post #52
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

How did you learn DNS? And when?

I was tasked with setting up & maintaining a dnsmasq server in college, which handled DNS, DHCP, and pxe booting.

I learned it like anything else. Googled it, read the docs, and trial & errord my way into a working setup. I was comfortable with all the technologies in a couple weeks (working part time).

Re: Why is DNS still hard to learn?

#113

Post by TheNewsIsHere »

alexjplant wrote: post #28
shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

When I was 14 I (poorly) administered an Active Directory environment with mail, web, and CIFS for a restaurant without understanding DNS or DHCP. Instead of setting the WRT54G's DHCP server to hand out the domain controller's static IP as the DNS server for proper name resolution I just used IP addresses and host file entries to make everything work. I also had the MX record for the domain set to the router's WAN IP…

This is why I continue to maintain that ops and SE excel at remaining distinct fields, though I certainly don’t mind overlap.

Most of my friends are software developers and/or software developers working on cloud-based stacks.

Two of those friends lead the platform engineering groups at their respective companies. One of them has a very basic understanding of networking and could figure out how to do subnetting that didn’t come out of the box, but they’d need to stop and go learn that.

That isn’t everyone by any stretch, but I see it more often than not these days.

I agree fully with the idea that younger professionals aren’t as used to the infrastructure underneath the infrastructure being as complex as the higher layers of the OSI model that they’re frequently more experienced with.

What I hope we don’t end up with is a future where all the data center people and all the network engineers (and so on) are almost exclusively employed by a small number of mega-corps. It’s important that knowledge and experience in the fundamentals of the networked world remain widely distributed and openly accessible.

Re: Why is DNS still hard to learn?

#114

Post by WarOnPrivacy »

antonjs wrote: post #96
josho wrote: post #73

Earlier quoted context omitted.

If you read the article the author points out why it's hard to learn. The concept is easy, but when teaching the concepts we don't include all the details of the modern internet. As an example what are the rules that your browser uses to cache and expire DNS entries? Are those rules consistent between browsers?

And does your browser have settings which bypass or supplement the host's DNS configuration. Secure DNS (DoH etc) is great, but damn that's confusing when you first run across it. Not to mention how phones do it; you can't override a DoH DNS server when connecting to a VPN which offers internal DNS on Android, for instance.

> you can't override a DoH DNS server when connecting to a VPN which offers internal DNS on Android, for instance.

True. I set my VPN server to force DNS thru the tunnel to an intercepting DNS server - and it replies as if it were the intended DNS server.

DNS server is setup this way in response to LAN devices that have their own DNS configured, but it handles Android's private DNS too.

Re: Why is DNS still hard to learn?

#115

Post by neilv »

At one point, I had to make and maintain my own DNS zone text file, knowing only a little. Today, cheap providers give me various Web forms interfaces, but that doesn't mean it will always "just work", so knowing a little can still help.

I still had to break out `dig` the other day, when a DNS provider started answering records days past TTL, breaking email and Web.

To know when if/when that happened again, I looked around for a monitoring service, but didn't quickly find one that did what I wanted (and was overwhelmed by SEO, and very aggressive robo-sales emails from one of them), so I wrote a script that essentially runs `dig` and `diff`: https://www.neilvandyke.org/check-my-dns/

The monitoring script discovered one of a provider's DNS servers had ongoing problems, so I sent them a monitoring report, saying I wasn't a DNS expert, but perhaps, if there's a problem, the report would be helpful to their DNS experts. This seemed to immediately get past any "have you tried rebooting Windows" front-line flowchart response that I wouldn't have been surprised to hear, and they said they're working on it.

Re: Why is DNS still hard to learn?

#116

Post by somat »

haroldp wrote: post #97
shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

Can you help me find the mistake in my zone file? $ORIGIN example.net. $TTL 900 @ IN SOA ns1.example.com. hostmaster@example.com. ( 20230728001 1800 300 3600 172800 ) @ IN NS 8.8.8.8. @ IN NS 8.8.4.4. @ IN CNAME example.com. @ IN MX 10 172.253.124.27 www IN CNAME example.com

Also the CNAME if you have a cname you don't want any other records with the same name. It ends up being a confusing and ambiguous situation to be if. You are supposed to use the cname to jump the the actual record. but now there is also a MX record here are we supposed to do anything with it?

Re: Why is DNS still hard to learn?

#117

Post by vichle »

yodsanklai wrote: post #39
shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

> I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. Younger people aren't dumber than old one, they build even more complex stuff on top of these old abstractions.

Because all great developers create More complexity (-:

Re: Why is DNS still hard to learn?

#118

Post by pessimizer »

f1shy wrote: post #88
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Absolutely agree. Back in the days, I was very inexperienced, I was thrown to the task of administering DNS (with BIND) and Sendmail. I had 100+ servers. The first couple of month was a lot of reading, and understanding things, but relatively fast I got a good understanding of it. After 6 month I was teaching DNS to other teams in other countries for the same company. It was not at all hard. I'm a very average engine…

DNS isn't at all hard, it only takes two months to learn when you're being paid to, and after only 6 months you'll be knowledgeable enough to teach!

> from 0 to explaining to others in 6 month, is by no means a difficult topic.

You should have seen almost anything else. Many things can be learned within days.

Re: Why is DNS still hard to learn?

#120

Post by naniwaduni »

paulddraper wrote: post #18
bratgpttamer wrote: post #14

I feel like DNS is one of the more straightforward protocols, especially on a practical level, and especially given that most interfaces are a dropdown and two text boxes. I have noticed a lot of developers shy away from it, probably because they don't use it much or it's not their job (rather than it being hard).

"Dropdown and two text boxes" undersells it. Here is the list of several dozen record types: https://www.iana.org/assignments/dns-parameters/dns-paramete...

Yeah, that's the dropdown.
Post reply on HN