Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

121–130 of 261 posts

Re: Why is DNS still hard to learn?

#121

Post by WarOnPrivacy »

dogleash wrote: post #65
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

> I think DNS is something few people take the time to learn I kinda agree and think DNS one of those technologies where you can go an entire career without picking up more than bits and peices here and there. Those things gains a sense of mystique in industry as more complicated than it otherwise would if more people had to tackle it full on.

> I kinda agree and think DNS one of those technologies where you can go an entire career without picking up more than bits and peices here and there.

As far as that's true it's weird, because DNS basically does one straightforward thing. But then you get into all the places where that one thing has to be done in different ways.

Where I wouldn't mind some more magic is with reverse DNS. Too many tables don't know a name pointing to an IP until something tries to resolve that name.

Reliably historical rdns would be even more awesome but that's more of a service than a spec thing.

Re: Why is DNS still hard to learn?

#122

Post by tikhonj »

TheNewsIsHere wrote: post #109
antonjs wrote: post #96

Earlier quoted context omitted.

And does your browser have settings which bypass or supplement the host's DNS configuration. Secure DNS (DoH etc) is great, but damn that's confusing when you first run across it. Not to mention how phones do it; you can't override a DoH DNS server when connecting to a VPN which offers internal DNS on Android, for instance.

Aren’t all of those concerns out of scope for DNS itself, though? DNS can only give you a TTL, for example, it cannot require you follow it. Ideally that’s what RFCs are for, but even organizations that pay smart people to come up with clever standards don’t always follow them. Implementations frequently disregard or guess about the things standards cover.

From the point of view of the standard, maybe, but not from the point of view of somebody learning or using DNS.

Re: Why is DNS still hard to learn?

#123

Post by 8organicbits »

Dylan16807 wrote: post #13
pgray wrote: post #5

the joke i've always heard is DNS combines 2 of the hardest problems in CS: naming things and cache invalidation

It comes with a validity counter in seconds, and you can be very very loose about counting those seconds. It's not the hard kind of cache invalidation. You don't really have to do "invalidation" at all. And on the server side, it's perfectly acceptable to send a mix of old and new versions for a while.

You sometimes can perform an invalidation, but it's a manual process and you need to know who to ask. Slack did this when they botched their DNSSEC rollout[1]:

> Our team quickly started contacting major ISPs and operators that run public DNS resolvers, with the request to flush all cached records for slack.com.

DNSSEC is another part of DNS that is still hard to learn.

[1] https://news.ycombinator.com/reply?id=36910054&goto=item%3Fi...

Re: Why is DNS still hard to learn?

#124

Post by TheNewsIsHere »

throw0101b wrote: post #101
haroldp wrote: post #97

Earlier quoted context omitted.

Can you help me find the mistake in my zone file? $ORIGIN example.net. $TTL 900 @ IN SOA ns1.example.com. hostmaster@example.com. ( 20230728001 1800 300 3600 172800 ) @ IN NS 8.8.8.8. @ IN NS 8.8.4.4. @ IN CNAME example.com. @ IN MX 10 172.253.124.27 www IN CNAME example.com

Off the top of my head (haven't had to do zone files for ~2 years): * hostmaster@example.com -> hostmaster.example.com * NS records are usually hostnames (not sure if IPs are even valid) * Ditto for MX records ; also add a period to the end, otherwise example.net will get appended * Also appending with the www record See also: * https://linux.die.net/man/8/named-checkzone

To add —

You can do delegated zones by specifying NS records for a subdomain within the parent zone. If you’re talking about NS for a second level domain (“example” in example.com) you would want glue records which are essentially a “lookaside” to prevent circular dependencies. Glue records are really just A records with clout, returned with the IP of your name server. This glue is maintained by the higher level authoritative zone. So you query for example.org and the nameserver for .org returns ns1.example.org as the name server for your zone, as well as the IP address for that server.

This is why you could run a DNS server at ns1.example.org as your authoritative DNS.

Re: Why is DNS still hard to learn?

#125

Post by WarOnPrivacy »

neilk wrote: post #52
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

How did you learn DNS? And when?

Setup an in-house server to sinkhole malware requests.

Re: Why is DNS still hard to learn?

#126

Post by ertian »

'Still'? There's a famous talk[1] in the network community about how DNS complexity is growing so fast that effectively nobody can keep up with it. There's so many competing, overlapping, and overriding RFCs that it's hard to make sense of it anymore.

[1] https://blog.apnic.net/2018/03/29/the-dns-camel/

Re: Why is DNS still hard to learn?

#127

Post by Joel_Mckay »

DNS has been repurposed for everything from security validation to load balancing.

DNS over HTTPS and DNSSEC attempted to address some longstanding issues, but in the end everyone still has a host they know is going to get hammered harder.

Not too difficult to understand, but it is complicated given the number of sub-optimal use-cases that emerged. =)

Re: Why is DNS still hard to learn?

#128

Post by m3047 »

jstx1 wrote: post #102

People who use their DNS knowledge often - what is your job and problems do you solve with your DNS knowledge?

I use DNS to define topology and services (what you'd expect) and of late I'm using it for federating telemetry (the actual data; think of "tags" in the industrial control sense).

I've used it as an observable for asset discovery and classification, as well as for characterizing infrastructure.

Re: Why is DNS still hard to learn?

#129

Post by TheNewsIsHere »

tikhonj wrote: post #122
TheNewsIsHere wrote: post #109

Earlier quoted context omitted.

Aren’t all of those concerns out of scope for DNS itself, though? DNS can only give you a TTL, for example, it cannot require you follow it. Ideally that’s what RFCs are for, but even organizations that pay smart people to come up with clever standards don’t always follow them. Implementations frequently disregard or guess about the things standards cover.

From the point of view of the standard, maybe, but not from the point of view of somebody learning or using DNS.

I don’t disagree, and I think that’s why we need to make it clear that there’s a difference between implementation and standard.

My education is a mix of formal and autodidactic. One of the best things I got from formal education is the structured introduction to fundamentals like the OSI model.

If you don’t have that kind of foundation, it can be much, much harder to understand the “why” of the endless differences between documented standards and in-the-wild implementations. It’s good to know where you are in the stack to help inform what you’re seeing.

Re: Why is DNS still hard to learn?

#130

Post by WarOnPrivacy »

shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

> For example, today wifi routers “just work” right out of the box. In the early 2000s it would have taken a network engineer

Or a nerd buying a WRT54v1 to install hyperwrt.

Post reply on HN