Unit 5: How DNS answers · Lesson 1 of 6 · 15 min
How a lookup works
Follow one question from your laptop through the resolver to the server that knows the answer.
mission
- You are
- The analyst on the mail migration.
- Situation
- Mail for corp.example is moving to a new server next week. Before anything changes, you record where mail goes today.
- Goal
- Follow a DNS lookup and read which host receives the company's mail.
- Hand in
- The current mail host for corp.example.
DNS as pneumatic tubes
Your workstation runs a DNS server for corp.example on 127.0.0.1, so every query in this unit names that server with @127.0.0.1. In this lab the resolver and the zone live on one machine, so you see only the first and last hop.
Ask for an address
+short prints only the data, which is what you want in scripts.
dig @127.0.0.1 www.corp.example +short
10.20.0.11
Ask for the mail host
An MX record names the server that accepts mail for a domain, with a preference number. Lower numbers are tried first.
dig @127.0.0.1 corp.example MX +short
10 mail01.corp.example.
you should see One mail host, mail01, with preference 10.
defender tip Attackers who change a company's MX record receive its mail. Monitor MX, NS and TXT records for changes the same way you monitor firewall rules.
Record types
| Command | What it does |
|---|---|
A / AAAA | Name to IPv4 / IPv6 address |
CNAME | This name is an alias for another name |
MX | Which host accepts mail for the domain |
TXT | Any text. Mail policies such as SPF, and domain ownership checks |
NS | Which servers are authoritative for the zone |
PTR | Address back to name, the reverse lookup |
Look up the intranet
Try one more name the lab's DNS server knows.
dig @127.0.0.1 intranet.corp.example +short
10.20.0.40
you should see 10.20.0.40.
Ask the question backwards
A reverse lookup turns an address back into a name, handy when a log only has IPs.
dig @127.0.0.1 -x 10.20.0.25 +short
mail01.corp.example.
you should see mail01.corp.example.
What a defender takes away
- 1A lookup goes laptop to resolver, and the resolver asks root, TLD and the authoritative server.
- 2Answers are cached for their TTL, so changes take time to spread.
- 3MX, NS and TXT records are security settings. Watch them.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.