Unit 5: How DNS answers · Lesson 2 of 6 · 16 min
Querying with dig
Ask the corp.example server for different record types and read every field of the answer.
mission
- You are
- The analyst documenting the zone.
- Situation
- The intranet has two names, and the security team wants to know which is the real one and what the mail policy says.
- Goal
- Read answer lines in full, follow aliases and do reverse lookups.
- Hand in
- The address behind portal.corp.example, the name of 10.20.0.12 and the SPF policy.
Read a full answer line
+noall +answer hides everything except the answer lines, but keeps the TTL and the type.
dig @127.0.0.1 www.corp.example +noall +answer
www.corp.example. 300 IN A 10.20.0.11
One answer line
- 1
www.corp.example.the name. The final dot is the root of DNS - 2
300TTL: seconds a resolver may cache it - 3
INclass, always IN for internet - 4
Arecord type - 5
10.20.0.11the data
Follow an alias
A CNAME points one name at another. dig follows it and shows both lines.
dig @127.0.0.1 portal.corp.example +noall +answer
portal.corp.example. 300 IN CNAME intranet.corp.example.
intranet.corp.example. 300 IN A 10.20.0.40
you should see portal is just another name for intranet.
defender tip Dangling CNAMEs that point at deleted cloud resources can be claimed by someone else. Review aliases when services are retired.
Look up an address backwards
-x builds the reverse name for you and asks for its PTR record.
dig @127.0.0.1 -x 10.20.0.11 +noall +answer
11.0.20.10.in-addr.arpa. 300 IN PTR www.corp.example.
Pull the record type out of answer lines
www.corp.example. 300 IN A 10.20.0.11 11.0.20.10.in-addr.arpa. 300 IN PTR www.corp.example. example.com. 3600 IN MX 0 . example.com. 3600 IN AAAA 2001:db8::10
4 matches. Group 1: A, PTR, MX, AAAA
Read a TXT record
TXT records hold text for other systems to read. Mail servers use one to check who may send mail for a domain.
dig @127.0.0.1 corp.example TXT +noall +answer
corp.example. 300 IN TXT "v=spf1 mx -all"
you should see An SPF record saying only the domain's MX hosts may send its mail.
What a defender takes away
- 1
+noall +answeris the most useful view: name, TTL, type, data. - 2Follow CNAMEs to the real record before you write a rule.
- 3Reverse lookups help name addresses in logs, but anyone can set their own PTR.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.