What is DNS? (and how it makes the Internet work)

About this video

The creator explains DNS as the internet’s contacts app: browsers know a name, not the IP address they actually need. He traces a first visit to academy.networkchuck.com step by step — the local stub resolver checks its cache, then asks a recursive resolver such as Google’s 8.8.8.8, which asks a root server, which only points to the servers for the .com top-level domain, which in turn point to the authoritative name server for the second-level domain (Cloudflare in his example), which finally answers from its zone file. He notes the roots comprise 13 named authorities run by 12 organisations, with 1,865 servers worldwide. He then tours record types in a zone file — A, AAAA, NS, MX, PTR, CNAME and TXT, including SPF, DKIM and DMARC for email — and explains registrars, ICANN and WHOIS privacy. The security section stresses that default DNS uses unencrypted UDP port 53, exposing queries to snooping and spoofing by hackers or an ISP, and presents DNS over HTTPS, DNS over TLS, DNSCrypt and DNSSEC as fixes, plus sponsor Twingate as a way to enforce secure DNS and filtering across a family’s or team’s devices.

Key takeaways

• DNS resolution is hierarchical: cache, recursive resolver, root, TLD server, then the domain’s authoritative name server — no single server knows everything.
• Root servers only delegate by top-level domain (.com, .net, country codes) and TLD servers only point to authoritative servers for second-level domains.
• Zone files hold more than web addresses: A/AAAA for IPs, MX for mail, PTR for reverse lookups, CNAME for aliases, and TXT records carrying SPF, DKIM and DMARC.
• Plain DNS on UDP port 53 is unencrypted, so queries can be observed or spoofed; prefer resolvers and clients that support DNS over HTTPS or DNS over TLS.
• You can run your own recursive DNS at home, for example Pi-hole or AdGuard on a Raspberry Pi, forwarding unknown queries to an upstream resolver you choose.

Episode details: published August 28, 2024 · 24:22 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: Using AI to become a Hacker · Next: IPv6 keeps getting hacked on Windows →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube