DNS at 30
summary
RFC1035 (1987) still shapes DNS but recent changes matter: DNSSEC signs zones with a KSK (kept offline) and ZSK (rotated several times a year), DANE lets TLS keys live in DNS, and DNS Privacy work includes port 853 DNS over TLS for the stub→resolver link. Roots use 13 logical root addresses published in clients and roughly ~450 anycast instances worldwide. Cache‑poisoning exploits a 16‑bit query ID (Dan Kaminsky 2008 used random names + NS injection); countermeasures are source‑port randomization, DNSSEC, and local validators like unbound, getdns and Stubby.
AI-written summary · about
chapters (20)
- 0:00Introduction and context
- 1:28Domain name system history
- 3:35Evolution of address routing
- 5:36DNS infrastructure and growth
- 8:42DNS system structure
- 10:27Authoritative and root servers
- 20:16DNS packet structure
- 24:09Data representation and flags
- 27:35Resource records types
- 34:33Query demonstration
- 34:45Live lookup walkthrough
- 35:57Review of lookup results
- 37:03Challenges in DNS resolution
- 37:58Application programming
- 38:34Modern lookup APIs
- 40:52DNS extension mechanisms
- 41:54Security and cache poisoning
- 52:35Introduction to DNSSEC
- 53:51Implementing DNSSEC
- 56:50Privacy and future outlook
related talks
15mYou Depend on DNS, This Is How It Works and You Won't...
28mDarwin & Protocols
12mHow DNS doesn’t work!- 28mDarwin & Protocols
10mLet’s implement DNS to learn history!
26mMisuse of DNS, the Second Most Used Protocol
46mDNSSEC
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter