DNS: Resolution

What DNS is

Domain Name System (RFC 1035) is a distributed hierarchical database that maps human-readable names to IP addresses (and back). A query goes over UDP/53 (or TCP/53 for large responses).

NSS: Name Service Switch

On Linux, the resolution process itself is a call to the libc function gethostbyname() / getaddrinfo(). That function queries sources through NSS plugins in the order defined in /etc/nsswitch.conf:

hosts: files dns

• files - /etc/hosts
• dns - a real DNS server
• On systems with systemd-resolved: resolve [!UNAVAIL=return] files dns
• With mDNS: mdns_minimal [NOTFOUND=return] files dns

So ping mysite.local checks /etc/hosts first. This lets you locally override any name without touching DNS.

/etc/hosts

The simplest resolver. Format: IP name [aliases...]:

127.0.0.1   localhost

::1         localhost ip6-localhost

192.168.1.5 nas.local nas

Common uses:

• Pinning a name in dev environments (api.local to 127.0.0.1)
• Blocking domains Pi-hole-style (0.0.0.0 ad-tracker.com)
• Hostname tricks for migration tests

/etc/resolv.conf

DNS server list and its parameters:

nameserver 1.1.1.1

nameserver 8.8.8.8

search corp.example.com lab.example.com

options timeout:2 attempts:1

• nameserver - DNS server IP; servers are tried in order
• search - suffixes for short names: ping db1 tries db1.corp.example.com, then db1.lab.example.com, then db1.
• options - timeouts, retry count, randomize, and so on

On systemd systems the file is often a symlink to /run/systemd/resolve/... and is configured through systemd-resolved (or NetworkManager).

getent vs dig

Two resolution commands with different semantics:

• getent hosts name goes through NSS, sees /etc/hosts plus the cache plus DNS. This is the path a real application takes. Use it to answer "what will libc see."

• dig name goes directly to the DNS server in resolv.conf, bypassing /etc/hosts. Use it specifically to debug the DNS server.

So dig mysite.local may return nothing while getent hosts mysite.local returns 127.0.0.1. That is not a bug; those are two different layers.

Record types

• A - name to IPv4
• AAAA - name to IPv6
• CNAME - alias of one name to another
• MX - mail exchanger
• TXT - arbitrary text (SPF, DKIM, domain verification)
• NS - which nameservers are authoritative for the zone
• PTR - reverse: IP to name
• SRV - service record (host and port for a specific service)