How DNS Works

1. The user enters asks Netscape to go to "http://www.woz.org" and hits return.

2. The computer's TCP stack doesn't know what address "www.woz.org" points to, so it calls upon its DNS server (192.100.81.101) for the address.

3. The DNS server runs the zone "netcom.net" and doesn't handle "woz.org". It first looks in its cache to see if its looked it up before, if so it just returns the address. Unfortunately the server hasn't looked up "netcom.net" before (or its cache entry has timed out), so it queries the server above it ".com" name server at the InterNIC (Internet Information Center) for the "woz.org" server.

Cached lookups on a domain name server are given "time-out values." This rids us of the problem of old entries being passed around. Time-out values are usually a minutes (for often-changed names) to more than a week. Time-out values are set by the person who runs the name server for a zone. This means that the administrator of "woz.org" can only set the time-out values for "woz.org" entries, and cannot modify "netcom.net" or "apple.com" entries, etc.

The InterNIC is where everybody must register their domain names. It keeps the hierarchy in tact so it works. It also houses what is called the "root servers," which point to ".org", ".net", ".com", etc. points in the Domain Name Space hierarchy.

4. The root servers pass the request to the ".org" root server.

5. The ".org" root server passes looks up the "woz.org" server and finds it, so it passes the request to "woz.org"'s name server.

Note that the root servers only look up where "woz.org" is. They are not responsible for any of the children ("www", "dns", etc.) that "woz.org" is authoritative for. In this case, the root servers are authoritative for ".org", ".com", etc. They delegate authority for other domains to their children in the domain name space tree. Here is what the tree would look like going to the "woz.org" domain: Note that the root servers are "parents" to ".org", which is the "parent" of anything under it, including "woz", which is the "parent" of "dns", "www" and anything else that ends with "woz.org".

6. The "woz.org" name server looks in its table for a "www" entry. It finds it, and returns its address, 207.142.33.2.

7. The request goes back to the sender, who's address has been retained the entire time as the originator of the name query.

8. The address 207.142.33.2 is added to the "netcom.net" name server's cache with a 1 day time-out, which means that it doesn't have to take the above steps again for an entire day.

9. The "netcom.net" name server returns the address to the user's TCP stack, which tells Netscape what address on the Internet to connect to (see above diagram).

10. The user gets connected to "www.woz.org".

As you can see, the entire process is very structured, which lends to the reason DNS has been so widely accepted and is now the standard for name/address resolution on the Internet.

There is another type of lookup called a "reverse lookup" which looks for the name of a server, instead of its address. So, knowing its address, it queries the name server for the name of the server using the same process you just saw. This is also known as an "IN-ARPA" lookup.

How Name Servers Get Their Data

Parent name servers have to be able to query their siblings for data. This is called a "Zone Transfer" and is a special type of request. Zone transfers are used for when a zone's DNS server goes down. For example, if "ns1.apple.com" does zone transfers with "ns2.apple.com" we can be sure if "ns1" goes down that "ns2" will handle DNS queries until "ns1" is fixed (assuming "ns2" isn't down as well). How do servers know to switch? When you set up your domain with the InterNIC you specify a secondary name server, that's how! Isn't this structured approach great?

When the zone transfer request is sent by a parent server the name server sends a complete zone list in response and increments the zone's "serial number". If the parent server's last serial number from a zone transfer is less than the one in the transferred zone file then it needs to update its entries. If the number is the same then no updates have been made and the zone transfer data isn't used.