How to test DNS Server for Host Resolution

The Domain Name System (DNS) is a standard technology for managing the names of Web sites and other Internet domains. DNS is an Internet service that translates domain names into IP addresses. Because domain names (example - google.com) are alphabetic, they're easier to remember. The Internet however, is really based on IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the corresponding IP address. For example, the domain name www.google.com.com might translate to 209.85.153.104.

The DNS system is, in fact, its own network. If one DNS server doesn't know how to translate a particular domain name, it asks another one, and so on, until the correct IP address is returned.

There are a number of commands you can use do test the DNS server resolution.

The Host Command

host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, host prints a short summary of its command line arguments and options.

# host www.google.com
google.com has address 209.85.153.104

To perform a reverse lookup

# host 209.85.153.104
104.153.85.209.in-addr.arpa domain name pointer bom01s01-in-f104.1e100.net.

As you can see, the forward and reverse entries don't match. The reverse entry matches the entry of the ISP.

The nslookup Command

Nslookup is a program to query Internet domain name servers. Nslookup has two modes: interactive and non-interactive. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain. Non-interactive mode is used to print just the name and requested information for a host or domain

#nslookup www.google.com
Server:         172.19.12.12
Address:        172.19.12.12#53

Non-authoritative answer: 

www.google.com  canonical name = www.l.google.com.
Name:   www.l.google.com
Address: 209.85.153.104

To perform a reverse lookup

#nslookup 209.85.153.104
Server:         172.19.12.12
Address:        172.19.12.12#53

Non-authoritative answer:
104.153.85.209.in-addr.arpa     name = bom01s01-in-f104.1e100.net.

dig:

dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.

# dig www.google.com

; <<>> DiG 9.5.0-P2 <<>> www.google.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22795
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.         85097   IN      CNAME   www.l.google.com.
www.l.google.com.       259     IN      A       209.85.153.104

;; Query time: 1 msec
;; SERVER: 172.19.12.12#53(172.19.12.12)
;; WHEN: Mon Jan 24 16:33:29 2011
;; MSG SIZE  rcvd: 68

DNS client configuration files /etc/hosts, /etc/nsswitch.conf and /etc/resolv.conf

There are three main client configuration files associated with DNS: /etc/hosts, /etc/nsswitch.conf and /etc/resolv.conf. When your computer looks for another computer on a TCP/IP network such as the Internet, it typically looks in two places: /etc/hosts and any DNS servers that you've set up for your network.

/etc/hosts

The /etc/hosts file keeps a local name database. This file helps in local name resolution if your local DNS server is not functioning. Network adinistrators should manually populate entries in this file. A sample /etc/hosts file is copied below.

[root@RHEL01 ~]# cat /etc/hosts

# Do not remove the following line, or various programs
# that require network functionality will fail.

127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
192.168.1.1 RHEl01.omnisecu.com RHEL01
192.168.1.105 RHEL05.omnisecu.com RHEL05
192.168.1.106 RHEL06.omnisecu.com RHEL06
192.168.1.107 RHEL07.omnisecu.com RHEL07
192.168.1.108 RHEL08.omnisecu.com RHEL08
192.168.1.109 RHEL09.omnisecu.com RHEL09

/etc/nsswitch.conf

The order of name resolution process is determined by a single line in /etc/nsswitch.conf:

hosts: files,dns

In this case, the name resolution process will begin with checking /etc/hosts file, and if the name cannot be resolved, the name resolution will happen with the DNS server.

/etc/resolv.conf

The /etc/resolv.conf file contains directives with the IP addresses of nameservers available to a host. A sample /etc/resolv.conf file is copied below.

[root@RHEL01 ~]# cat /etc/resolv.conf

search omnisecu.com
nameserver 192.168.1.1

What is Domain Name Resolution ?

When using the Internet most people connect to web sites, ftp servers or other Internet servers by connecting to a domain name, as in www.bleepingcomputer.com. Internet applications, though, do not communicate via domain names, but rather using IP addresses, such as 192.168.1.1. Therefore when you type a domain name in your program that you wish to connect to, your application must first convert it to an IP address that it will use to connect to.
The way these hostnames are resolved to their mapped IP address is called Domain Name Resolution. On almost all operating systems whether they be Apple, Linux, Unix, Netware, or Windows the majority of resolutions from domain names to IP addresses are done through a procedure called DNS.

Domain Name Resolutions

As discussed above, Domain Name Resolution is the task of converting domain names to their corresponding IP address. This is all done behind the scenes and is rarely noticed by the user. When you enter a domain name in an application that uses the Internet, the application will issue a command to have the operating system convert the domain name into its IP address, and then connect to that IP address to perform whatever operation it is trying to do.
The way the operating system resolves the domain name is based upon its configuration. For almost all operating systems the default order for Domain Name resolution is as follows:

1. Hosts File - There is a file called the HOSTS file that you can use to convert domain names to IP addresses. Entries in the HOSTS file override any mappings that would be resolved via a DNS server.
2. Domain Name System - This is the system used on the Internet for converting domain names to their corresponding IP addresses. Your operating system will connect to the DNS server configured on your computer and have that server return to you the IP address for the domain name you queried it with.
3. Netbios - This only applies to Windows machines and will only be used to map names to IP addresses if all previous methods failed. This method will attempt to map the netbios name you are trying to connect to with an IP address.

It is possible though to change the order that your operating system uses when doing Domain Name Resolution. We will discuss these methods for the Windows and Unix/Linux operating systems below.

 Domain Name Resolution on Windows 

Windows by default uses the above order for Domain Name Resolution. This can be changed though by changing certain registry keys. There registry keys are:

Registry Key	Description
DnsPriority	Which corresponds to using the Domain Name System
LocalPriority	This refers to the local name of the computer
HostsPriority	This is the HOSTS file
NetbtPriority	This is using Netbios name mapping

You assign to these keys a priority based upon values ranging between -32768 and 32767. The lower the number you assign to the entry, the higher the priority for that particular resolution provider.
For example, examine the priorities assigned to the values below:
DnsPriority = 30
LocalPriority = 200
HostsPriority = 75
NetbtPriority = 100
What this will do is change the Domain Name Resolution order to the following sequence:

1. Domain Name System
2. Hosts file
3. Netbios Mappings
4. The Local Computer Name

As you can see I have changed the default order of how Windows will do domain name resolution and the value that had the lowest number had the highest priority when doing domain name resolution.

The location for the above registry subkey's can be found under these registry keys:

Windows 95/98/ME	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSTCP\ServiceProvider
Windows NT, 2000, XP	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider

NOTE: For Windows 95/98/ME if the key does not exist, you must create it. In order for these keys to work with NT 4.0, you need to install Service Pack 4.

Domain Name Resolution on Linux and Unix 

Unix and Linux have a similar default Domain Name Resolution order as Windows. The operating system will first check its /etc/hosts file and if it does not find an entry for the queried domain, it will then query its configured DNS servers.

The order in which server resolves domain names can be changed by editing the /etc/host.conf file. This file determines the order that the operating system uses to resolve domain names. The line that we are concerned with is the one that looks like:

order hosts, bind

This tells the operating system to first check the hosts file, and if that fails, to use DNS, otherwise known as bind which is the name of the software used to make DNS requests.

You can change the order the operating system uses, by changing the order line. For example if we wanted to make it so it queried DNS first and the hosts file second we would change the line to read:

order bind, hosts

Currently the valid values you can place after order is hosts, bind, or nis. NIS stands for the Network Information Service and will not be covered by this article.

 Conclusion

As you can see it is not always wise to think that your operating system will always use the default resolution order. Due to it being possible to change the order in which the operating system does Domain Name Resolution, you must keep this in mind when trying to debug problems with resolving domain names.