2

I setup my name server based on this link: https://www.digitalocean.com/community/tutorials/an-introduction-to-dns-terminology-components-and-concepts

Normally the name server resolv.conf would contain 2 other available name server ip. But what if the resolv.conf just has 127.0.0.1 as the servername like this:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
#nameserver 172.31.0.2
#nameserver 127.0.0.53
search ec2.internal

Then on my custom name server, I input following command in terminal:

telnet www.yahoo.com 80
Trying 98.139.180.149...
Connected to fd-fp3.wg1.b.yahoo.com.
Escape character is '^]'.
GET / HTTP/1.1
Host: www.yahoo.com

I have test it and the name server works well.

Thus, I have two assumption:

1: if the resolv.conf file only contain 127.0.0.1, the name server will iterative query the 'root` server, then TLD name server, etc.

2: The name server, such as bind9, has the record of root server, thus it could send query directly without additional query.

If I am correct, where the name server record the root server address?

However, if I am wrong, what is the query flow for such situation? Thanks.

update

After using tcpdump track the query flow, the name server does query the root name server firtly. But why the root server return all the other root name server to me?

k.root-servers.net.domain > ip-172-31-8-42.55523: Flags [P.], cksum 0x8784 (correct), seq 1:1100, ack 31, win 229, options [nop,nop,TS val 1581998147 ecr 403293], length 109964020*- q: NS? . 14/0/27 . NS b.root-servers.net., . NS g.root-servers.net., . NS i.root-servers.net., . NS c.root-servers.net., . NS e.root-servers.net., . NS f.root-servers.net., . NS d.root-servers.net., . NS l.root-servers.net., . NS k.root-servers.net., . NS a.root-servers.net., . NS j.root-servers.net., . NS h.root-servers.net., . NS m.root-servers.net., . RRSIG ar: a.root-servers.net. A 198.41.0.4, b.root-servers.net. A 192.228.79.201, c.root-servers.net. A 192.33.4.12, d.root-servers.net. A 199.7.91.13, e.root-servers.net. A 192.203.230.10, f.root-servers.net. A 192.5.5.241, g.root-servers.net. A 192.112.36.4, h.root-servers.net. A 198.97.190.53, i.root-servers.net. A 192.36.148.17, j.root-servers.net. A 192.58.128.30, k.root-servers.net. A 193.0.14.129, l.root-servers.net. A 199.7.83.42, m.root-servers.net. A 202.12.27.33, a.root-servers.net. AAAA 2001:503:ba3e::2:30, b.root-servers.net. AAAA 2001:500:84::b, c.root-servers.net. AAAA 2001:500:2::c, d.root-servers.net. AAAA 2001:500:2d::d, e.root-servers.net. AAAA 2001:500:a8::e, f.root-servers.net. AAAA 2001:500:2f::f, g.root-servers.net. AAAA 2001:500:12::d0d, h.root-servers.net. AAAA 2001:500:1::53, i.root-servers.net. AAAA 2001:7fe::53, j.root-servers.net. AAAA 2001:503:c27::2:30, k.root-servers.net. AAAA 2001:7fd::1, l.root-servers.net. AAAA 2001:500:9f::42, m.root-servers.net. AAAA 2001:dc3::35, . OPT UDPsize=4096 DO (1097)

If the name server already has the record of all the root server, this step is meaningless.

  • 1
    Not sure if I understand the question, but if resolv.conf contains 127.0.0.1 aka localhost, you are very likely running a DNS proxy or cahce like dnsmasq or pdnsd. So any application will query only this local service, and the service in turn will query in whatever way it's configured to query (look at its configuration). – dirkt Mar 19 '17 at 22:12
  • Both of your assumptions might be correct but they could be wrong. Even though your nameservice is working, without seeing your nameserver configuration it's not possible to be sure either way. – roaima Mar 19 '17 at 23:24
2

you can debug DNS flows/path in real-time; either installing and using the dnstracer command, or using the debug mode of nslookup, or dig in trace mode.

See my answer to a related question for how to use these commands How to find out nameserver which resolves a particular host name

1

The file /etc/resolv.conf has got nothing to do with your name server. It is the configuration file for the resolver library which tells the library where to find the name server(s). In this case, because the file only contains a single nameserver entry pointing to 127.0.0.1, some software component on your local host functions as a name server. Without knowing your configuration better, I can't say if it is bind9 or a proxy (e.g. dnsmasq, as suggested by dirkt above).

The point is that the resolv.conf file does not affect how the name server functions, it is not a name server configuration file.

  • you right, my name server works well even there is no entry point in etc/resolv.conf. – sydridgm Mar 20 '17 at 14:00
0

try to answer my own question, hope any improvement or better answer. not include update part

My two assumptions are right. If the resolv.conf file only contains 127.0.0.1, the name server will directly ask one of the root server.

I use bind9 name server, and all the root server info has been stored in /etc/bind/db.root. Thus the name server just fetch it and use one of them randomly.

Then you could use tcpdump to record the the query flow.

tcpdump -w tcpdump.out & telnet www.google.com 80 tcpdump -t -r tcpdump.out

you can also use tcpdump -vv to see more details.

0

When a recursive nameserver starts, such as the one sitting at 127.0.0.1 on your server, it does 'root priming' : it starts with some root server IP address it has on file (as distributed with the software when it was installed) and asks for NS . (which you can see in your tcpdump output) to get back all current names and IP adresses (both v4 and v6) of root servers (because its local file may contain stale information, root server IP adresses seldom change but do change occasionnally).

So the step is not meaningless, it is a kind of soft auto-update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.