DNS lab: dig, part 1
In the following labs, we'll be using "auth1" as your work machine.
In reality, this is not very important, as we're only going to be using
the 'dig' command.
DIG
---
1. Issue DNS queries using 'dig':
Note: make sure you explicitly specify the nameserver to query using the
"@" syntax in dig:
$ dig @server_ip ...
If you do not specify the @server_ip, then dig will use the nameserver(s)
listed in /etc/resolv.conf
1a. Run each command, look for the ANSWER section and write down the result.
Make note of the TTL as well.
Repeat the command. Is the TTL the same? Are the responses Authoritative?
RESULT 1 RESULT 2
-------- --------
$ dig @10.192.0.231 your-favorite-domain a
$ dig @10.192.0.231 www.google.com. a
$ dig @10.192.0.231 afnog.org. mx
$ dig @10.192.0.231 NonExistentDomain.sometld any
$ dig @10.192.0.231 tiscali.co.uk. txt
$ dig @10.192.0.231 www.afrinic.net aaaa
$ dig @10.192.0.231 www.google.com aaaa
1b. Now send some queries to another caching server.
(Run each of the following twice, and note the time in ms for each attempt)
RESULT 1 RESULT 2
-------- --------
$ dig @8.8.8.8 news.bbc.co.uk. a
$ dig @208.67.222.222 yahoo.com. a
$ dig @222.31.0.1 fb.com a
How long did it take each answer to be received? (on the first, and
on the second lookup)
Some public servers or "open resolvers":
217.31.204.130, 193.29.206.206, 149.20.64.20, 159.226.168.30, 222.31.0.1
2. Reverse DNS lookups
Now try some reverse DNS lookups - note here that we do not explicitly
specify which nameserver dig should query. Which nameserver will be used ?
$ dig -x 10.192.X.1
$ dig -x 10.192.X.2
$ dig -x 10.192.X.3
... where X is an IP address is your group number
Repeat for an IP address of your choice, on the Internet. Remember, you'll
have to use @10.192.0.231 to be able to perform DNS queries on the Internet...
Now try to lookup:
$ dig 1.X.192.10.in-addr.arpa. PTR
... where X is your group number.
What do you notice ?
Let's try IPv6 now:
$ dig @10.192.0.231 -x 2001:42d0::200:2:1
What are the differences you can observe in the results, between reverse
DNS for IPv6 and IPv4 addresses ?
Note: you may possibly not get an answer for the v6 address - but compare
the question section for the IPv4 and IPv6 reverse addresses.
3. DNSSEC & EDNS0
Try some of the queries above, this time add the "+edns=0" option.
For example:
$ dig @10.192.0.231 www.icann.org +edns=0
Notice the OPT PSEUDOSECTION, at the top of the output ?
What do you notice about the flags: section in the OPT section ?
Let's explicitly enable the BUFSIZE option, but not EDNS0:
$ dig @10.192.0.231 www.icann.org +noedns +bufsize=1024
Notice that EDNS is set automatically, and notice the udp: size section
in the OPT pseudosection.
Now, let's try and retrieve DNSSEC records:
$ dig @10.192.0.231 isoc.org DNSKEY | more
$ dig @10.192.0.231 www.isoc.org RRSIG | more
And finally, let's tell our DNS server that we support DNSSEC:
$ dig @10.192.0.231 www.isoc.org A +dnssec
$ dig @10.192.0.231 isoc.org NS +dnssec
$ dig @10.192.0.231 google.com NS +dnssec
Do you notice a new field in the "flags:" section of the answer
in the HEADER and OPT PSEUDOSECTION ?
$ dig @10.192.0.231 www.isoc.org A
$ dig @10.192.0.231 isoc.org NS
$ dig @10.192.0.231 google.com NS
Compare with doing dig WITHOUT the +dnssec option and for a
domain without DNSSEC:
Now look at a large response:
$ dig @10.192.0.231 isoc.org DNSKEY +dnssec
And limit our buffersize:
$ dig @10.192.0.231 isoc.org DNSKEY +dnssec +bufsize=512
What do you notice at the begining of the response?
Why does DNS default to UDP?
If you are alreaady running a nameserver on your local server,
What happens if you send DNSSEC enabled queries to it ?
$ dig @127.0.0.1 noc.ws.nsrc.org A +dnssec
$ dig @127.0.0.1 ws.nsrc.org NS +dnssec
Other Tricks:
Extra credit: Try
$ dig chaos txt version.bind @10.192.0.231
$ dig chaos txt hostname.bind @199.7.83.42
$ dig chaos txt version.bind @10.192.0.232