DNS Configuration - CompTIA A+ 220-1201 - 2.4

Main ideas / concepts

• DNS (Domain Name System) is a critical network service that translates fully qualified domain names (FQDNs) into the corresponding IP addresses.
  • Example: typing www.professormesser.com in a browser triggers DNS resolution to find the IP address for that hostname.
• DNS works as a hierarchical distributed database across the internet:
  • The hierarchy includes 13 root server clusters (with over a thousand servers behind them).
  • Root servers help direct queries to top-level domains (TLDs) (e.g., com, org, net) and country-code TLDs (e.g., US=.us, Canada=.ca, UK=.uk).
  • Domain structure is layered, such as:
    • professormesser.com
    • www.professormesser.com
    • mail.professormesser.com
    • sub-host examples like chat.katy.east.professormesser.com / ftp.judy.west.professormesser.com
• DNS data is stored in resource records (RRs), which can include:
  • IP address mappings
  • certificate-related info
  • email-related details
  • aliases (CNAMEs)
  • and more
• DNS configuration changes should be handled carefully:
  • A mistake in DNS can make devices/services unavailable to others on the internet.
  • When managing DNS, always back up and ensure a quick rollback plan.
• Tools to query/inspect DNS:
  • dig (common on Linux/macOS; sometimes available on Windows)
  • nslookup (commonly on Windows)
  • Queries return the DNS server’s records answering the asked question.
• DNS is managed via server configuration interfaces that may include:
  • a raw text configuration file (not used in the example)
  • a web-based front end for adding/modifying records

DNS record types and what they accomplish

A / AAAA records (host-to-IP mapping)

• A record (IPv4)
  • Maps a hostname to an IPv4 address.
  • Example (as stated): host www, record type A, IP address 162.59.246.164
• AAAA record (IPv6; referred to as “quad A” in subtitles)
  • Same purpose as A, but for IPv6 addresses
• Time To Live (TTL)
  • How long clients cache the answer
  • Example: TTL set to 15 minutes, after which clients refresh

CNAME records (aliasing)

• Lets one hostname act as an alias for another canonical hostname.
• Purpose:
  • If multiple services use the same server, you can point them all to one “real” name.
  • Example concept:
    • chat.example.com, ftp.example.com, www.example.com → all map to mail.example.com
• Benefit:
  • If the IP changes for the canonical server (mail.example.com), only its A/AAAA record needs updating; CNAMEs can remain unchanged.

MX records (mail exchanger)

• MX = Mail Exchanger records ensure you can send and receive email for a domain.
• How it works:
  1. Look up the domain’s MX record to find the mail server hostname.
  2. Then look up that mail server’s A/AAAA record to get its IP address.
  3. Send email to that IP.
• Example concept:
  • MX target: mail.example.com
  • Then lookup A record for mail.example.com to obtain the destination IP
• MX administration via web UI typically includes:
  • host/name
  • target mail server
  • TTL

TXT records (human-readable DNS text; verification & policy)

• TXT records store text-based information others can query.
• Common uses described:
  • Email verification
  • Anti-spam measures
  • Publishing security/authentication data for other servers

Email authentication concepts conveyed

DKIM (DomainKeys Identified Mail)

• DKIM is carried in a TXT record containing a public key:
  • DNS stores the public key
  • Email messages are signed with the domain’s private key
• Verification flow (as described):
  • Recipient mail server receives a message with a DKIM signature
  • It retrieves the public key from DNS (TXT record)
  • It verifies the signature to ensure the message was truly sent by an authorized system for the domain
• DKIM record provisioning (concept):
  • Configure a TXT record with DKIM content (public key) and TTL

SPF (Sender Policy Framework)

• SPF is delivered via a TXT record listing which servers are allowed to send email for the domain.
• How SPF is used:
  • Recipient checks the message’s originating server against the SPF-allowed list
  • If the origin is not listed, the message may be considered suspicious/invalid
• SPF record properties (as described):
  • Record type: TXT
  • Host: @ / “all hosts” (as stated)
  • Content: allowed sending server(s)/rules
• SPF and DKIM together:
  • Mail receivers can use SPF to validate sender origin and DKIM to validate signature authenticity

DMARC (Domain-based Message Authentication Reporting and Conformance)

• DMARC is another TXT record used to declare what to do with messages that fail authentication (SPF and/or DKIM).
• Receiver policy outcomes (as described):
  • Accept and deliver normally
  • Send to quarantine/spam
  • Reject completely
• Reporting:
  • DMARC can include a reporting email address so disposition results can be sent to a central reporting tool
  • This enables tracking how many messages passed vs. were marked spam/quarantined

Methodology / instruction-like guidance explicitly stated

• When editing DNS:
  • Take precautions because errors can disrupt services globally
  • Always back up DNS settings
  • Ensure you have a revert/rollback method if problems occur
• When changing A/AAAA records, set:
  • record type (A for IPv4, AAAA/“quad A” for IPv6)
  • hostname
  • IP address value
  • TTL (example: 15 minutes)
  • Expect propagation according to TTL
• When administering records via web-based DNS front end, use the interface to:
  • add new records
  • modify existing records
  • update relevant record fields (e.g., host/name, target/content, TTL)

Speakers / sources featured

• Professor Messer (referenced as the example domain: professormesser.com and in examples like www.professormesser.com)