4

I am trying to understand the purpose of public DNS nameservers (public as in not an SOA; like 8.8.8.8).

I executed a dig +trace command, and, as far as I can tell, the only time the nameserver is used is when finding The SOA of the root domain .. After that, the SOA of each domain up in the hierachy is queried.

My assumptions are that public nameservers are used for:

  • identifying the SOAs of the root domain, so they don't have to be hardcoded on clients.
  • decentralizing the process and caching. So if a domain's SOA goes down, another server can guide the clients.
  • reducing the load on the SOA. If another server knows the recored, no need to query the SOA.

I have 3 question:

  • Are my assumptions correct?

  • If these are really the only things that a nameserver does, if I don't need caching and am willing to do the recursive query on my own, can I stop using nameservers?

  • Can/Does an SOA refuse to answer queries from a specific nameserver if it performs too many requests?
  • Your question is hard to understand because of the wrong use of some technical terms. For instance, I don't think you use "SOA" correctly, specially in the last sentence. – bortzmeyer May 15 '18 at 14:23
7

Your assumption is incorrect. The +trace option tells dig to query the SOA servers for each domain; that's not its normal behaviour. A normal DNS lookup will use your configured DNS server, such as a public recursive DNS server, for all of its lookups.

You can't stop using name servers unless you're prepared to use IP addresses only. But you can run your own recursive name server, possibly on the same machine as your client software, in which case you can stop using public recursive name servers.

  • How does the public server know the answer if it's not the SOA? – David Bryant May 13 '18 at 16:14
  • @DavidBryant The public server gets it from the SOA, if it doesn't have the result cached. That's what recursive DNS servers do. But your client isn't getting anything from the SOA. – Mike Scott May 13 '18 at 16:16
  • Thanks for clarifying. One last question: I noticed that when I send a high number of requests per second to public nameservers, I start getting REFUSED/SERVFAIL responses or just outright wrong responses, like NXDOMAIN for existent domains. Is this the result of the public server banning me, or is that the SOA banning the public server? (considering the public server doesn't cache responses and asks the SOA every single time) – David Bryant May 13 '18 at 16:23
  • That will most likely be the public server throttling your access. – Mike Scott May 13 '18 at 17:50
  • 3
    No matter how many times you query a DNS server it is never supposed to send NXDOMAIN for existent domains. If a DNS server does that, then that DNS server is faulty. – kasperd May 13 '18 at 21:59
5

As a small addition to Mike Scott's answer...

The main purposes of public name servers (as you've defined them) are to:

  1. Keep individuals from having to run their own name servers.

  2. Help (potentially) speed up the process of resolving domains.

Some notes regarding your "three assumptions"

  • Some name servers merely forward lookups for unknown requests to other recursive resolvers (such as public name servers). Since public name servers keep a root hints files to do recursive lookups, this does mean that this file is unnecessary on these forwarding-only name servers. However, this has nothing to do with any "clients" (as far as I understand your meaning).

  • Public name servers can (arguably) help with decentralization and caching. Likewise, they can potentially provide robustness to the DNS system overall. But these are side benefits.

  • Public DNS servers can reduce the load on an authoritative name server, but again, that is not the main reason for bypassing those servers. The idea is that cached information is returned quicker versus asking for that information from an authoritative name server.

0

A public resolver (be careful of the terme "nameserver": there are two kinds of name servers, resolvers and authoritative, and they have almost nothing in common) is just a resolver, like the one of your ISP or the one you run yourself on your network. Like any service, they can be faster or slower than the default service, more or less reliable, have some additional good or bad features but they don't do anything specific.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.