Friday, 22 January 2010

DNS Tutorial

This is a tutorial to explain DNS, what it does, and how it relates to your website. For purposes of the tutorial, we shall assume that the user is a home user connected to a ISP with dial-up, cable, DSL, etc. The same ideas apply to businesses, but things can get complicated quickly depending on how the business is set up. Dealing with those complications is beyond the scope of this tutorial.

Before we get into DNS, lets start off with breaking down a web address. This is also known as URL or Uniform Resource Locater. It essentially gives where the web page is, and how you need to talk to it. Lets use the example of:

http://www.onlyonecreations.com/pages/wood-gift-pen.htm

The first part is "http://", and that tells your PC what protocol (what language so to speak) to use talking with this site. In this case, you are using HTTP (HyperText Transfer Protocol). Another very common one for web designers to use is "ftp://" or File Transfer Protocol. You would use it to connect to your webserver to put the web pages you created onto the server.

You also see "https://" quite commonly. This simply means that you the connection between you and the web server is secure (meaning the information being sent back and forth is encrypted). You should see "https://" when you (or your customers) are checking out, especially when they are entering credit card information.

The next part, "onlyonecreations.com" is called the domain name. The "www" used to be more significant than it is today. Today, the "www" is, for the most part, assumed and you can get to the same page regardless of whether or not you type in "www" your browser.

The part "/pages/wood-gift-pen.htm" tells the web server to look in the directory called "pages" and send the file called "wood-gift-pen.htm" to your browser. It is just like the directories on your PC.

Before we get into DNS, we need to explain what an IP address is. Every PC and server has an IP address on the Internet. It has the format of 4 numbers, separated by periods, and looks like "64.17.143.84". Each number should be between 0 and 255.

Think of it as your phone number on the internet, it must be unique. It would be bad to have 2 different houses with the same phone number, and it would be bad to have 2 different machines (more properly known as hosts) that have the same IP address on the Internet.

For most people, it is much easier to remember "www.onlyonecreations.com" than it is to remember "64.17.143.84". When you enter a URL into your browser, you usually use the easy to remember name.

How does your PC know where to find "www.onlyonecreations? Remember that each machine has a IP address? There is a way to translate from the easy to remember domain name, and the hard to remember IP address.

Enter DNS. DNS is an acronym for "Domain Name Service". It's whole purpose in life is to translate between the friendly "www.onlyonecreations.com" and the not-so-friendly 64.17.143.84. It handles this translation for web sites, email, FTP servers, database servers, or any machine within a domain name.

Let's dig into the process of how that works. Let's use the example that Scott types "www.onlyonecreations.com" into his web browser. How does his PC find the web server that has the page he's looking for, among the thousands of web servers?


  1. Scott types in www.onlyonecreations.com to his browser.

  2. Scott's PC looks at it's configuration. It will find something called "DNS Server" or "name server" and there will be an IP address associated with that. Let's say it is 198.6.1.1. Scott's PC sends a message to 198.6.1.1 and asks "I am looking for the IP address of www.onlyonecreations.com, can you tell me what it is?"

  3. The DNS Server (198.6.1.1) gets the message, and assuming that the server already knows what the IP address of www.onlyonecreations.com is, it tells Scott's PC that the IP address is 64.17.143.84. I will get into considerable more depth about the DNS server, how it works, and why it is important to a web site owner, a little later.

  4. Scott's PC gets the message that the IP address of www.onlyonecreations.com is 64.17.143.84. So his PC sends a message to 64.17.143.84 and asks "send me the default web page at 64.17.143.84".

  5. The web server (whose IP address is 64.17.143.84) sends the web page to your browser. That is a simplistic example of how your PC finds a particular web-server and web page. The process of matching a domain name to a IP address is called resolving. So your PC resolves the IP address from the domain name. Let's get into a little more detail.

For step 1, how does Scott's PC know that the IP address of the DNS Server is? There are 2 ways it learns what the address is. The first is that Scott asked his ISP what the address was, and entered it himself. There are times manually entering (also known as statically entering) the address is necessary or desirable, but usually the ISP automatically tells your PC what the IP address of the DNS server is.

This process is called "DHCP" or Dynamic Host Configuration Protocol. When you select "Obtain IP address automatically" in your windows Network connections page, you are telling your PC to use DHCP and to ask the ISP to give you the DNS Server address (among a bunch of other things).

In step 3, we assumed that the DNS server already knew what the IP address of www.onlyonecreations.com was.

What if it didn't already know?

Let's assume that the DNS server Scott's PC sent a request to, doesn't know where www.onlyonecreations.com is.

Have you ever noticed that there are only so many variations of the end of the domain name? There are .com, .gov, .net, .org, .us, .biz, among others. When a DNS server receives a request to resolve an IP address (translate from a domain name to a IP address) for a domain that it doesn't know the answer to, it sends a message to any one of a small number of servers. That small number of servers are responsible for knowing what the "authoritative server" is for EVERY domain name. A realm would be .com, or .org for example, and is properly called a top-level domain.

What is an authoritative server? An authoritative server is a DNS server that has a Statement of Authority configured for a particular domain name. That means that the server has absolute and total knowledge of the domain, any information that contradicts the information that the server has is wrong, it is the final word.

This becomes more important a little later. For purposes of this discussion, let's ignore backup authoritative servers.

The message that Scott's DNS server sends to the top-level domain server "what is the authoritative server for onlyonecreations.com?". It is important to understand, that Scott's DNS Server is NOT asking "what is the IP address of the web server for onlyonecreations?". It is only asking "where do I go to find out where the web server for onlyonecreations.com is?"

Once Scott's DNS server knows where to go to get the answer for Scott's request, it sends a message to the authoritative server asking "what is the IP address of the web server for onlyonecreations.com?". The authoritative server responds, and Scott's DNS Server tells Scott's PC the IP address it needs to connect Scott to the webpage he is looking for.

To summarize the past few paragraphs, Scott's DNS server receives a request for an IP address that it doesn't know. That server makes a request of a top-level domain server, and gets a response with where to go to get the information that Scott is requesting. The DNS server then makes a request of the authoritative server, and forwards the answer it receives to the PC that made the first request.

It sounds long and complex, but it happens very quickly. One way to speed up the process is called caching. Caching is where the DNS server remembers the response from the authoritative server for a period of time. So if Bob makes the same request 5 minutes after Scott did, the DNS server doesn't have to repeat the whole process. Caching will be brought up again in a bit.

So we learned how your PC finds out where it needs to go to get to specific web page. So what. What does that have to do with web site owners? Let's explore.

You're a web site owner, you just got your site made (or had it made). Now you want to register a domain name. What does that mean?

When you register a domain name, you need to talk to a "registrar". You tell the registrar some information about you, and they ask for a "name server", or "DNS Server" when you register the domain. The exact term used will vary, but they all means the same thing - what are the IP addresses for the authoritative servers for your domain? These would generally be the DNS servers of your web host. They will ask for at least 2, sometimes up to 4, but 2 are all that are absolutely needed. Those after the first are used if the first one is down.

For the sake of simplicity, that registrar is responsible for telling the top-level domain servers the answer to the question that Scott's DNS server asked "what is the authoritative server for onlyonecreations.com?".

There are numerous companies that register domain names, and many web designers and web hosting companies have a process to help make this easy for you. However it gets accomplished, make SURE that YOU own the domain name, not the web hosting company, not the web site designer.

This is not as much of a problem as it once was. Many times in the past, your web host/ISP/designer would own the domain name. If you were unhappy with them for whatever reason, you could not move your site to someone else without their blessing. They permitted you to use the domain name because you were a customer. They locked you in as a customer because it was very costly to change domain name. It's essentially changing the name of your business, your identity on the internet. They could also charge you whatever fee they decided on to transfer the domain name to someone else, and there was no guarantee they were willing to do that.

Again, not nearly as big a problem as it once was, but still something to make sure you get ownership of.

Now you are thinking, that is a really long explanation for 2 paragraphs of needed information. :) What happens if you picked a web host that is the worst company on the face of the planet, or you have outgrown what the web host is capable of providing, or maybe even you decide to host your own website.

The first thing you need to do is plan. The basic process would be that you sign up with a new web host, put a copy of your site on the new web host, and make sure everything is working, sometimes there will be glitches. Once everything is working, then you have the registrar tell the top-level domain servers that the new authoritative servers are at the new web host. So from then on, whenever Scott wants to see your webpage, his DNS server is told by the top-level domain server that the authoritative server is at the new web host, and they in turn point to your new web page.

Now, I said to plan. There is a reason for that besides just making sure everything works. Remember when I said that "caching" would come up again? Now is that time. Remember that Scott's DNS server cached the address for the web server of:


www.onlyonecreations.com,


meaning that it remembers that www.onlyonecreations.com is has the IP address of 64.17.143.84. Most DNS servers are set to remember that information for 24 hours. So if Scott requests your web page at noon on Monday, Scott's DNS server will cache the IP address of your web server until noon on Tuesday. If you change hosts at 1pm on Monday, Scott will get your old website until at least noon on Tuesday. His DNS server is giving Scott's PC the information it remembers, it doesn't check to see if that is still accurate. So if your old website is down (maybe your shopping cart won't work now that you have moved hosts, for example), Scott can't get to your new website, until his DNS server refreshes the information (which will point to the new web site).

Plan on a timeframe of 24-48 hours from the time your registrar makes the change in the top-level domain server, before that change is spread through the Internet. So what does this mean for your planning? If your site is generally used by businesses, your site won't be very busy over the weekend. Therefore, plan on making the change on a Friday evening, by the time Monday rolls around, all the DNS server caches have been cleaned out (timed out actually), the DNS servers will have to ask the top-level domain servers, and your new website well be accessible.

One word of caution, before you make plans, find out when you need to tell the registrar when to make the change. It usually takes a period of time, that you need to plan for. There is little you can do about the 24-48 hour period.

As that time period elapses, more and more of the DNS servers around the world with have their cache time out, and get the new information pointing to your new site, hence fewer and fewer people will be unable to access your new site. It generally is pretty manageable, if you plan accordingly.

So we know what DNS is, what it does for us, and a basic idea of how it works. We know what a registrar does, and why we need them, and what an authoritative server does for us. We know why some people may not be able to access our new site 5 minutes after we changed hosts.

A customer just called and said my site is down. I call my web host, and they say it's up. I call the customer and they still can't get on. Now what? Time for some basic troubleshooting. I'm not going to go into great detail, but enough for you to confirm things have been done correctly, and figure out if the site is really down or if there is something making it look like it is down.

Two of the best sites I have found for troubleshooting are:

There are a TON of tools here to help you figure out what the problem is.

A few quick steps:

  1. Can you get to other web sites? Including ones you have not been to recently?

  2. Can your customer access other sites?

One of the first steps you should take in troubleshooting your site being down - type in the IP address of your web server in your browser. If you normally type in http://www.onlyonecreations.com/pages/wood-gift-pen.htm, type in http://64.17.143.84/pages/wood-gift-pen.htm. Does it work? When you use the domain name, does it still not work? If you can get to your site using the IP address, but not using the domain name, the problem is DNS, it is not your web server.

Let's use some tools at www.dnsstuff.com to confirm some things. The 3rd tool down on the left side is WHOIS lookup. Type in your domain name there (example, "onlyonecreations.com"). That brings up a page with 2 important pieces of information. One being who owns the domain name (this should be your name and address for your domain name). The other being the authoritative servers (called domain servers here)- remember Scott's DNS server asking for the authoritative server for onlyonecreations.com? These are the addresses that the top-level domain servers answer with.

The top tool on the right is called DNS Lookup. Type in www.onlyonecreations.com, make sure that A is selected, and click look up. There are some interesting and useful pieces of information here. When I entered my domain name, I got:

- Searching for A record for www.onlyonecreations.com at g.root-servers.net:

- Got referral to M.GTLD-SERVERS.NET. [took 197 ms]

- Searching for A record for www.onlyonecreations.com at M.GTLD-SERVERS.NET.:

- Got referral to ns1.ixwebhosting.com. [took 249 ms]

- Searching for A record for www.onlyonecreations.com at ns1.ixwebhosting.com.:

- Reports www.onlyonecreations.com. [took 100 ms]

Do you see "g.root-servers.net" and "M.GTLD-SERVERS.NET"? Those are top-level domain servers. On the 2nd line, it says "got referral to ns1.ixwebhosting.com". That should be the one of the domain servers you saw in the WHOIS lookup a minute ago. The DNS server is being told where to get the IP address of www.onlyonecreations.com (ie, ns1.ixwebhosting.com). The next block of information tells you the answer that the authoritative server gave to the question "what is the IP address of www.onlyonecreations.com?". It says that www.onlyonecreations.com has an IP address of onlyonecreations.com. What!? That's not an IP address. Remember way back at the beginning, I mentioned that you usually get the same page regardless of whether you type in www or not? Here's why! Now click, back and remove the "www." from the front of the domain name in the box, and click look up. Now we see that onlyonecreations.com points to 64.17.143.84. www.onlyonecreations.com points to onlyonecreations.com, which points to 64.17.143.84, so it doesn't matter if someone types the www or not (in this case).

So now you can walk through and ensure that the servers that are supposed to have to correct answers, do in fact have the right answers. But how do I tell if my (or my customer's) DNS server is giving me the right information? Click here : http://www.kloth.net/services/nslookup.php. There are 3 boxes to be concerned with. The first one (called simply Domain here) is the domain name (like www.onlyonecreations.com) of the machine you are having problems getting to. The next box (called Server here) is the DNS server you want to ask. The 3rd box (called Query) is the type of record you are looking up. For our purposes you want to look "A" (which is a regular type of name or record) or "MX" (which is an email record - ie "where do I send mail to at onlyonecreations.com?").


So to find what MCI's DNS Server (as an example) has for the IP address of onlyonecreations.com, enter "onlyonecreations.com" in the 1st box, 198.6.1.1 (MCI's DNS server) in the 2nd, and select "A" in the third box.

Last thing, sub-domains. A subdomain can be used, for example, if you have both wholesale and retail for your business. You could have the retail part of your business as www.yourdomain.com, and the wholesale as wholesale.yourdomain.com. Details are beyond the scope of this tutorial, but the same general rules apply to subdomains as it does to domains.

I hope this clears up confusion, and doesn't muddy the waters too much

No comments:

Post a Comment