People remember names; computers work with IP addresses. The Domain Name System connects the two and is therefore often called the phone book of the internet. Without working DNS, employees cannot reach websites, emails are not delivered, cloud services are unreachable, and in Windows networks with Active Directory, devices cannot find their domain controllers. Faulty DNS records therefore quickly lead to disruptions that, at first glance, seem to have nothing to do with DNS.
How does DNS work?
DNS is structured hierarchically. At the top are the root servers, below them the top-level domains such as .at or .com, and below those the individual domains and their subdomains.
When a device asks for a name, it contacts a recursive resolver, for example in the router, at the provider, or on a company server. If the resolver does not know the answer, it works its way from the root servers via the top-level domain to the domain's authoritative name server. The answer is cached for a defined time, the TTL.
Important record types are:
- A and AAAA: name to IPv4 or IPv6 address
- CNAME: reference to another name
- MX: responsible mail server of a domain
- TXT: free text, for example for SPF, DMARC, or domain verifications
- NS: responsible name servers
The DNSSEC extension signs answers against forgery. DNS over HTTPS and DNS over TLS encrypt queries on their way to the resolver.
Typical examples
- When switching to Exchange Online, MX, SPF, and DKIM records are adjusted.
- Before a website move, the TTL is lowered so that the new address takes effect quickly.
- A cloud service requires a TXT record as proof that the domain belongs to the company.
What companies should keep in mind
- Secure domains: Register domains in the company's name, protect registrar access with multi-factor authentication, and do not miss renewals.
- Maintain email records: SPF, DKIM, and DMARC make spoofed senders, and thus phishing in the company's name, more difficult.
- Delete orphaned records: Records that point to cloud resources no longer in use can be abused to take over subdomains.
- Document: Record all zones, records, and responsibilities in the IT documentation.
- Use as a protective layer: A DNS filter blocks known malicious domains as early as name resolution.