Domain Name System (DNS)

The Domain Name System is the distributed directory that turns names people can remember into the addresses machines route on. A resolver walks a hierarchy, from the root servers to the top-level domain to the domain’s own authoritative servers, and caches what it learns for a period the record itself specifies. It carries far more than addresses: MX records name a domain’s mail servers, and TXT records carry the public policy statements that SPF, DKIM and DMARC are built on. That is why email authentication works between parties that have never communicated: DNS is a notice board any server in the world can read.

The security properties matter more than the packet format. Classic DNS provides no authentication of its answers, so a forged reply accepted into a cache redirects every client that trusts it, which is cache poisoning and a natural setting for a man-in-the-middle attack. DNSSEC addresses this by signing records so a resolver can verify origin and integrity, and it is worth being precise that DNSSEC authenticates, it does not encrypt. Because DNS is almost never blocked, it is also a favoured covert channel: DNS tunnelling smuggles data out inside query names, which is a case for egress monitoring.

Exam relevance: DNSSEC provides integrity and authenticity of DNS data and not confidentiality, and that distinction is a common trap. Availability questions tend to favour redundant, geographically separated authoritative servers. If a scenario describes steady outbound queries to an unfamiliar domain, consider tunnelling rather than ordinary name resolution.