How DNS Resolver Works?
Every Operating System (Windows, Linux, Mac, Android etc.) is equipped with a utility called DNS Client which takes care of resolving Domain Names to respective IP addresses. Did you ever wonder how this DNS Client works? I mean how it resolves domain names to IP addresses within milli/micro seconds searching thoughout the globally distributed DNS database. So here I am with a simple explanation of how this DNS Client works using Windows external command utility called nslookup. I want to resolve various DNS resource records for the domain gopalthorve.com.
- Open Command Prompt by typing cmd in Run window.
- DNS resolutions works from right to left. Here my left most domain extension is biz. So type nslookup -norecurse biz command and Press Enter. This command returns the list of name servers with their FQDN and IP Addresses serving the biz TLD as show in Command output pasted below.
D:\>nslookup -norecurse biz Server: dir-600 Address: 192.168.0.1 Name: biz. Served by: - e.gtld.biz 156.154.126.65 biz - a.gtld.biz 156.154.124.65 2001:503:7bbb:ffff:ffff:ffff:ffff:ff7e biz - c.gtld.biz 156.154.127.65 biz - b.gtld.biz 156.154.125.65 biz - k.gtld.biz 156.154.128.65 2001:503:e239::3:2 biz - f.gtld.biz 209.173.58.66 2001:500:3682::12 biz
- Resolver takes any one name server from the list returned by previous command lets assume it’s e.gtld.biz. Enter this command nslookup -norecurse gopalthorve.com e.gtld.biz. This command returns list of name servers for domain gopalthorve.com. Now, we can query any (preferably top in result) name server for resource record of gopalthorve.com.
D:\>nslookup -norecurse gopalthorve.com e.gtld.biz Server: UnKnown Address: 156.154.126.65 Name: gopalthorve.com Served by: - NS3697.HOSTGATOR.COM gopalthorve.com - NS3698.HOSTGATOR.COM gopalthorve.com
We got the name servers (ns3697.hostgator.com and ns3698.hostgator.com) serving gopalthorve.com, we can query these name servers to resolve various kind of resource records.
Resolving “A” record nslookup
Type nslookup www.gopalthorve.com ns3697.hostgator.com in Command Prompt, which return IP address 50.116.98.15.
D:\>nslookup gopalthorve.com ns3697.hostgator.com Server: UnKnown Address: 184.173.250.156 Name: gopalthorve.com Address: 50.116.98.15
Resolving “A” record using nslookup
Type nslookup www.gopalthorve.com ns3697.hostgator.com in Command Prompt.
D:\>nslookup www.gopalthorve.com ns3697.hostgator.com Server: UnKnown Address: 184.173.250.156 Name: gopalthorve.com Address: 50.116.98.15 Aliases: www.gopalthorve.com
The last line of above command output Aliases: www.gopalthorve.com, indicates that www.gopalthorve.com is CNAME (canonical) record pointing to gopalthorve.com which ultimately points to IP address 50.116.98.15.
Resolving MX record using nslookup
Type nslookup -querytype=mx gopalthorve.com ns3697.hostgator.com in Command Prompt.
D:\>nslookup -querytype=mx gopalthorve.com ns3697.hostgator.com Server: UnKnown Address: 184.173.250.156 gopalthorve.com MX preference = 0, mail exchanger = gopalthorve.com gopalthorve.com nameserver = ns3698.hostgator.com gopalthorve.com nameserver = ns3697.hostgator.com gopalthorve.com internet address = 50.116.98.15 ns3697.hostgator.com internet address = 184.173.250.156 ns3698.hostgator.com internet address = 50.116.98.12
As per above result MX record for domain gopalthorve.com points to gopalthorve.com.
Resolving TXT record using nslookup
Type nslookup -querytype=txt gopalthorve.com ns3697.hostgator.com in Command Prompt. This command returns all TXT records for gopalthorve.com.
D:\>nslookup -querytype=txt gopalthorve.com ns3697.hostgator.com Server: UnKnown Address: 184.173.250.156
gopalthorve.com text =
"v=spf1 ip4:184.173.239.119 a mx include:websitewelcome.com ~all" gopalthorve.com nameserver = ns3697.hostgator.com gopalthorve.com nameserver = ns3698.hostgator.com ns3697.hostgator.com internet address = 184.173.250.156 ns3698.hostgator.com internet address = 50.116.98.12
The TXT record returned by above command is actually an SPF record for gopalthorve.com.
In this article we used nslookup in non-interactive mode. In interactive mode it displays nslookup shell from where we can execute various commands.