Concepts

DNS cache is temporary storage that stores DNS records of domain names. It is usually found on user devices, routers, and the servers of Internet Service Providers (ISPs). DNS cache improves network performance and efficiency.

When a user device accesses a domain name, the device first checks the local DNS cache. If the DNS record is found in the local DNS cache, the device uses it directly. If the information is not found there, the device then queries its DNS server provided by the ISP or other DNS servers and stores the queried data in the cache for future use.

Helpful Links

• When Will a New Record Set Be Applied?
• When Will the Modification or Deletion of a Record Set Be Applied?

Time to live (TTL) specifies how long a local DNS server can cache record sets. A proper TTL value helps balance DNS server load and resolution speed, while also affecting how quickly DNS changes are applied.

When receiving requests for a domain name, the local DNS server asks the authoritative DNS server for the required DNS record, and then caches the record for a period of time. During this period, if the local DNS server receives requests for this domain name again, it will not request the record from the authoritative DNS server, but directly returns the cached record.

The time records are cached on the local DNS server is specified by the TTL value. You can set it when adding record sets in public or private zones. For details, see Managing Record Sets.

The effective time of the following operations depends on the TTL value (to accelerate the process, decrease the TTL value):

• When Will a New Record Set Be Applied?
• When Will the Modification or Deletion of a Record Set Be Applied?
• When Will New DNS Server Addresses Be Applied?

Recursive query and recursive resolution are fundamental concepts in DNS resolution. A recursive query is initiated by a client to a DNS resolver, and that resolver is responsible for performing the recursive resolution and ultimately returning the DNS results to the client.

• Recursive query: a type of DNS queries sent from a client (such as a user's computer) to a DNS resolver. A client sends requests to a DNS resolver, and the resolver takes full responsibility for the entire resolution process until it finds the final answer and returns it to the client. In a recursive query, the client only sends the request to the first DNS server.
• Recursive resolution: a method used by a DNS resolver to process recursive queries. When receiving a recursive query, the DNS resolver will work down the hierarchy, starting from the root servers, then to top-level domain servers, and finally to the authoritative servers for the query result. Finally, the DNS resolver will return the query result to the client. Users do not need to handle complex query processes.

Helpful Links

Configuring Recursive Resolution for Subdomains

Domain Name System Security Extensions (DNSSEC) provides digital signatures and public key cryptography to ensure the integrity and authenticity of DNS response packets and to defend against common attacks such as DNS spoofing and cache pollution. This prevents you from being redirected to unexpected addresses and protects your core services.

Working principles and main functions

• Digital signatures for data integrity: Digital signatures are added to DNS records so that data integrity can be verified. This ensures that DNS records are not tampered with.
• Public key cryptography for trusted data sources: Public keys are used to verify signatures for establishing trust in data sources.
• A full chain of trust to prevent DNS spoofing and cache pollution: A full chain of trust is formed from the root DNS servers to the top-level domain servers and then to the authoritative DNS servers. This prevents attackers from inserting false records into the DNS cache.

Helpful Links

Configuring DNSSEC

DomainKeys Identified Mail (DKIM) is a technical standard used to verify the authenticity and integrity of email sources. It uses digital signatures to prevent email spoofing and tampering.

Key principles and working process

1. Key generation and distribution
   1. DKIM uses a private/public key pair.
   2. The private key is kept on the sender's email server and is used to sign emails.
   3. The public key is added to the DNS records for the sending domain and is usually used as a TXT record for the receiver to query.
2. Email signature process
   1. The sending email server uses the private key to generate a digital signature for the specific part of the email (such as the header and body).
   2. DKIM signatures are embedded within the DKIM-Signature header field, including a cryptographic hash of the email content, the algorithm used for signing (like RSA-SHA256), and the sending domain.
3. Verification by the recipient
   1. The receiving server parses the DKIM-Signature header field of the email to extract the signature information.
   2. The receiving server looks up the DNS records for the sending domain and retrieves the public key for the sending domain.
   3. The public key decrypts the encrypted hash sent. The receiving server computes its own hash and compares it with the one received in the message.
   4. If the two match, the message is let through, meaning that the mail has not been tampered with and its source is authentic. Otherwise, the email may be flagged as spam or rejected.

Example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;  
s=mail; h=From:Subject:Date:Message-ID:To:MIME-Version:Content-Type;  
bh=abc123==; b=def456==; 

Sender Policy Framework (SPF) is a technique designed to authenticate email senders to prevent email spam and phishing attacks. It enables the receiving mail server to check whether an incoming email comes from a domain authorized by that domain's administrators, thereby verifying the legitimacy of the email.

Key principles and working process

1. IP address authorization

   The domain owner configures a TXT or SPF record in DNS that lists all authorized sending IP addresses or servers.

2. Verification process
   1. When the email server receives an email, it checks the Return-Path (sender address) of the email.
   2. The email server queries the SPF record of the sender's domain name through DNS.
   3. This SPF record is used to check whether the IP address from which an email is sent is authorized.
   4. When the verification succeeds, the mail is legitimate. When the verification fails, the mail can be marked as spam or rejected.

Example:

The following is an example of an SPF TXT record.

v=spf1 include:spf.example.com -all

• v=spf1: Indicates that it is an SPF record and the version is 1.
• include:spf.example.com: Indicates that the SPF record contains the spf.example.com domain.
• -all: Specifies that any IP address not explicitly authorized in the record should be treated as a hard fail, meaning emails from them should be rejected. (~ indicates a soft fail qualifier while - indicates a hard fail qualifier.)

  If ~all is specified here, it indicates a soft failure qualifier. Emails from any IP address not explicitly authorized in the record will be marked as potentially suspicious but will not be rejected.

A wildcard record set with its name set to an asterisk (*) can map all subdomains of a domain name to the same IP address or other destination.

For example, a wildcard DNS record like *.example.com acts as a catch-all for subdomains. www.example.com, abc.example.com, and test.example.com can all be mapped to the same IP address or destination that *.example.com will be mapped to.

Scenarios:

• Static resource hosting

  All subdomains can be mapped to the same CDN or static resource server. This improves resource loading speed and management efficiency.

• Test and development environments

  You can quickly create and test multiple subdomains without frequently adjusting DNS settings. This facilitates development.

• User-generated content platforms

  Users can create personal subdomain-based blogs or websites. All subdomains are automatically mapped to the same server. This ensures easier management.

• API service

  Multiple subdomains can be mapped to the same API service where API requests are centrally managed for more flexible services.

• Multilingual or multi-regional sites

  All subdomains are mapped to the same multilingual or multi-regional website where users can view content in different languages or regions. This optimizes user experience.

• Temporary or dynamic subdomain

  You can quickly create temporary subdomains for promotions or events without manual configuration, improving the response speed.

Helpful Links

Configuring a Wildcard DNS Record Set

A domain name is owned by the person or organization who registered it through a domain registrar Details about a domain name owner are as follows:

• Ownership and control: Domain name owners have the right to use domain names as they see fit, for example, directing them to specific servers and creating subdomains.
• Registration and maintenance: Domain name owners must register their domain names with a registrar and pay annual renewal fees to maintain ownership and prevent expiration.
• Information management: Domain name owners are generally required to provide personal information, including their name, address, and email address, during the registration process. This information is stored in a publicly accessible database called the WHOIS database. However, privacy protection services can be used to hide their personal details.
• Management permissions: Domain name owners can manage DNS settings, control website resolution, implement security measures like DKIM and SPF records, and transfer domain names to other registrars.
• Renewal and transfer: Domain name owners should renew their domain registrations before the expiration date. Domain names can be transferred through registrars or traded in the secondary market.

A DNS service provider manages the Domain Name System (DNS), which translates domain names into server IP addresses. A DNS service provider provides the following functions:

• Domain name resolution: translates domain names into IP addresses so that users can access target websites by entering a domain name.
• DNS record management: allows users to set and manage various DNS records, like A, CNAME, and MX records.
• High availability and stability: leverages multi-node distribution to ensure the DNS resolution stability and efficiency.
• Value-added services: provides functions such as load balancing, CDN integration, anti-DDoS, and intelligent resolution to improve website performance and security.