Home » DNS Architecture: Recursive, Authoritative, DNSSEC, DoH, DoT, DNS Load Balancing และ DNS Security
DNS Architecture: Recursive, Authoritative, DNSSEC, DoH, DoT, DNS Load Balancing และ DNS Security
DNS Architecture: Recursive, Authoritative, DNSSEC, DoH, DoT, DNS Load Balancing และ DNS Security
DNS Architecture เป็นโครงสร้างพื้นฐานที่สำคัญที่สุดของ internet Recursive DNS รับ query จาก clients แล้วหาคำตอบให้, Authoritative DNS เก็บ records จริงของ domain, DNSSEC เพิ่มความปลอดภัยด้วย digital signatures, DoH (DNS over HTTPS) เข้ารหัส DNS queries ผ่าน HTTPS, DoT (DNS over TLS) เข้ารหัสผ่าน TLS, DNS Load Balancing กระจาย traffic ด้วย DNS และ DNS Security ป้องกันการโจมตีผ่าน DNS
DNS เป็น “สมุดโทรศัพท์ของ internet” ที่ทุก connection เริ่มต้นจาก DNS query: เปิดเว็บ, ส่งอีเมล, ใช้ API, ทุกอย่างต้อง resolve DNS ก่อน ถ้า DNS ล่ม = internet “หายไป” สำหรับผู้ใช้ (แม้ servers ยังทำงานอยู่) Dyn DNS attack ปี 2016: DDoS ที่ DNS provider → Twitter, Netflix, Reddit, GitHub ล่มทั้งหมด DNS เป็นทั้ง critical infrastructure และ attack vector — ต้องออกแบบให้ redundant และ secure
DNS Resolution Flow
| Step |
Action |
Server |
| 1. Client Query |
User types www.example.com → OS checks local cache → if not cached, query recursive resolver |
Client (stub resolver) |
| 2. Recursive Resolver |
Check cache → if not cached, start iterative resolution |
ISP DNS or public (8.8.8.8, 1.1.1.1) |
| 3. Root Server |
Resolver asks root → root responds with .com TLD server addresses |
Root servers (13 clusters, anycast) |
| 4. TLD Server |
Resolver asks .com TLD → responds with example.com authoritative NS |
TLD servers (Verisign for .com) |
| 5. Authoritative |
Resolver asks example.com NS → responds with A record (IP address) |
Domain’s authoritative DNS |
| 6. Response |
Resolver caches answer (per TTL) → returns IP to client → client connects |
Recursive → Client |
DNS Record Types
| Record |
Function |
Example |
| A |
Domain → IPv4 address |
www.example.com → 93.184.216.34 |
| AAAA |
Domain → IPv6 address |
www.example.com → 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME |
Domain → another domain (alias) |
blog.example.com → example.wordpress.com |
| MX |
Mail exchange servers (with priority) |
example.com MX 10 mail.example.com |
| NS |
Name servers for domain |
example.com NS ns1.provider.com |
| TXT |
Text data (SPF, DKIM, DMARC, verification) |
example.com TXT “v=spf1 include:_spf.google.com ~all” |
| SRV |
Service location (port, priority, weight) |
_sip._tcp.example.com SRV 10 60 5060 sip.example.com |
| CAA |
Certificate Authority Authorization |
example.com CAA 0 issue “letsencrypt.org” |
DNSSEC
| Feature |
Detail |
| Problem |
DNS responses are unsigned → attacker can forge/modify responses (DNS spoofing, cache poisoning) |
| Solution |
Digital signatures on DNS records → resolver can verify response is authentic and unmodified |
| RRSIG |
Signature record — signs each RRset (set of records of same type) |
| DNSKEY |
Public key used to verify RRSIG signatures |
| DS |
Delegation Signer — hash of child’s DNSKEY, stored in parent zone → chain of trust |
| Chain of Trust |
Root (trust anchor) → .com DS → example.com DS → verify RRSIG → authentic |
| Limitation |
DNSSEC provides authentication + integrity, NOT confidentiality (queries still visible) |
DoH vs DoT vs Traditional DNS
| Feature |
Traditional DNS |
DoT (DNS over TLS) |
DoH (DNS over HTTPS) |
| Port |
UDP/TCP 53 |
TCP 853 |
TCP 443 |
| Encryption |
None (plaintext) |
TLS encryption |
HTTPS encryption |
| Visibility |
ISP/admin can see all queries |
Encrypted but identifiable (port 853) |
Blends with HTTPS traffic (port 443) — hard to detect/block |
| Privacy |
None |
Good — encrypted |
Best — encrypted + hidden in HTTPS traffic |
| Enterprise Control |
Easy to monitor/filter |
Can block port 853 |
Hard to control — same port as all HTTPS |
| Adoption |
Default everywhere |
Android, some resolvers |
Firefox, Chrome, Windows 11, major public resolvers |
DNS Security Threats & Mitigation
| Threat |
Description |
Mitigation |
| DNS Spoofing/Cache Poisoning |
Forge DNS response → redirect to malicious IP |
DNSSEC, source port randomization, 0x20 encoding |
| DNS Tunneling |
Encode data in DNS queries → exfiltrate data through DNS |
DNS monitoring, detect long/unusual queries, DNS firewall |
| DNS DDoS |
Flood DNS servers with queries → service unavailable |
Anycast DNS, rate limiting, DNS scrubbing, overcapacity |
| Domain Hijacking |
Compromise registrar account → change NS records |
Registrar lock, 2FA, DNSSEC, monitor NS changes |
| Typosquatting |
Register similar domains (gooogle.com) → phishing |
Register common typos, brand monitoring, DMARC for email |
| DNS Rebinding |
Attacker DNS returns internal IP → bypass same-origin policy |
DNS pinning in browsers, validate DNS responses, split-horizon DNS |
ทิ้งท้าย: DNS = Critical Infrastructure That Deserves Serious Attention
DNS Architecture Flow: client → recursive resolver → root → TLD → authoritative → cached response (per TTL) Records: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (nameserver), TXT (SPF/DKIM), SRV, CAA DNSSEC: digital signatures (RRSIG + DNSKEY + DS) → chain of trust from root → authenticate + integrity (not privacy) DoH/DoT: encrypt DNS queries — DoT (port 853, identifiable), DoH (port 443, hidden in HTTPS) — privacy vs enterprise control Security: spoofing (DNSSEC), tunneling (DNS monitoring), DDoS (anycast), hijacking (registrar lock + 2FA) Key: every internet connection starts with DNS — secure it (DNSSEC), encrypt it (DoH/DoT), make it redundant (anycast)
อ่านเพิ่มเติมเกี่ยวกับ DDoS Protection Mitigation Scrubbing Center CDN และ SSL/TLS Deep Dive Certificate PKI Cipher Suite TLS 1.3 ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
