DNS in operation

Why this matters

DNS is the service whose failure produces the widest variety of wrong diagnoses. "The internet is down" is usually DNS. "The application is broken" is often DNS. It sits in front of nearly every user action, so when it degrades, everything appears to degrade.

For the exam you need the record types cold — they are named explicitly in the objective — and you need the diagnostic instinct that separates a name problem from a connectivity problem. That instinct is one test: if it works by IP address and fails by name, it is DNS.

The lesson

Name resolution, step by step

Name resolution turns a name a human can remember into an address a packet can be sent to. The client works through a sequence and stops at the first answer:

1. Its own cache. Recently resolved names are held for the record's TTL.
2. The hosts file. A local text file of static mappings, checked before any server is asked.
3. The configured DNS resolver, learned from DHCP option 6.
4. The resolver's own cache, and failing that, a recursive lookup out to the internet.

That ordering explains several exam scenarios. A stale cache entry means one host keeps reaching an old address after a change — ipconfig /flushdns clears it. An entry in the hosts file overrides DNS entirely and is invisible unless you look, which makes it both a useful testing tool and a classic malware persistence trick.

The record types

The ones N10-009 names, with what each is for.

A — Address. Maps a hostname to an IPv4 address. The most common record by far.

AAAA — "quad A". Maps a hostname to an IPv6 address. The name is a mnemonic: an IPv6 address is four times the size of an IPv4 address, so four As. A dual-stack client will normally prefer the AAAA record when one exists, which matters — a broken IPv6 path can make a site slow or unreachable for dual-stack clients while IPv4-only clients are unaffected.

CNAME — Canonical Name. An alias pointing one name at another name. www.example.com as a CNAME to example.com means one place to change the address. A CNAME must point at a name, never at an IP address, and by the standard a CNAME cannot coexist with other records for the same name — which is why you cannot CNAME a domain's apex.

MX — Mail Exchange. Names the mail servers for a domain, each with a priority value. Lower priority wins, and equal values load-balance. An MX record must point at a hostname with an A or AAAA record, not at an IP address directly.

TXT — Text. Arbitrary text attached to a domain. Originally for human notes, now the mechanism behind most domain verification and email authentication: SPF, which lists the servers permitted to send mail for the domain; DKIM, which publishes the public key used to sign outgoing mail; and DMARC, which tells receivers what to do when SPF or DKIM fails.

If a question describes mail being rejected or marked as spam and asks where the fix goes, the answer is a TXT record.

NS — Nameserver. Names the authoritative servers for a zone. This is what makes delegation work: the parent zone's NS records point at the servers that hold the child zone, and that chain from the root downward is how any resolver finds any domain.

SLAAC: addressing without a server

IPv6 can assign addresses with no DHCP server at all, using SLAAC (Stateless Address Autoconfiguration).

The mechanism is short. A router periodically sends Router Advertisement messages describing the prefix in use on the link. A host hears one, takes the prefix, generates its own interface identifier for the remaining 64 bits, and combines them into a full address. It then runs Duplicate Address Detection to confirm nobody else has it.

"Stateless" is the key word and the reason for the name: no server keeps a record of which host has which address. Nothing tracks leases, because there are none.

That is also the limitation. With no state, there is nowhere to record what was assigned, which complicates auditing, and basic SLAAC provides the address and gateway but not necessarily DNS servers. The options are DHCPv6 for full stateful assignment, or stateless DHCPv6 alongside SLAAC — the host gets its address from SLAAC and its DNS settings from DHCPv6.

The interface identifier is often derived from the MAC address using EUI-64, which creates a privacy problem: the address follows the device between networks and identifies it. Privacy extensions generate random identifiers that rotate, and are the default on modern operating systems.

Time protocols: NTP

NTP (Network Time Protocol) synchronises clocks across a network, on UDP port 123.

Accurate time is not a nicety. It underpins:

• Log correlation. Comparing events across devices is impossible if their clocks disagree — and investigating an incident is exactly when you need to.
• Authentication. Kerberos rejects tickets outside a tolerance, commonly five minutes, so a drifted clock produces logins that simply fail.
• Certificates. Validity is checked against the local clock, so a wrong clock produces "certificate not yet valid" or "expired" errors on a perfectly good certificate.
• Scheduled tasks and rate limits, which drift with the clock.

NTP is organised in strata. Stratum 0 is a reference clock — an atomic clock or GPS receiver. Stratum 1 servers are directly attached to one. Stratum 2 synchronises from stratum 1, and so on. Each level adds a little inaccuracy, and the number is a distance from the true source rather than a quality rating.

The design pattern is to have a small number of internal servers synchronise with reliable external sources, and everything else synchronise with those internal servers. That gives consistent time internally even if the external link fails — and consistency matters more than absolute accuracy for most of the uses above.

The classic exam symptom: users cannot authenticate, and the affected machine's clock is wrong. Check time before anything else.