Ravindra BagaleCourses & study guides

2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS

2.6 DNS Basics – Port 53

By Last updated:

Aapan google.com type karto, IP nahi. Naavacha IP shodhne he DNS che kaam. DNS la internet chi phonebook mhantat.

  1. The browser checks its own cache, then the OS cache and the hosts file.
  2. If not found, it asks the recursive resolver (your ISP, a public resolver like 8.8.8.8 / 1.1.1.1, or on EC2 the VPC resolver).
  3. The resolver asks a root server → "ask the .com servers".
  4. The .com TLD server → "the name servers for example.com are ns51.domaincontrol.com...". These NS entries come from what you set at the registrar.
  5. The authoritative name server replies with the record, e.g. A 203.0.113.10, along with a TTL.
  6. The resolver caches the answer for TTL seconds and gives it to the browser, which then connects to the IP and sends Host: example.com.

DNS normally uses UDP port 53 (TCP 53 for large answers and zone transfers). See also Chapter 3 on opening a website step by step. | Record | Purpose | Example | |---|---|---| | A | Name → IPv4 | example.com → 203.0.113.10 | | AAAA | Name → IPv6 | example.com → 2001:db8::10 | | CNAME | Alias → another name | www → example.com | | MX | Mail servers | 10 mail.example.com | | TXT | Text – SPF, DKIM, verification | "v=spf1 -all" | | NS | Authoritative name servers | ns1.example.net |

dig example.com +short
dig MX example.com +short
nslookup example.com

Why this matters for security

DNS is used in reconnaissance (finding subdomains), abused in attacks (DNS spoofing/cache poisoning, DNS tunnelling for data exfiltration) and critical for email security (SPF, DKIM, DMARC records fight phishing). A forgotten CNAME pointing to a deleted cloud resource can allow subdomain takeover.

Ravindra Bagale's Tip

After changing DNS, many students panic because the website doesn't show up immediately, and they change the record again and again. Don't do that! Because of the TTL, the old answer stays in the cache. Check with dig @8.8.8.8 yourdomain.com +short and wait a while.

Practice task

Run dig example.com, dig NS example.com +short and dig +trace example.com. Identify the TTL value and the authoritative name servers.

Thodkyaat sangaycha tar

  • Port identifies the service; well-known ports 0–1023. Know 21, 22, 23, 25, 53, 80, 443, 3306, 3389.
  • SSH (22): encrypted, key-based login; protect the private key; restrict port 22 to your IP.
  • HTTP (80): methods, headers, status codes; clear text. HTTPS (443) = HTTP + TLS (confidentiality, integrity, server identity).
  • FTP sends passwords in clear text – use SFTP/SCP over SSH.
  • DNS (53) turns names into IPs; records A, AAAA, CNAME, MX, TXT, NS; important for recon and email security.

Samjla ka? Ekda `ss -tlnp` chalvun bagha – konte doors ughde aahet? Aata pudhe jaauya: OSI aani TCP/IP models.