DNS Glue records

In the third part of  DNS series here I will be covering Glue Records in DNS, During normal DNS resolutions, when a resolver attempts to resolve a domain name, it first queries the root, which provides the top-level domain. Next, it queries the top-level domain servers, which provide the domain’s authoritative nameserver's. Finally, it queries the authoritative nameserver's for the domain resolution. If the nameserver's for a domain being resolved exist inside the domain itself, then a helper is needed to resolve the domain.



What is a Glue Record ?

One may wonder what Glue records are, these are DNS records created at the domain’s registrar. This record provides a complete answer when the TLD nameserver returns a reference for an authoritative nameserver for a domain.  For example, the domain name “exampledomain.net” has nameserver's “ns1.exampledomain.net” "ns2.exampledomain.net”. To resolve the domain name, the DNS resolver would query in order i.e root, TLD nameserver, and authoritative nameserver. However, by having the authoritative nameserver's inside the domain itself, these nameserver's cannot be found without outside assistance. This creates a dependency loop and makes the domain name unresolvable because for resolving this domain we need a authoritative name server and to reach this authoritative server we need to resolve this domain creating a chicken and egg problem, the same is called a ‘circular reference’. 

 

With help of Glue record, an A record served by the TLD nameserver, avoids circular references and allows for both DNS name resolution and listing the nameserver's inside the domain itself.



Glue records can only be created at the domain registrar as the registrar controls the DNS settings for a given domain’s delegation. Every nameserver on the internet has its own glue record created by the domain’s owner.

When is a Glue Record needed?

We need to create a Glue record when we host our own authoritative servers. If we use a 3rd party, such as a managed DNS provider hosting our authoritative nameserver's, then the provider takes care of setting up the glue record.

When we host our own authoritative servers, we need to set up the glue records for the DNS servers with the domain registrar, the same is further updated to TLD's by the registrar.

Below is a Sample DNS Zone file for a domain configured using BIND, here we have a need for glue record to be set with domain registrar as the name servers are part of the domain itself leading to ‘circular reference’.



Checking the Glue record


We can check the glue records using  dig command in Linux this is done by querying the NS record for a domain using a TLD server, below image shows the response when we have a domain with our own authoritative server with glue record set with registrar, the response has authority section which provides the authoritative name server for the domain and also has additional section having IP address for the authoritative name serve, this additional information is used to break the cyclic reference.




suppose we don't own a authoritative name server for our domain and are using 3rd party DNS server as authoritative name server for our domain then the same response received will be only authority section only as seen as in image below providing the 3rd party nameserver's as authoritative for our domains.



 

Conclusion

Glue Records have a important role in name resolutions, and hope with this article I was able to explain the concept of Glue record, to know more about how to create a glue record for a authoritative server owned by your for a domain with a  registrar you can follow this link which explains how to get it done with godaddy.com.

Comments

Post a Comment

Popular posts from this blog

Reverse DNS Lookup

Image
In the Second Part of DNS series we would be looking into reverse Lookup,  Reverse DNS as the name suggests is the process of using the DNS  to translate IP addresses to hostnames. Reverse DNS is the opposite of forward lookup, which is used to translate human readable hostnames to IP addresses. In the case of reverse DNS, the query is similar to forward lookup it travels from the root DNS to the DNS servers of the Regional Internet Registry (RIR), which contains the authoritative information for the RIR-delegated IP block, for example for any query to ip from IP block 202.0.0.0/8  will travel from root to the respective RIR's DNS server then based on the subnet delegation and the authoritative DNS server registered with the RIR for the queried subnet ip it will forward the query to the respective authoritative DNS server. How this is done? For all the IP addresses  allocated by Internet Assigned Numbers Authority (IANA) to RIR, RIR also delegates corresponding rever...
Read more

MTU vs MSS

Image
MTU stands for Maximum transfer unit, it is the largest data size in bytes that can be transferred by the physical port, it is different for each physical medium that we use, it is per port basis and cannot be negotiated. Ethernet by default has the value of 1500 bytes, This means that a single frame passing the Ethernet medium can be of 1500 bytes of data, on top of this data payload (i.e data 1460 bytes + TCP header 20 bytes + IP header 20 bytes) further details like Ethernet headers of 14 bytes, Frame check sequence (FCS) 4 bytes gets added making it 1518 byes if this frame is carried over tagged connection then further 4 bytes for dot1Q gets added making the Frame 1522 bytes in size.   If for any reason the size of payload increases which results in increase of the Ethernet frame size then the device starts fragmenting the packets  i.e the source device will break the payload to fit the data into multiple Ethernet frames and the destination device will have to reassemble t...
Read more