DNS & DHCP — Network Services
Understand how DNS resolves domain names, how DHCP assigns IPs automatically, and troubleshoot both.
Learning Objectives
- → Explain the DNS resolution process step by step
- → Identify DNS record types: A, AAAA, MX, CNAME, TXT, PTR
- → Describe the DHCP DORA process
- → Troubleshoot DNS and DHCP from the command line
DNS — Domain Name System
DNS is the internet's phone book — it translates human-readable names like example.com into IP addresses like 93.184.216.34.
DNS Resolution Flow
Browser → asks: "What is the IP of google.com?"
↓
1. Check local cache (browser, OS)
2. Ask Recursive Resolver (your ISP or 8.8.8.8)
3. Resolver asks Root Nameserver → "Try .com TLD servers"
4. Resolver asks .com TLD server → "Try google's nameservers"
5. Resolver asks google's nameserver → returns IP
6. Resolver caches + returns IP to browser
DNS Record Types
| Type | Purpose | Example |
|---|---|---|
| A | Domain → IPv4 | google.com → 142.250.80.46 |
| AAAA | Domain → IPv6 | google.com → 2607:f8b0::4004 |
| CNAME | Alias → another name | www.example.com → example.com |
| MX | Mail server | example.com → mail.example.com |
| TXT | Arbitrary text | SPF, DKIM, domain verification |
| PTR | IP → Domain (reverse) | 46.80.250.142.in-addr.arpa |
| NS | Nameserver for domain | example.com → ns1.cloudflare.com |
| SOA | Zone authority info | Serial, refresh, retry, expire |
DNS Tools
# Basic lookup
nslookup google.com
dig google.com
# Specific record type
dig google.com MX
dig google.com TXT
dig -x 8.8.8.8 # reverse lookup (PTR)
# Query a specific server
dig @8.8.8.8 google.com
# Full trace
dig +trace google.com
DHCP — Dynamic Host Configuration Protocol
DHCP automatically assigns IP addresses to devices — no manual configuration needed.
DORA Process
Client DHCP Server
│──DISCOVER──────────▶│ "Anyone have an IP for me?"
│◀─────────OFFER──────│ "I offer 192.168.1.50 / lease 24h"
│──REQUEST───────────▶│ "I'll take 192.168.1.50 please"
│◀─────────ACK────────│ "Confirmed! It's yours for 24h"
Discover → Offer → Request → Acknowledge
DHCP Lease Components
A DHCP server gives clients:
- IP Address (e.g. 192.168.1.50)
- Subnet Mask (e.g. 255.255.255.0)
- Default Gateway (e.g. 192.168.1.1)
- DNS Servers (e.g. 8.8.8.8, 8.8.4.4)
- Lease Duration (how long the IP is valid)
Troubleshooting Commands
# See your current DHCP-assigned config
ip addr show
ip route show
cat /etc/resolv.conf # DNS servers
# Release and renew (Linux)
sudo dhclient -r eth0 # release
sudo dhclient eth0 # request new
# Windows equivalent
ipconfig /release
ipconfig /renew
ipconfig /flushdns # clear DNS cache
# Test DNS resolution
nslookup google.com 8.8.8.8
dig @1.1.1.1 google.com +short
Common Issues & Fixes
| Symptom | Likely Cause | Fix |
|---|---|---|
| Can ping IP but not hostname | DNS issue | Check /etc/resolv.conf, try dig |
| 169.254.x.x address | DHCP failed (APIPA) | Check cable/WiFi, restart dhclient |
| Can ping gateway, not internet | DNS or routing | Try ping 8.8.8.8 to isolate |
| Slow page loads | Slow DNS resolver | Switch to 1.1.1.1 or 8.8.8.8 |
DNS (Domain Name System) translates human-readable names like google.com into IP addresses like 142.250.80.46.
Browser first checks its own cache, then the OS cache.
Your ISP or configured DNS server (8.8.8.8) gets the query.
Resolver asks root: "Where is .com?" Root responds with .com TLD server.
Resolver asks TLD: "Where is google.com?" TLD points to Google's nameservers.
Returns the A record: google.com → 142.250.80.46
What DNS record type maps a domain to an IPv4 address?
Which DNS server is queried first after local cache misses?
DNS stores different types of records. Each serves a specific purpose in the naming system.
| Record | Purpose | Example |
|---|---|---|
| A | Domain → IPv4 address | google.com → 142.250.80.46 |
| AAAA | Domain → IPv6 address | google.com → 2607:f8b0::4004 |
| CNAME | Alias → another domain name | www.example.com → example.com |
| MX | Mail server for domain | gmail.com → smtp.google.com |
| TXT | Arbitrary text (SPF, DKIM…) | v=spf1 include:_spf.google.com |
| PTR | IP → Domain (reverse lookup) | 8.8.8.8 → dns.google |
| NS | Nameserver for domain | cloudflare.com → ns1.cloudflare.com |
A CNAME record creates:
Which record type would you look up to find a domain's mail servers?
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices — no manual configuration needed. The process is called DORA.
Client broadcasts: "Is there a DHCP server? I need an IP!"
Server responds: "I can offer you 192.168.1.50 for 24 hours."
Client: "I'll take 192.168.1.50 please!" (broadcast so other servers know)
Server: "Confirmed — 192.168.1.50 is yours for 24h."
What does DORA stand for in DHCP?
A device gets IP 169.254.5.10 automatically. This means:
💪 Exercises & Challenges
DNS Investigation Lab
## Task: Investigate DNS Records Use `dig` to investigate the DNS setup of a real domain. ### Steps **1. Find A record:** ```bash dig example.com A +short ``` **2. Find nameservers:** ```bash dig
DNS Record Hunt
The domain `tryhackme.com` has a TXT record used for domain verification. Use `dig tryhackme.com TXT` to find it. The flag is hidden in a TXT record of `cybersec-challenge.example` — for this lab, l