Network Operations · Topic 7 of 8
DNS and Time Services
Explain how DNS resolves names, common record types, zones and zone transfers, TTL, DNSSEC, DoH and DoT, and how NTP, PTP and NTS keep clocks in sync.
- 5 min
- Includes a diagram
- An A record maps to IPv4, AAAA to IPv6, CNAME is an alias, MX names the mail server, NS names the name server, PTR is the reverse lookup and TXT holds text.
- DNS uses UDP 53 for most queries and TCP 53 for large answers and zone transfers.
- A recursive resolver finds answers and caches them. An authoritative server owns the zone.
What it is
The Domain Name System (DNS) turns names such as www.example.com into Internet Protocol (IP) addresses, and back again. Without it, users would have to remember numbers for every service.
Accurate time is just as important. The Network Time Protocol (NTP) keeps device clocks in step, which logs, certificates and authentication depend on.
How it works
Name resolution
A client sends a query to its configured DNS server. A recursive resolver does the work of finding the answer, asking other servers in turn, and caches the result so the next request is fast.
An authoritative server holds the official records for a zone and gives answers from its own data. A zone is the portion of the DNS namespace that one server or group of servers manages.
DNS normally uses User Datagram Protocol (UDP) port 53 and switches to Transmission Control Protocol (TCP) port 53 for large answers and zone transfers.
An answer that comes from a resolver's cache is called non-authoritative. A hosts file is a local text file that maps names to addresses and is checked before DNS on many systems.
Common record types
| Record | Full name | Purpose |
|---|---|---|
| A | Address | Maps a name to an Internet Protocol version 4 (IPv4) address |
| AAAA | Quad A | Maps a name to an Internet Protocol version 6 (IPv6) address |
| CNAME | Canonical name | An alias that points to another name |
| MX | Mail exchange | Names the mail server for a domain |
| NS | Name server | Names the authoritative server for a zone |
| PTR | Pointer | Maps an IP address back to a name (reverse lookup) |
| TXT | Text | Free text, used for email sender checks such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) |
A CNAME must point to a name, not an address. An MX record points to a name that must have an A or AAAA record.
Zones and zone transfers
A forward lookup zone resolves names to addresses. A reverse lookup zone resolves addresses to names using PTR records.
A primary server holds the writable copy of a zone. A secondary server holds a read only copy, which it receives from the primary by a zone transfer. Restrict zone transfers to known servers, because the data reveals the network layout.
An internal DNS zone serves private names inside the organization, while an external zone serves public records to the internet.
Time to live
Each record has a time to live (TTL), which tells caches how long they may keep the answer. A long TTL reduces traffic but delays changes, so lower the TTL before planned changes to a record.
DNS security and privacy
| Feature | Purpose |
|---|---|
| DNS Security Extensions (DNSSEC) | Digitally signs records so a resolver can verify they are authentic and unaltered |
| DNS over HTTPS (DoH) | Sends queries inside encrypted Hypertext Transfer Protocol Secure (HTTPS), normally on port 443 |
| DNS over TLS (DoT) | Sends queries inside a Transport Layer Security session, normally on port 853 |
DNSSEC protects the integrity of answers but does not encrypt them. DoH and DoT encrypt the queries so that others on the path cannot read them.
Time services
NTP uses UDP port 123, and time flows in layers called strata. Stratum 0 is a reference clock such as a Global Positioning System (GPS) receiver or atomic clock, and a stratum 1 server is directly connected to it. Each further hop increases the stratum number.
The Precision Time Protocol (PTP) gives much more precise synchronization than NTP and suits systems with strict timing needs. Network Time Security (NTS) adds authentication to NTP so that a time source cannot easily be spoofed.
Wrong time breaks log correlation, certificate checks and some authentication methods such as Kerberos.
What to remember for the exam
- An A record maps to IPv4, AAAA to IPv6, CNAME is an alias, MX names the mail server, NS names the name server, PTR is the reverse lookup and TXT holds text.
- DNS uses UDP 53 for most queries and TCP 53 for large answers and zone transfers.
- A recursive resolver finds answers and caches them. An authoritative server owns the zone.
- A secondary server gets a read only copy by zone transfer from the primary.
- TTL controls how long answers are cached.
- DNSSEC signs records for integrity. DoH (port 443) and DoT (port 853) encrypt queries.
- NTP uses UDP 123 and stratum levels. PTP is more precise. NTS secures NTP.
- Incorrect time affects logs, certificates and authentication.
If a web page loads by IP address but not by name, the fault is DNS. If a recent record change is not visible, think of cached answers and the TTL.
Common mistakes
Pointing a CNAME at an IP address. A CNAME points to another name.
Mixing up the record types. A is IPv4, AAAA is IPv6, and PTR is the reverse of A.
Believing DNSSEC encrypts traffic. It proves authenticity but does not hide the query content.
Allowing zone transfers to anyone. This gives attackers a list of hosts.
Forgetting stale caches. A long TTL means old answers persist after a record is changed.
Do not treat DoH as a security fix by itself. It hides queries from observers on the path, but it can also bypass local DNS filtering if it is not managed.
Check yourself
Try these three.
Which DNS record type maps a name to an IPv6 address?
An AAAA record.
Which two ports do DoH and DoT use by default?
DoH uses port 443 and DoT uses port 853.
What does stratum mean in NTP?
It is the distance from the reference clock, where stratum 0 is the clock itself and each hop adds one.
Topic 7 of 8 in Network Operations
Test yourself on Network Operations
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.