How DNS Works - Computerphile 

unless the nameserver is set to recursive

Imagine dns over tor: i know a guy that knows a guy that knows a guy.... thar will tell you about the guy

DNS is no laughing matter! Why once, I met this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy, who knew this guy's cousin...!

Can we trust this guy? - I don’t know for sure, he works for NASA though...

DNS is no doubt 'SaulGoodMan

suggested solution: check wtf is up with your DNS ;)

@@ayefries I literally just (right before lunchtime, less than an hour ago) resolved an issue caused by 1.1.1.1 not giving out ANY results for Fortinet requests.

@rebmcr yeah I’ve had similar random issues with 1.1.1.1 and ended up moving back to Google’s 8.8.8.8. I wanted to try and at least reduce my use of Google services so they don’t have literally all of my information haha, but unfortunately they tend to have the best, most reliable option most of the time (e.g. Google search vs DuckDuckGo, Gmail vs like every other email service, etc).

@@einsteinx2 The easiest way is to just use your ISP's DNS, or even your ISP-provided router (if applicable) as a forwarder. If you want something super-fast for free, you go to Google's servers these days. Just be aware that they are now aware of _every_ site you access (you're asking _them_ where that server is. And selling information is what's their business, after all). There's quite a few free ("open source community" I'd say for some) non-tracking services around aswell, some even blacklisting known phishing sites etc; they work fine, but you'll have to add a millisecond here or there, so it's not _as_ snappy as 1.1.1.1

@@GutnarmEVE Great idea, all ISPs in my country are obligated by government to log all client traffic. Google may make money on it, ISPs may help make case for law enforcement.

☺ More like "The F*K If I Know!?"

Made my day

This is a wonderful comment

It's a blackbox and you don't really need to know.

Genius 😂

Yeah, that's what I thought too and I popped over to root-servers.org to verify. There are 13 "servers" belonging to 12 organizations (Verisign has two) which use anycast to serve from 1,309 sites as of today (2020-07-09).

@@CCRLH85 Odd, this is a copy and paste from their site, "As of 2020-07-10, the root server system consists of 1086 instances operated by the 12 independent root server operators." Still the 9th here in the US, but some parts of the world are already on the 10th.

Ah, is that why the limit.

Great clarification :) I think Steve is already planning a new video on this!

@@lawrencedoliveiro9104 Size of a UDP packet, which is the protocol that DNS runs on ( it runs on TCP too but UDP is tried first for various factors) has a limit of 512 bytes per packet. So there's a limit on the number of addresses you can fit in it. More than that and you can't fit the answer in 1 packet and have to switch to TCP to send the complete info.

Boomer

but anyway well played the card of transitory state of youth

haha Im sure youre loaded now buddy stay blessed

Too bad your name is Mark and not Nigel.

Lmau

RU-vid is definitely not fundamentally broken in many ways.......

Or how to make people forget that RU-vid exists. :) I hate this change

Am I the only one who confused substitution boxes with sub box? Maybe I've studied cryptography too much

Subscribe to me to get a sub (:

Was going to say something similar, and also the energy and humor he uses to convey the message is great.

You mean Sir Dr Michael Pound, CBE

you pound the like button

Yeah, I was first learning the DNS server farms out around and basic DNS servers are set up with text like data and they feed update each other until recent better security has been implemented because DNS can be hacked rerouted.

And the Address and Routing Parameter Area where PTR records live... ;)

@@klyanadkmorr yep, DNSSEC. Cryptographically signs replies so it can't be faked, unless you have managed to compromise the signing keys...usually very, very unlikely.

I love how ambiguous the record names are lol. It's impossible to infer anything from them aside from CNAME. I mean that's gotta be name for something. But... A?

@@-dash They are completely fine abbreviations. A is an address and AAAA is an address that is four times as big as the one with a single A. Mail exchangers can be abbreviated with -ME- MX, because eXchange begins with X. ;)

Yes. This.

Zazzy I’d rather watch YOUR video. You seem quite knowledgeable.

@@robertholtz Ha thanks, i studied computer science at UoN Mike and Julie are great lecturers for cyber security and comp sci things in general! Just wish UoN had more investment in cyber security and digital forensics modules while I was there.

THIS

There are ways to thwart secured DNS. If your records have a very short time to live, all queries will end up going to an authoritative nameserver. This request can be used to enable Web service temporarily, only to the IP address ultimately asking for its one. So only queries made in the clear will be answered.

You should get something better. This video is full of errors.

@@maflones what

My, my. I live at the Data Center!

I live in the ocean

Hahaha almost missed that, thank you for this comment

Why again is that? It's not in the public IP range or why?

@@Ultrajuiced 10.0.0.0/8 (i.e. 10.0.0.0 through 10.255.255.255) is one of three ranges reserved for private networks

Or maybe 172.16......wait no. Perhaps 192.168......ah s**t

@@stensoft Thank you. I've heard that before but didn't remember.

They are not competent...

Computerphile is a channel that explains professional concepts to laypeople, and the _lack_ of technical details is valuable.

It gives you the general idea so you have a fundamental understanding you can go research more yourself. Even as a software engineer this is probably all you need to know about DNS

@@p_serdiuk Hey, Can you suggest some channel cool like computerphile with moree techy knowledge ? Thankyou

@@maflones I remember being in University - and I still know some Professors. They don't live in the real world for sure but saying they're not competent is a bit harsh. They are really expert - just in things that your average company doesn't need. If they had to they could probably adapt to what real world IT demands of you. They wouldn't be happy with it though.

After 2 weeks nobody has answered this, nobody knows the answer , what a shame !

@@pkelly20091 Indeed. Maybe the powers that be with the answers have simply not noticed the question. LOL

any source you can suggest dealing with topics you mention?

miniro it is actually pi * 1,000,000

The early Internet didn't have a DNS system but required you to keep track of the IPs yourself. A legacy of that is the /etc/hosts file in *nix systems and the inherited (and very badly placed - I have no idea what DNS and Drivers have in common) C:\Windows\System32\Drivers\etc\hosts file in the Microsoft world.

that's because each number is unique, names aren't

Funny, then, that the world is running out of IPv4 numbers (addresses), but there are still plenty of domain names to go around.

@@lawrencedoliveiro9104 That's neither funny nor strange. You can make up almost any domain name, using any combination of letters and digits (and each domain name can have subdomains as well), but there is a limited number of IPv4 addresses.

That's because phone numbers are unique. You can quite difficultly create an NAPTR record in DNS to point a SIP URI at a SIP server, although having people enter your SIP address in their mobile phone's dialling software is a completely different usability problem. You could also point your UK phone number at a SIP address, you just need to follow all of the requirements set out by the defunct UKEM and petition the UK government to take over control of 4.4.e164.arpa (UK ENUM) from Nominet (who gave up on it).

Or domain name service

I click the video, I see Mike Pound

IPv6 ftw?

IPv4 or IPv6 makes no difference.

Oh there 100% are. The internet is a wild place.

amaena Then they deserve what they get. >:-)

@@PrimitiveFuturologist_YTC absolutely :) we did a scan of all the nameservers in one of the tld zones, and tried to fingerprint them. There were windows nt nameservers out there. It was scary! I mean, I'm impressed they are still up, but wow.

amaena What’s the betting 389 is open on some of ‘em?

It goes there and fails. Anyone who is going to change their IP should reduce the TTL for their records in advance so the change is picked up quickly, Or have both IP's working for the transition period.

@Red Dunkey wut?

@Red Dunkey ah yes, if I string enough computery sounding words together people will think i'm smart!

IPs change allllll the time, especially with cloud services.

Dude it's way more dynamic out there than you think. Have you done any research into it at all?

That's a kitten, not a snake. You don't keep them in glass tanks. 🙃

nope. you have to wait sometimes a couple of hours for the propagation to happen.

Hope you've got DORA, TDM and CSMA/CA down. ;-)