I should clarify I wasn’t a upper level sys admin managing those servers, I just used them or maintained accounts being a rank and file technician
While I get the fundamental concept of DNS as a phonebook for your IPs. I am not sure why it is joked around if something goes haywire or someone breaks something.
Is it because if you get no DNS, people can’t log in through their AD accounts, browse the Internet?
Afaik DNS is a bit of a rabbit hole topic, maybe that’s why people joke about it due to DNS being this “No one really knows how this magic name matching box works”?
Please correct me, I’d genuinely like to know why this is prevalent from you guys.
There’s even a haiku:
It’s not DNS
There’s no way it’s DNS
It was DNS
100% of the internet depends on it, and 90% of technical people can’t be bothered to learn how it works and understand it. Partly because they only touch it once every 5 years. They get what they need done but don’t understand why it worked, so it ends up feeling like black magic to them.
The worst part isn’t even that they don’t understand it, but that they think they know everything about it after learning the basics. Suddenly you get people blocking port 53/udp “because DNS uses UDP” and people using .dev and .local as internal domain names.
Still not as misunderstood as NTP, though.
It’s fine to use if you’re using it for Bonjour/mDNS (which is enabled by default on basically everything these days). If not, any computer in your network can take on a .local domain of their choosing and your computers will happily resolve it before hitting the DNS server, or you may end up in a race between normal DNS and mDNS. Or you can manually disable mDNS on every machine and hope nothing else causes conflicts, I guess.
If you need a TLD for fake internal domains, use .internal; that has recently been reserved for internal use and won’t end up in any standard protocols. There’s also a weaker blacklist list that’s part of the gTLD application process which includes .local, but that’s not necessarily set in stone.
If anyone you know claims to have expertise in the computer field and doesn’t know everything about DNS (there’s not much to know) then those people are clueless and by no means are they experts.
there’s not much to know
But there is. Between DNSSEC and EDNS you need to stay on top of stuff or your assumptions may be wrong. many supposed facts about DNS were assumptions by textbook authors that were invalidated years later, and that’s with the stuff that complies with the standards.
DNS from the 20th century was simple modern DNS really isn’t.
used to feel this way about dns until I setup my pihole. I love how dns controls so much behind the scenes.
DNS isn’t supposed to control that much PIhole is a hack, it would be more accurate to say PIhole controls so much behind the scenes. DNS is supposed to do exactly this domain.com->1.2.3.4 nothing more and nothing less anything else is a hack when cloud flair runs all your traffic traffic through a proxy that is them hacking the system domain.com->change-1.2.3.4
Does Pi Hole do anything Ad Guard’s Public DNS servers can’t? https://adguard-dns.io/en/public-dns.html seems easier this way which is why I ask.
what do you think is pointing adservers to a black hole and not being able to reach my home network?
90% of technical people can’t be bothered to learn how it works and understand it
Playing real fast and loose with the term “technical people.” If you mean just in general people familiar with and comfortable with tech, yeah that’s fine. If you mean those who work or hobby in the IT industry, well then they’re not very good at their jobs and probably should not have those jobs.
I can speak to Windows DNS and AD.
Yes, the basis of DNS is to match IP addresses with hostnames. But there are plenty of other kinds of DNS records. SPF, DKIM, DMARC use DNS for email validation; AD uses SRV records to point clients to find domain resources. There are also reverse zones, where you send a query for an IP address to learn the hostname(s) associated with it. There are CNAME records that associate a hostname with whatever IP address another hostname is using.
Point being, there are a lot of different interconnected layers, and if some entry is wrong, it can easily have a cascading effect that creates a problem with something entirely different.
I would also extend the “It’s always DNS” trope to “It’s always name resolution.” In a Windows environment, at least, DNS name resolution is only used when a FQDN (fully qualified domain name) is being queried. If your application is only looking for [ServerName], NetBIOS name resolution is used.
When NetBIOS name resolution is used, that is querying a WINS server (if one is specified and exists). In the absence of a WINS server, the query is sent to the “master browser” on your network segment. What machine is the “master browser”? By default, all machines on a network segment (subnet) have a browser election behind the scenes to choose the master browser, based in large part on the machines’ hardware capabilities.
This means that any machine on the segment (again, by default) can become the master browser and respond to NetBIOS queries. Laptop, desktop, server, doesn’t matter. There are registry entries that can be manipulated to have manual control over what machine is master browser, what machines are and are not allowed to participate in elections, but it is rare that those are configured.
Why do I know all this? Because about 25 years ago, I came across a situation where different machines were configured with different overlapping subnet masks, and users were trying to browse \\servername\share, and getting only partial results. It took a long time to narrow that down to the misconfigured subnet masks. At the company I’m currently at, the developers still use NetBIOS names instead of FQDNs in applications.
Always use FQDNs in any in-house development. Always use FQDNs when accessing resources by hostname. And if “some weird, inexplicable, possibly intermittent issue” is happening, check name resolution.
I got a story that perfectly illustrates the meme.
Had done a solid job of setting up my first domain, from scratch. Everything was tooling along nicely for months until my administrator account kept locking itself, every few minutes.
Logged in with another admin account and hunted for the issue for a month. Since it was affecting only my account, none of the users had issues. Finally found a single sentence in an obscure forum that pointed me. My DNS issue was buried deep in the DHCP settings.
Despite knowing better, I had used my personal account to authorize interactions between the DNS and DHCP services. When I changed my password, DNS was still trying to use the old credentials, over and over again, locking my account.
HOLY SHIT! If you google “dns haiku” my image is in the front page twice! Love it!
When it is the cause of a problem it’s not always obvious at first so you spend hours troubleshooting the broken app until you look at DNS and a simple DNS issue
