Skip to content

06-02: Exercises

Question

A DNS client runs a lookup and receives the following simplified response (formatted similarly to dig output):

;; QUESTION SECTION:
;www.shopfast.net.       IN    A

;; ANSWER SECTION:
www.shopfast.net.  300   IN    A      198.51.100.23

;; AUTHORITY SECTION:
shopfast.net.       86400 IN    NS     ns1.shopfast.net.
shopfast.net.       86400 IN    NS     ns2.shopfast.net.

;; ADDITIONAL SECTION:
ns1.shopfast.net.   86400 IN    A      203.0.113.5
ns2.shopfast.net.   86400 IN    A      203.0.113.6

Based on this packet, answer:

  1. What domain name was originally queried, and what record type?
  2. What IP address was returned for that domain?
  3. What is the TTL of the answer record, and what does that TTL mean practically?
  4. Which servers are authoritative for the shopfast.net zone, and what section tells you that?
  5. What is the purpose of the Additional section here, and why is it needed?

Solution

Step 1: Identify the queried domain and record type

Look at the Question section — this always echoes back exactly what the client asked for:

;www.shopfast.net.       IN    A
  • Domain queried: www.shopfast.net
  • Record type: A (an IPv4 address record). IN just means "Internet class," which is the class used for essentially all normal DNS traffic.

Step 2: Identify the returned IP address

Look at the Answer section — this holds the actual record(s) that answer the question:

www.shopfast.net.  300   IN    A      198.51.100.23
  • Returned IP address: 198.51.100.23
  • This directly answers the question: www.shopfast.net resolves to 198.51.100.23.

Step 3: Identify the TTL and what it means

The TTL is the second field in the resource record, right after the name:

www.shopfast.net.  300   IN    A      198.51.100.23
                    ^^^
                    TTL (in seconds)
  • TTL = 300 seconds (5 minutes)
  • Practically: any resolver or client that caches this answer is allowed to reuse it without asking again for 300 seconds from the moment it received the response. After that, the cached entry expires and must be re-queried. A short TTL like 300s is common for records that might change soon (e.g., during a server migration or load-balancing failover); a long TTL means less DNS traffic but slower propagation of changes.

Step 4: Identify the authoritative name servers

Look at the Authority section — this lists the name servers that are authoritative for the zone containing the answered name (here, the zone is shopfast.net):

shopfast.net.       86400 IN    NS     ns1.shopfast.net.
shopfast.net.       86400 IN    NS     ns2.shopfast.net.
  • Authoritative servers: ns1.shopfast.net and ns2.shopfast.net
  • The section header itself (AUTHORITY SECTION) and the record type (NS = Name Server) are what tell you these are the servers responsible for answering queries about the shopfast.net zone authoritatively — as opposed to a caching resolver just repeating an answer it remembered.
  • Their TTL of 86400 seconds (24 hours) is separate from the Answer section's TTL — each record carries its own TTL.

Step 5: Identify the purpose of the Additional section

ns1.shopfast.net.   86400 IN    A      203.0.113.5
ns2.shopfast.net.   86400 IN    A      203.0.113.6
  • The Authority section told us the names of the authoritative servers (ns1.shopfast.net, ns2.shopfast.net), but names alone aren't directly usable — a resolver needs an IP address to actually contact those servers.
  • The Additional section supplies exactly that: the glue records (A records) giving the IP addresses of the name servers mentioned in the Authority section.
  • This avoids a circular problem: if the resolver had to look up ns1.shopfast.net's IP address by querying... shopfast.net's name servers, it would never get started. Bundling the glue records directly in the response solves this.

Final Answer

  1. Queried domain: www.shopfast.net, record type A.
  2. Returned IP address: 198.51.100.23.
  3. TTL: 300 seconds — the answer may be cached and reused for 5 minutes before it must be re-queried.
  4. Authoritative servers: ns1.shopfast.net and ns2.shopfast.net, shown in the Authority section as NS records.
  5. The Additional section provides glue A records (IP addresses) for the name servers listed in the Authority section, so resolvers can actually reach them without a chicken-and-egg lookup problem.