7.2 DNS & DHCP

Two services make modern networks usable for humans: DNS (Domain Name System) turns names into addresses, and DHCP (Dynamic Host Configuration Protocol) hands out IP settings so devices can join a network without manual typing. The Cyber Test expects you to know the resolution path, major record types, the DHCP DORA exchange, and the ports involved.

DNS: Names That Machines Can Use

People remember recruiting.af.mil far better than a raw IPv4 or IPv6 address. DNS is the distributed database and protocol that maps names to resource records. When your browser or tool asks "what is the IP for this hostname?", a resolver (usually your OS, talking to a recursive DNS server) finds the answer.

Recursive Resolution Steps (Typical Path)

Assume a client needs the IPv4 address of www.example.com and has no useful cache:

1. Stub resolver → recursive server: The client queries its configured DNS server (often from DHCP), usually over UDP port 53.
2. Root hint: If the recursive server does not already know, it asks a root name server: "Who handles .com?"
3. TLD referral: A root server responds with a referral to the .com TLD (top-level domain) name servers.
4. Authoritative referral: The recursive server asks a .com TLD server: "Who is authoritative for example.com?" and receives NS records (and glue addresses) for that zone.
5. Authoritative answer: The recursive server queries an authoritative server for example.com and receives the A record for www.example.com (or a CNAME chain that eventually ends in an A/AAAA).
6. Response to client: The recursive server returns the answer to the client and typically caches it for the record's TTL (time to live).

On later lookups within the TTL, steps 2–5 are skipped — cache hits are why the Internet feels fast after the first resolution.

Iterative vs Recursive (Exam Language)

• Recursive query: "Please get me the final answer" — what clients usually send to their resolver.
• Iterative query: "Tell me the next best referral" — how recursive servers typically walk the hierarchy with root/TLD/authoritative servers.

You do not need ISP internals, but you do need the chain: client → recursive → root → TLD → authoritative → answer.

---

Important DNS Record Types

Practical Notes

• A hostname can have both A and AAAA records (dual-stack).
• CNAME targets are names, not "final IPs" by themselves — resolution continues until an address record appears.
• MX records point to hostnames that themselves need A/AAAA records.
• Reverse DNS (PTR) is separate from forward DNS; not every forward name has a matching PTR.

DNS and Transport

Ordinary queries use UDP/53. If the response is too large or for zone transfers (AXFR/IXFR between name servers), DNS may use TCP/53. Security tooling that "allows DNS" must often allow both, or large answers break.

Failure Modes You Should Recognize

• Wrong DNS server / blocked 53: Pings to an IP work; browsing by name fails.
• Stale cache: An old A record remains until TTL expires after a server moves.
• NXDOMAIN: Authoritative answer says the name does not exist.
• ServFail: Resolver error — upstream timeout, misconfiguration, or validation failure.

---

DHCP: Automatic Host Configuration

Manually assigning IP address, subnet mask, default gateway, and DNS servers to every laptop does not scale. DHCP leases that configuration from a server.

What a Typical Lease Includes

• IPv4 address
• Subnet mask (or prefix length)
• Default gateway (router)
• DNS server addresses
• Lease duration and renewal timers
• Optionally: domain name, NTP servers, and other options

DORA — The Four-Step Dance

Memorize the acronym DORA:

1. Discover — The client (usually with address 0.0.0.0) broadcasts a DHCPDISCOVER: "Is any DHCP server out there?" Source port 68, destination 67, often to the broadcast address.
2. Offer — A DHCP server replies with a DHCPOFFER proposing an IP address and options.
3. Request — The client broadcasts (or unicasts, depending on state) a DHCPREQUEST accepting a specific offer — important when multiple servers offered.
4. Acknowledge — The chosen server sends DHCPACK confirming the lease. The client configures its interface and can communicate on the network.

Ports to lock in: UDP 67 = server, UDP 68 = client.

Lease Lifecycle

• Mid-lease, the client renews (typically unicast to the leasing server).
• If renewal fails, it may rebinding by broadcasting again before the lease expires.
• When finished, a polite client can DHCPRELEASE the address.
• If no server answers, some OSes fall back to APIPA (169.254.0.0/16 link-local) — a clue the host never got a real DHCP lease.

DHCP Relay (Why Servers Can Sit Off-Subnet)

DHCP Discover is a broadcast. Routers do not forward broadcasts by default. A DHCP relay (IP helper) on the local router catches the Discover and unicasts it to a central DHCP server on another subnet, preserving enough client info for a correct offer. Conceptually: relays let one DHCP server serve many VLANs.

---

DNS and DHCP Working Together

On a healthy LAN:

1. Host boots and completes DORA.
2. Lease includes a DNS server address (and often a default domain).
3. User opens a URL; the stub resolver asks that DNS server.
4. Name becomes an IP; TCP/UDP sessions proceed to the destination.

Break either service and symptoms diverge:

---

Security Angles (Light Touch for CT)

You are not studying full red-team tradecraft here, but the aptitude exam may touch risks:

• Rogue DHCP: An unauthorized server offers bad gateways (traffic interception).
• DNS spoofing / cache poisoning: Wrong answers redirect users to malicious IPs.
• Cleartext queries: Traditional DNS is not encrypted (DoH/DoT exist but are beyond core CT depth).

Defenses conceptually: authorize DHCP servers, monitor for extra offers, validate DNS where policy requires, and restrict who can reconfigure resolver settings.

---

Exam Drill Points

Be ready to:

1. Order the DNS hierarchy walk (root → TLD → authoritative).
2. Expand DORA and assign each step's purpose.
3. Match 67/68 to DHCP and 53 to DNS.
4. Distinguish A vs AAAA vs MX vs CNAME.
5. Diagnose "IP works, web names don't" as DNS-centric.

Master these two services and you unlock half of practical networking troubleshooting — and a large slice of Networking-domain Cyber Test items.