Do I have to create a DNS server when setting up a network?

Question

I studied a bit of networking in my class a few years ago. But I always had some doubts about this and never got it clear. We set up Windows Server and Ubuntu HTTP servers, DNS servers using apache and various settings. I hope this question is not too open.

My question is, why should I set up a DNS server in a network, under what situation? If I were setting up a hosting server for websites, would DNS servers be necessary to create multiple public virtualhosts for example?

In my experience, using apache for example, setting virtualhosts don't need to set up DNS servers at least for local environment. Sorry for the question but I'm too confused about why to set up DNS servers for what situation especifically. We set up DNS in class using the host machine and then Windows Server in a Virtual Machine but still didn't understand the real life usability of this.

Could anyone explain under what circunstances should I set up a DNS server when setting a network? Is creating multiple domains for hostings websites?

Answer 1

You are mixing a lot of things in fact, probably because the role of a DNS server is not clear.

So, let me just go back and try to explain things a little more. First by making sure to understand that everything below indeed also applies for websites and the HTTP(S) protocol but is certainly not specific to it and in fact applies to any service on the Internet.

Computers work with numbers. On the Internet, to be reachable we give them IP addresses (they exist in 2 flavors: IPv4 and IPv6), which are basically just big numbers.

But since this is not very practical to deal with for humans, we defined a protocol and an infrastructure that is capable of mapping arbitrary names (such as the hostname in an URL, or the right end part of an email address) to these IP addresses, so that humans could just remember the names, not the numbers.

This is, very simplified, the role of the DNS. And for its service to work, you need some DNS servers which fall basically in two categories:

• authoritative nameservers
• recursive nameservers

When you activate a new domain name on Internet and it has services attached to it, like a website, some email adresses and so on, to be able to resolve it, that is make sure people will be able to translate its names to the appropriate IP addresses for a given service on this domain name, this domain will need some authoritative nameservers and the appropriate configuration in the parent zone (that is "one level up" in summary), that is at the registry side of the TLD in which the domain is.

There are typically 2 authoritative nameservers per domain. They are configured once and updated if names/IP addresses changed. They can be managed by the domain name owner itself, or any third party delegated to do it, be it the registrar of the domain name or external DNS providers.

They typically live in datacentres, and certainly not on user's networks (again, typically).

So, before your website is reachable you need to make sure that its hostname is correctly configured in the zonefile used by the authoritative nameservers. Which means some kind of correct DNS setup there.

Then you need recursive nameservers. Why? Because they are the ones that will do the mapping between the name and the IP. They know, using the DNS protocol, how to find the appropriate authoritative nameservers for any kind of domain name. Each computer is configured with one or more (for resiliency) of such nameservers by putting the IP address (otherwise obvious chicken and egg problem) of these recursive nameservers somewhere in the OS (depends on the OS). The configuration can be static or be discovered when the computer boots up (by querying other servers whose role is to provide such kind of configuration items)

When any application, such as a browser, needs to resolve a name, it asks the OS typically (or do the DNS queries itself) to do it on its behalf, and the OS will use the configured recursive nameserver(s) to do the job and get back the reply to the calling application.

These recursive nameservers can be installed:

• on the computer itself, typically for the use only of all local processes
• on a computer in the same network, for example as a client of an ISP you can use the ISP recursive nameservers and they are then shared by all clients of the ISP. This can have both benefits and drawbacks: as benefits you have the fact that the cache (each reply a recursive nameserver is given with a "time to live" and the server can cache this information for some time hence giving it faster next time because no need to query again) is shared among clients so is more "riche", but as drawbacks you may have that your ISP changes the replies you get, for example to divert traffic or to censor some pages
• on a computer available publicly, for anyone, managed by some big or not so big organizations (having a public recursive nameservers expose you to some DDOS and to be used as some DDOS origin, so it should not be done without expertise in this field), like Google did with 8.8.8.8 or CloudFlare with 1.1.1.1 or Quad9 with 9.9.9.9.

Everyone can choose which recursive nameserver it wants to use.

Apache, as a webserver, like any other application may also need access to a recursive nameserver for at least these reasons:

• if you put name in VirtualHost blocks, instead of IP addresses, Apache may need to resolve them at startup (and hence it is not recommended to put names there)
• depending on how they are configured, during logging time, you may wish to log not only the IP address of the client coming to your website but its name (the mapping name -> IP can be reversed, again by using the DNS in some specific way), and hence you need the recursive nameserver<

So Apache, like any process on the same computer, will have access to some "local" recursive nameservers for it needs, like written above it could run on the same box, in another box on same network, or be a public one like listed above.

But besides that, somewhere and typically not in the same network as the Apache webserver, you will have 2 authoritative nameservers that will need to be correctly configured so that people wanting to go to your websites will have the hostname contained in URL be correctly resolved to the IP addresses that are on the server where Apache is running.