How do DNS servers get added to the DNS tree?

Question

I recently decided to start researching the Domain Name System, and I was wondering. How does one get their DNS server onto the DNS Tree? From what I understand about unregistered domains, people make a DNS server of their own, somehow get it to the bottom of the DNS tree so that other, larger DNS servers forward unknown queries to the personal one, and then make some random domain like asldjfilewkjilsadfjielkd.cf that nobody would try to register. But how do they get their DNS servers onto the "Tree" in the first place?

Answer 1

Your understanding is flawed, and indeed there are 2 different scenarios that need to be discussed.

Broadly speaking there are 2 types if name servers (many nameservers act as both)

authorative servers are nameservers which store the definitive records for a domain. There is a list of root nameservers (https://www.iana.org/domains/root/servers) which recognize the top level domains - eg .com, .net, .nz .au - and specify which nameservers to use for these tld's /cctlds - they would be the base of the tree you are referring to and creating the first branches. Within each tld/cctld you have nameservers for the subdomains which may be further delegated. These nameservers have mappings between nameserver domain records and IP address records hard coded into them and are called glue records which are needed if, for example, example.com has nameservers ns1.example.com and ns2.example.com, so part 1 of your answer the authorative parent for a domain adds nameservers and IP addresses for children subdomains as part of the process of registering the domain. These are called glue records and are handled between the domain registrar and the tld/cctld nameserver

Recursive Nameservers have a list of root nameservers (and typically cache everything else). 8.8.8.8 and 1.1.1.1 are examples of caching nameservers - your ISP likely has their own, and your soho router typically has a special case of these (where it looks to your isp for answers it doesnt know). If you want to provide answers for domains that don't exist or "override authoritative answers" you need to control the caching nameserver

Its worth noting that most (but certainly not all) DNS traffic is sent unencrypted on port 53. In these cases it is practical to MITM (man-in-the-middle-attack) requests and do their own resolution, providing answers for records that don't exist, or overriding authoritative answers. These attacks have been done large-scale by some providers - especially free/cheap ones. DNS over HTTPS - DOH and zone signing are ways to thwart this.

Answer 2

You don't need a DNS server of your own to register a domain. Most domain owners use DNS hosting services provided by their domain registrar, their website host, or a third party. In fact, it would be foolish to run your own DNS server just to register a domain.

Proper DNS hosting for a domain should use multiple servers (preferably 3 or 4) located in different cities (or even countries.) Those servers each need a host name and it is best if they each have a host name from a different top level domain (.com, .org, .uk, etc.) It also takes a fair amount of knowledge and time to run a DNS server and keep it secure.

On the flip side, once somebody (or a company) has gone through the work of setting up a network of DNS servers, they can easily host the DNS for thousands of domains. That makes hosting your DNS with one of these companies very cheap. DNS hosting usually costs a small fraction of what web hosting costs. Domain registrars and web hosting companies often throw in DNS hosting for free with a domain registration or with web hosting.

Back to the original question

Once you have DNS hosting, your DNS host will tell you the host names of their DNS servers. They call this NS (nameserver) records. They might look something like:

• NS: ns1.example.com
• NS: ns2.example.org
• NS: ns3.example.co.uk

You would copy and paste these values into your domain registrar. All domain registrars allow you to set the nameservers for your domain, which are the NS records in the DNS. When you set your NS records at your registrar, the registrar inserts them into the DNS server for the registry.

To make this concrete, lets examine the actual DNS records for example.com:

$ dig example.com
example.com.        86400   IN  A   93.184.216.34

But where did this record come from, and how did the DNS system know which servers to query? Lets look at the NS records:

$ dig NS example.com
example.com.        7016    IN  NS  b.iana-servers.net.
example.com.        7016    IN  NS  a.iana-servers.net.

And we can query each of those servers to see that they return the record for example.com directly (rather than relying on the caching of closer DNS servers):

$ dig @a.iana-servers.net example.com
example.com.        86400   IN  A   93.184.216.34
$ dig @b.iana-servers.net example.com
example.com.        86400   IN  A   93.184.216.34

We can even go one level higher and examine the records for the .com registry:

$ dig NS com
com.            6833    IN  NS  c.gtld-servers.net.
com.            6833    IN  NS  m.gtld-servers.net.
com.            6833    IN  NS  k.gtld-servers.net.
com.            6833    IN  NS  a.gtld-servers.net.
com.            6833    IN  NS  i.gtld-servers.net.
com.            6833    IN  NS  l.gtld-servers.net.
com.            6833    IN  NS  f.gtld-servers.net.
com.            6833    IN  NS  d.gtld-servers.net.
com.            6833    IN  NS  j.gtld-servers.net.
com.            6833    IN  NS  h.gtld-servers.net.
com.            6833    IN  NS  e.gtld-servers.net.
com.            6833    IN  NS  g.gtld-servers.net.
com.            6833    IN  NS  b.gtld-servers.net.

We should be able to query any of these servers directly for the NS records for example.com:

$ dig @d.gtld-servers.net NS example.com
example.com.        172800  IN  NS  a.iana-servers.net.
example.com.        172800  IN  NS  b.iana-servers.net.

example.com is using iana-servers.net for their DNS hosting. The registrar for example.com has been instructed to insert two NS records for the domain into each of the 12 DNS servers that power the .com registry.

So the last missing info: how do we know where to look for the DNS servers for com? There is a hard coded list of root DNS servers. Any of them can be queried to find the name servers for the .com registry:

dig @l.root-servers.net NS com
com.            172800  IN  NS  a.gtld-servers.net.
com.            172800  IN  NS  b.gtld-servers.net.
com.            172800  IN  NS  c.gtld-servers.net.
com.            172800  IN  NS  d.gtld-servers.net.
com.            172800  IN  NS  e.gtld-servers.net.
com.            172800  IN  NS  f.gtld-servers.net.
com.            172800  IN  NS  g.gtld-servers.net.
com.            172800  IN  NS  h.gtld-servers.net.
com.            172800  IN  NS  i.gtld-servers.net.
com.            172800  IN  NS  j.gtld-servers.net.
com.            172800  IN  NS  k.gtld-servers.net.
com.            172800  IN  NS  l.gtld-servers.net.
com.            172800  IN  NS  m.gtld-servers.net.