DNS Management

# Check current DNS configuration
cat /etc/resolv.conf

# Test DNS resolution
nslookup example.com
dig example.com

# Check DNS propagation
dig example.com @8.8.8.8
dig example.com @1.1.1.1

# DNS lookup with detailed information
dig example.com +trace

# Check reverse DNS
dig -x 8.8.8.8

# Test different record types
dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com TXT
dig example.com NS

# A Record Example
# example.com. IN A 192.168.1.100

# AAAA Record Example
# example.com. IN AAAA 2001:db8::1

# CNAME Record Example
# www.example.com. IN CNAME example.com.

# MX Record Example
# example.com. IN MX 10 mail.example.com.

# TXT Record Examples
# example.com. IN TXT "v=spf1 mx -all"
# _dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

# SRV Record Example
# _sip._tcp.example.com. IN SRV 10 5 5060 sip.example.com.

# PTR Record Example (Reverse DNS)
# 100.1.168.192.in-addr.arpa. IN PTR example.com.

# NS Record Example
# example.com. IN NS ns1.example.com.
# example.com. IN NS ns2.example.com.

# SOA Record Example
# example.com. IN SOA ns1.example.com. admin.example.com. (
#     2024010101 ; Serial
#     3600       ; Refresh
#     1800       ; Retry
#     604800     ; Expire
#     86400      ; Minimum TTL
# )

# Check domain registration information
whois example.com

# Check current nameservers
dig example.com NS

# Test domain delegation
dig example.com NS @a.gtld-servers.net

# Check domain status
dig example.com SOA

# Verify DNSSEC (if enabled)
dig example.com DNSKEY
dig example.com DS

# Test from different locations (using different resolvers)
dig example.com @8.8.8.8     # Google DNS
dig example.com @1.1.1.1     # Cloudflare DNS
dig example.com @208.67.222.222  # OpenDNS

# Check TTL values
dig example.com +noall +answer

# Test subdomain resolution
dig www.example.com
dig mail.example.com
dig api.example.com

# MX Records Configuration
# Primary mail server
# example.com. IN MX 10 mail.example.com.

# Backup mail server
# example.com. IN MX 20 backup-mail.example.com.

# SPF Record Configuration
# example.com. IN TXT "v=spf1 mx a ip4:192.168.1.100 -all"

# DKIM Record Configuration
# Generate DKIM key pair
openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

# Extract public key for DNS
# mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

# DMARC Record Configuration
# _dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com"

# PTR Record for Reverse DNS
# 100.1.168.192.in-addr.arpa. IN PTR mail.example.com.

# Verify email DNS configuration
dig example.com MX
dig example.com TXT
dig _dmarc.example.com TXT
dig mail._domainkey.example.com TXT

# Test email delivery
echo "Test email" | mail -s "DNS Test" user@example.com

# DNSSEC Configuration
# Check DNSSEC status
dig example.com +dnssec

# Verify DNSSEC chain
dig example.com DS
dig example.com DNSKEY

# Test DNSSEC validation
dig example.com +sigchase +trusted-key=./trusted-key.key

# DNS Monitoring
# Monitor DNS queries
sudo tcpdump -i eth0 port 53

# Check for DNS cache poisoning attempts
sudo tail -f /var/log/syslog | grep named

# DNS Benchmarking
# Test DNS server performance
dnsperf -s 8.8.8.8 -d queryfile.txt

# DNSSEC Tools
# Install DNSSEC tools
sudo apt install dnssec-tools -y

# Generate DNSSEC keys
dnssec-keygen -a RSASHA256 -b 2048 example.com

# Sign zone file
dnssec-signzone -o example.com example.com.zone

# Firewall rules for DNS
sudo ufw allow 53/tcp
sudo ufw allow 53/udp

# Rate limiting for DNS queries
# Configure in BIND/named.conf
# rate-limit {
#     responses-per-second 10;
#     window 5;
# };

# DNS over HTTPS/TLS
# Install DNS over HTTPS client
sudo apt install curl -y
curl -H 'accept: application/dns-json' 'https://1.1.1.1/dns-query?name=example.com&type=A'

# Check DNS propagation
# Using online tools
curl -s "https://www.whatsmydns.net/api/check?domain=example.com&type=A"

# Check from multiple locations
dig example.com @8.8.8.8
dig example.com @1.1.1.1
dig example.com @208.67.222.222
dig example.com @4.2.2.1

# Check TTL values
dig example.com +noall +answer

# Clear local DNS cache
# Linux
sudo systemd-resolve --flush-caches
sudo service dnsmasq restart

# macOS
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Windows
ipconfig /flushdns

# DNS troubleshooting commands
# Check nameserver response
nslookup example.com ns1.example.com

# Test recursive resolution
dig example.com +trace

# Check for DNS loops
dig @ns1.example.com example.com

# Test zone transfer (if allowed)
dig @ns1.example.com example.com AXFR

# Check for DNS blacklisting
dig example.com TXT

# Monitor DNS query logs
sudo tail -f /var/log/named/query.log

# DNS debugging with Wireshark
# Capture DNS traffic
sudo tcpdump -i eth0 -s0 -w dns.pcap port 53

# Analyze with tshark
tshark -r dns.pcap -Y "dns" -T fields -e dns.qry.name -e dns.qry.type

# Load Balancing with DNS
# Round-robin configuration
# www.example.com. IN A 192.168.1.10
# www.example.com. IN A 192.168.1.11
# www.example.com. IN A 192.168.1.12

# Weighted load balancing
# www.example.com. IN A 192.168.1.10 ; weight 3
# www.example.com. IN A 192.168.1.11 ; weight 1

# Geographic DNS (GeoDNS)
# Configure with DNS provider for location-based routing

# DNS Failover
# Primary server
# api.example.com. IN A 192.168.1.10

# Backup server (higher TTL for stability)
# backup.example.com. IN A 192.168.1.11

# Health check monitoring script
#!/bin/bash
PRIMARY_IP="192.168.1.10"
BACKUP_IP="192.168.1.11"
DOMAIN="api.example.com"

# Check primary server health
if curl -f --max-time 5 http://$PRIMARY_IP/health > /dev/null 2>&1; then
    echo "Primary server is healthy"
    # Update DNS to point to primary
    # Use DNS API to update record
else
    echo "Primary server is down, switching to backup"
    # Update DNS to point to backup
    # Use DNS API to update record
fi

# Dynamic DNS Update
# Using ddclient for dynamic DNS
sudo apt install ddclient -y

# Configure ddclient
sudo nano /etc/ddclient.conf

# protocol=dyndns2
# use=web
# server=members.dyndns.org
# login=username
# password=password
# example.com

# Manual dynamic DNS update
curl "https://dynamicdns.park-your-domain.com/update?host=example.com&domain=example.com&password=password&ip=192.168.1.100"

# CDN DNS Configuration
# Configure CNAME for CDN
# cdn.example.com. IN CNAME example.cdnprovider.com.

# Multi-CDN setup with DNS
# www.example.com. IN CNAME primary.cdn.com.
# www.example.com. IN CNAME backup.cdn.com.

# DNS Analytics and Reporting
# Install DNS analytics tools
sudo apt install dnstop -y

# Monitor DNS traffic in real-time
sudo dnstop -l 5 eth0

# DNS statistics
sudo tcpdump -i eth0 -c 1000 port 53 | awk '{print $8}' | sort | uniq -c | sort -nr