100% 브라우저 메모리 연산 • 서버 로그 수집 제로 • 즉각적인 실행
Curious Techie개발자 툴박스
DNS8분 소요•한국어 Edition100% 브라우저 메모리 실행

DNS란 무엇이며 네임서버는 어떻게 작동하는가?

도메인 네임 시스템의 계층적 주소 해석, 루트 서버, A/AAAA/MX/TXT 레코드 및 암호화된 DNS-over-HTTPS (DoH) 기술 해설.

CT
Curious-Techie Engineering Team검증된 작성자

Web Protocols & Security Architecture Research

발행일:
•
수정일:
•8분 소요
공식 기술 규격:RFC 9110(IETF)
검토자: Curious-Techie Architecture Peer Review Group
핵심 질문 • 즉시 기술 답변

DNS란 무엇이며 네임서버는 어떻게 작동하는가?

TL;DR — 핵심 엔지니어링 요약

  • DNS는 사람이 기억하기 쉬운 도메인 이름을 라우팅 가능한 IP 주소(IPv4 및 IPv6)로 변환합니다.
  • 주소 해석 순서: 재귀 리졸버 → 루트 서버 → TLD 서버 → 권한 있는 네임서버.
  • 핵심 레코드: A (IPv4), AAAA (IPv6), CNAME, MX, TXT.
  • 최신 DNS는 도청 방지를 위해 DoH (RFC 8484) 및 DoT를 통해 통신을 암호화합니다.
// 기본 개념

핵심 개념 및 아키텍처 구조

Recursive Resolver

Resolver

The server (often ISP or public like 1.1.1.1 / 8.8.8.8) that iteratively queries the DNS hierarchy on behalf of the client.

Root Nameservers

Infrastructure

13 root server IP identities (managed by IANA/ICANN) at the pinnacle of the DNS hierarchy serving root zone hints.

TLD Nameserver

Hierarchy

Maintains delegations for specific domain extensions (.com, .org, .dev, .io) and points to authoritative nameservers.

Authoritative Nameserver

Authority

The final destination holding master zone files with definitive DNS records for a domain.

Time-to-Live (TTL)

Caching

32-bit unsigned integer specifying seconds a record may be cached before re-querying authoritative sources.

DNSSEC

Security

Cryptographic authentication of DNS responses using asymmetric keys (KSK, ZSK) to eliminate spoofing.

실행 흐름 • 동작 시퀀스

DNS란 무엇이며 네임서버는 어떻게 작동하는가?의 동작 원리와 메커니즘

핵심 요약 답변:

When a browser requests a domain, the local operating system stub resolver checks local memory and hosts files. If uncached, it dispatches a recursive query over UDP port 53. The recursive resolver systematically walks down the hierarchical tree: first querying a root nameserver for the TLD delegation, then querying the TLD nameserver for the authoritative delegation, and finally querying the authoritative server for the exact record.

1

Local Cache Check

Browser checks internal DNS cache, OS socket cache (e.g. systemd-resolved), and hosts file.

getaddrinfo("curious-techie.com", NULL, &hints, &res);
2

Recursive Resolver Query

The OS dispatches a recursive query to configured resolvers (e.g., 1.1.1.1 or internal VPC resolver).

dig +trace curious-techie.com
3

Root Hints Query

Resolver contacts a Root Nameserver (.); receives referral NS records for the .com TLD.

;; Query: curious-techie.com A
;; Referral to: a.gtld-servers.net.
4

TLD Nameserver Query

Resolver queries TLD nameserver for .com; receives authoritative NS records and glue records.

;; NS Delegation: ns1.curious-techie.com. (Glue: 198.51.100.53)
5

Authoritative Record Retrieval

Resolver queries authoritative nameserver directly; receives authoritative A/AAAA record with TTL.

curious-techie.com. 300 IN A 198.51.100.1
6

Response & Client Cache

Resolver caches the answer for 300 seconds and returns IP to browser; TCP handshake begins.

Connect to 198.51.100.1:443 -> SYN / SYN-ACK
기술 예제 • 실전 구현

DNS란 무엇이며 네임서버는 어떻게 작동하는가?의 실무 구현 및 적용 방법

Querying DNS Records via dig Command

bash
# Query IPv4 Address (A Record)
dig +noall +answer curious-techie.com A

# Query Mail Exchange (MX Record) with Priority
dig +noall +answer curious-techie.com MX

# Trace Complete Iterative Resolution Path
dig +trace curious-techie.com

# Inspect Authoritative SOA Serial and Timers
dig curious-techie.com SOA

엔지니어링 상세 정보: The dig (Domain Information Grok) utility sends raw DNS query packets and displays flags, answer sections, and TTL counters.

Configuring BIND Zone File Syntax (RFC 1035)

zonefile
$TTL 3600
@       IN  SOA ns1.example.com. admin.example.com. (
                2026100501 ; Serial YYYYMMDDNN
                7200       ; Refresh (2h)
                3600       ; Retry (1h)
                1209600    ; Expire (2w)
                300        ; Negative Cache TTL (5m)
)
; Nameservers
@       IN  NS  ns1.example.com.
@       IN  NS  ns2.example.com.

; Host Records
@       IN  A     198.51.100.1
@       IN  AAAA  2001:db8::1
www     IN  CNAME curious-techie.com.

; Email Verification
@       IN  MX 10 mail.example.com.
@       IN  TXT   "v=spf1 include:_spf.example.com ~all"

엔지니어링 상세 정보: Standard RFC zone syntax declaring Start of Authority (SOA), nameservers, IPv4/IPv6 address records, CNAME aliases, and SPF text records.

프로덕션 아키텍처 • 실사례 연구

운영 환경에서 DNS란 무엇이며 네임서버는 어떻게 작동하는가?을 사용하는 이유와 구성

Global CDN Anycast Routing

Cloudflare / AWS CloudFront routing users to nearest edge point-of-presence (PoP).

GeoDNS and Anycast BGP announce identical IP addresses from hundreds of locations; resolvers receive localized routes.

Zero-Downtime Blue/Green Deployments

Migrating production traffic between Kubernetes clusters across cloud providers.

Lower DNS TTL to 60 seconds 48 hours prior to migration; adjust Weighted CNAME records to gradually shift percentages.

Email Deliverability & Anti-Spoofing

Preventing phishing domains from impersonating corporate transactional emails.

Publishing strict SPF, DKIM (public key TXT record), and DMARC (p=reject) policy records at domain apex.

안티패턴 및 주의사항

DNS란 무엇이며 네임서버는 어떻게 작동하는가? 구현 시 자주 발생하는 실수와 오해

안티패턴: Placing a CNAME record at domain apex (@ root domain)

영향도: Violates RFC 1034 section 3.6.2; breaks MX, NS, and SOA records on apex domain.

권장 해결책: Use ALIAS / ANAME record virtualization or native Apex flattened routing provided by modern DNS providers.

안티패턴: Modifying production DNS records with an 86400s (24h) TTL active

영향도: Users stay routed to decommissioned backends for up to 24 hours due to aggressive downstream caching.

권장 해결책: Pre-lower TTL to 300 seconds at least 24 hours before planned infrastructure maintenance.

안티패턴: Failing to increment SOA serial number after editing zone records

영향도: Secondary slave nameservers fail to detect zone changes; zone transfer is never initiated.

권장 해결책: Always increment the 10-digit SOA serial (format: YYYYMMDDNN) with every zone edit.

위협 모델링 • 공격 벡터

DNS란 무엇이며 네임서버는 어떻게 작동하는가?의 보안 영향 및 취약점 분석

DNS Cache Poisoning (Kaminsky Attack)

CWE-348 / Kaminsky Flaw

취약점: Attacker injects forged answers into resolver cache before authoritative response arrives.

완화 및 방어 전략: Implement UDP source port randomization and DNSSEC cryptographic signature validation.

DNS Amplification DDoS

OWASP Top 10 Denial of Service

취약점: Open resolvers amplify small spoofed UDP requests into massive response floods targeting victim IPs.

완화 및 방어 전략: Disable open recursive resolver access on public IPs; configure Response Rate Limiting (RRL).

Subdomain Takeover

CWE-284 Improper Access Control

취약점: Dangling CNAME record points to abandoned cloud storage bucket or decommissioned SaaS service.

완화 및 방어 전략: Audit DNS records continuously; remove CNAME targets immediately upon resource decommissioning.
진단 워크플로 • 근본 원인 해결

DNS란 무엇이며 네임서버는 어떻게 작동하는가? 오류 진단 및 트러블슈팅 가이드

발생 증상 및 오류 징후: NXDOMAIN returned for valid domain in production

근본 원인 기술 분석:
  • Typo in authoritative zone file
  • Registrar nameservers pointing to wrong NS records
  • Negative caching in local resolver
프로덕션 검증 해결책: Query authoritative server directly with `dig @ns1.yournameserver.com domain.com A` to bypass intermediary resolver caching.

발생 증상 및 오류 징후: SERVFAIL returned intermittently across global regions

근본 원인 기술 분석:
  • DNSSEC validation failure due to expired RRSIG key
  • Authoritative nameservers timing out or firewall dropping UDP 53
  • Zone transfer failure
프로덕션 검증 해결책: Validate DNSSEC chain of trust using `delv domain.com` or online DNSViz to detect broken delegation signers.

발생 증상 및 오류 징후: DNS changes visible locally but not globally (Propagation Lag)

근본 원인 기술 분석:
  • Downstream public resolvers honoring prior high TTL cache duration
  • Stale OS local resolver cache
프로덕션 검증 해결책: Flush local resolver cache (`ipconfig /flushdns` or `resolvectl flush-caches`); query authoritative servers directly.
기술 지식베이스 • 즉시 답변

DNS란 무엇이며 네임서버는 어떻게 작동하는가?에 대한 자주 묻는 질문

Q:What is the difference between an Authoritative and a Recursive DNS server?

핵심 요약 답변:An Authoritative server holds the definitive master records for a specific domain. A Recursive server acts as an intermediary, querying authoritative servers across the global hierarchy on behalf of client devices and caching the answers.

Authoritative servers (e.g. Cloudflare, Route53, BIND) answer "Who owns this domain and what is their IP?". Recursive resolvers (e.g. 1.1.1.1, Google 8.8.8.8, ISP resolvers) answer the client request by iteratively walking the tree from root hints downward.

Q:Why can’t a CNAME record co-exist with other record types at the domain root?

핵심 요약 답변:RFC 1034 section 3.6.2 dictates that if a CNAME record exists at a node, no other data records may exist for that node. Placing a CNAME at apex eliminates mandatory SOA and NS records.

Because the root apex (@) requires an SOA record and at least two NS records for zone validity, an RFC-compliant nameserver cannot bind a CNAME to the apex. Modern DNS hosts resolve this via proprietary ALIAS/ANAME record synthetic flattening.

Q:Does DNS use UDP or TCP port 53?

핵심 요약 답변:DNS uses UDP port 53 for standard queries under 512 bytes (or up to 4096 bytes with EDNS0) to minimize latency. It falls back to TCP port 53 for truncated payloads (TC flag set), zone transfers (AXFR), and large DNSSEC responses.

Standard queries use stateless UDP to avoid connection handshake round trips. If an answer exceeds the buffer size, the server sets the TC (Truncation) bit in the header, prompting the client to retry over TCP port 53.

섹션 12 • 대화형 실습 유틸리티

추천 관련 개발자 도구

100% 브라우저 메모리 실행

Companion Interactive Tool100% Client-Side Execution

Test & Verify with DNS Lookup

Query A, AAAA, MX, TXT, CNAME, NS, SOA, and CAA records via DNS-over-HTTPS.

Open DNS Lookup→
Companion Interactive Tool100% Client-Side Execution

Test & Verify with WHOIS Lookup

Query domain registration, registrar info, and expiration dates via RDAP.

Open WHOIS Lookup→
Companion Interactive Tool100% Client-Side Execution

Test & Verify with Domain Intelligence

Comprehensive domain reconnaissance: registrar, age, DNS, and IP info.

Open Domain Intelligence→
Companion Interactive Tool100% Client-Side Execution

Test & Verify with IP Address Checker

Detect your public IP address, ISP, ASN, and geographic location.

Open IP Address Checker→

용어사전

A Record
Address record mapping a fully qualified hostname to a 32-bit IPv4 address.
AAAA Record
Quad-A record mapping a hostname to a 128-bit IPv6 address.
CNAME
Canonical Name record aliasing one hostname to another canonical hostname.
MX Record
Mail Exchange record specifying SMTP mail servers and numerical priority values.
SOA Record
Start of Authority record containing primary nameserver, admin email, serial number, and zone timers.
Authoritative Sourcing & Verification

References & Primary Sources

Every source below directly substantiates technical statements and protocol behaviors explained in DNS란 무엇이며 네임서버는 어떻게 작동하는가?. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.

  1. [1]IETFPrimary SpecificationRFC 1034 • Section 3 & 4
    Verified Primary Source
    RFC 1034: Domain Names — Concepts and Facilities
    Technical Claim Supported:

    Establishes the hierarchical distributed domain name space, authoritative name servers, root zone topology, and zone delegations.

    Source URI: https://datatracker.ietf.org/doc/html/rfc1034
  2. [2]IETFPrimary SpecificationRFC 1035 • Section 3.2 (Resource Records)
    Verified Primary Source
    RFC 1035: Domain Names — Implementation and Specification
    Technical Claim Supported:

    Defines standard DNS Resource Record wire structures (A, CNAME, MX, NS, PTR, SOA) and port 53 UDP/TCP protocol formats.

    Source URI: https://datatracker.ietf.org/doc/html/rfc1035
  3. [3]IETFPrimary SpecificationRFC 8484 • Section 3 & 4
    Verified Primary Source
    RFC 8484: DNS Queries over HTTPS (DoH)
    Technical Claim Supported:

    Standardizes encrypted DNS query transmission inside HTTP/2 and HTTP/3 HTTPS streams to prevent ISP eavesdropping and on-path manipulation.

    Source URI: https://datatracker.ietf.org/doc/html/rfc8484
Semantic Internal Links (GEO)

관련 기술 생태계 및 다음 학습 단계

Context: DNS & Internet Name Resolution

추천 관련 개발자 도구

100% 브라우저 메모리 실행
100% Client-Side→

DNS Lookup & Propagation Tool

Query A, AAAA, CNAME, MX, TXT, and CAA records across global recursive resolvers.

RDAP Standard→

WHOIS & RDAP Domain Intelligence

Inspect domain registration, authoritative nameservers, and expiration dates.

관련 기술 아티클

아키텍처 정의
Comparison→

DNS vs DNS-over-HTTPS (DoH): Privacy & Security

Traditional UDP port 53 lookups compared to encrypted TLS-encapsulated DoH queries.

Troubleshooting→

Troubleshooting: DNS Returns NXDOMAIN Error

Diagnose missing records, propagation lag, and nameserver delegation failures.

관련 기술 질문

직접 답변 (AEO 핵심 요약)
Q&A

What Happens When a DNS TTL Expires?

→

Answer: When a DNS TTL expires, caching resolvers evict the record and must re-query the authoritative nameserver before responding to clients.

Q&A

Can a CNAME Record Point to an IP Address?

→

Answer: No, RFC 1034 requires CNAME records to point exclusively to another domain name, never to raw IPv4 or IPv6 addresses.

Q&A

Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?

→

Answer: RFC 1034 requires that if a CNAME exists at a node, no other record data may exist there. Since a zone apex must have SOA and NS records, CNAME is prohibited.

개발자 표준 규격 및 레퍼런스

빠른 조회 매트릭스 표
RFC 1035→

DNS Resource Records Reference Matrix

Specifications and parameters for A, AAAA, CNAME, MX, TXT, SRV, CAA, and PTR records.

RFC 6895→

DNS Response Codes (RCODEs) Reference

NOERROR, NXDOMAIN, SERVFAIL, REFUSED, and FORMERR error handling.

토픽 아키텍처 클러스터 탐색 →

다음 학습 단계

DNS Specs → Recursive Query Lab
엔지니어링 권장안

DNS Resolution & Propagation Lab

Trace authoritative resolution from the root servers down to the zone file in the visual DNS workbench.

다음 실습으로 이동 →DNS Topic Architecture Cluster→