(upbeat music)
- Hi, I'm Chukwuemeka, a Cloud Support Engineer
here at AWS office in Cape Town.
Sometimes, customers ask me how DNS works,
and how they can troubleshoot partial DNS failures
when using AWS services.
I tell them this can be done using available
online tools and the command line interface.
Let's start with a brief introduction of how DNS works.
The Domain Name System is built using
a distributed architecture.
When the host needs to resolve the IP address
of a domain name,
the host device hands over this process to a DNS server.
The DNS server finds the IP address of the domain name
and returns it back to the host.
Let me walk you through the process of a simple DNS query.
When a customer is trying to resolve the DNS record
Amazon.com this happens.
First the host sends the requested DNS query
to the local DNS server.
Second DNS server which is pre-configured
with the list of root name servers
randomly selects one of these route name servers
and sends an interactive DNS query
for the record Amazom.com.
Third the root name server responds with a list
of authoritative name servers for the dot com zone
as well as the IP addresses.
Fourth the DNS server randomly selects
one of the main returned in step three
and send another DNS query for the record Amazon.com.
Fifth the top level domain name server
responds with a list of name servers
that are authoritative for the domain Amazon.com.
Sixth the DNS server randomly selects
one the authoritative name servers returned in step five
and sends another DNS query for Amazon.com.
Seventh since the name server receiving
the query in step six is authoritative for the domain
Amazon.com the name server responds to the DNS server
with the value of the record Amazon.com
which is an IP address.
Finally the DNS server send this DNS response to the host.
Let me walk you though the process
of troubleshooting common DNS issues.
For example a customer just transferred the domain
"awskcvideos.com" to Route53 and cannot resolve records
in their hosted zone after completing the transfer.
For DNS records to resolve properly after transferring
or registering a domain on Route53,
the Route53 name servers on your hosted zone
needs to match the name servers
on the Registered Domain sectio on the Route53 console.
Here's how you verify this.
After you sing an AWS management console,
navigate to the Amazon Route53 console.
[Upbeat Music]
In the navigation pane choose Registered Domains.
Click the desired domain name.
Take note of the four nameservers.
In the navigation pane choose hosted zone.
Go ahead and click the domain name.
Take not of the four name servers in the hosted zone.
Verify the name servers listed in both sections marked.
In this case the customer with domain
"awskcvideos.com" will not be able to resolve any record
in their hosted zone.
The solution is to update the nameservers
in the registered domain section
with the nameservers in their Route53 hosted zone.
Sometimes customers receive DNS errors
when trying to resolve records in their hosted zone.
To show you this I'm going to open a terminal window.
To troubleshoot this using the command line interface
on a line of start operating system.
Type "dig" and the name of the record.
The Dig application performs a DNS lookup
for the record specified.
The status section shows the DNS responds error code.
An annex domain response mean the record
or domain does not exist.
Check the hosted zone to verify the record was created
properly and the correct nameservers
are referenced on the top level domain.
When using the Windows operating systems,
you can use online tool digwebinterface.com
to perform this task.
Now that we are at the Digwebinterface.com webpage,
I'm going to typ the record name here.
Click start and then click dig.
Again the status section shows the DNS response error code.
Other common DNS errors include SERVFAIL and REFUSED.
A SERVFAIL DNS response indicates the DNS server
was unable to process this query
due to a problem with the authoritative nameserver.
A SERVFAIL response is also a common response
for certain DNSSEC validations that are unsuccessful.
To fix this, verify the DNS service provider supports DNSSEC
and the authoritative nameserver
on the Registered Domain section are reachable
and valid for the domain.
A REFUSED response indicates the nameserver
is not authoritative for that domain,
meaning it does not have the records
for that domain in its zone file.
To fix this, verify the correct nameservers
in the hosted zone updated on the Registered Domain section
of the Route53 console.
That sums it up for troubleshooting common DNS issues.
Thanks for watching and happy Cloud Computing
from all of us here at AWS.
[Upbeat Music]