There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Why is DNS often joked about in the I.T. Industry?

I should clarify I wasn’t a upper level sys admin managing those servers, I just used them or maintained accounts being a rank and file technician

While I get the fundamental concept of DNS as a phonebook for your IPs. I am not sure why it is joked around if something goes haywire or someone breaks something.

Is it because if you get no DNS, people can’t log in through their AD accounts, browse the Internet?

Afaik DNS is a bit of a rabbit hole topic, maybe that’s why people joke about it due to DNS being this “No one really knows how this magic name matching box works”?

Please correct me, I’d genuinely like to know why this is prevalent from you guys.

some_guy ,

Sorry this doesn’t explain anything, cause I think others have already put in the work. At my old job, there was a slack icon for “Is it DNS?” because it’s often DNS. You already know and that’s why you asked, but I’m just reinforcing that this is how common it is.

kobra ,

There’s even a haiku:

It’s not DNS
There’s no way it’s DNS
It was DNS

scsi ,

In addition to the other comments which more directly address your question, DNS has been / can be used to exfiltrate data from “secure” networks. Search “dns data exfiltration” in your favourite search engine and you’ll get several high quality articles. Typical mitigations might be to limit which DNS servers your network can contact, restrict packet sizes to the bare minimum which valid use would have and so forth.

brygphilomena ,

Because so few understand it and so many things use it.

If you read a guide on setting up a website. They might have you change a DNS record and you might not realize it’s doing something else. Web developers frequently want to make changes to DNS and will change the name servers away to theirs but not migrate any of the records for anything besides the website. They’ll break EVERYTHING but hey, the website will load.

If you read a guide on connecting some service like hubspot. They will have you add spf records. But those need to be included with the existing ones and not just replacing what’s already there. Mess it up and every single email you send will get sent to spam folders.

dreugeworst ,

clueless dev who very rarely touches web apps here, what things would break if you dont touch other records besides those for tour website?

brygphilomena ,

A records are usually fine for web dev, and some cname records. But if you move DNS to different name servers it doesn’t take the MX, srv, or txt with you.

Name servers are where all the DNS records are hosted. It tells every computer who is the authority on the information. If you change those without moving all the DNS records to the new location. All the old ones are no longer used at all. Even if they still exist on the old system.

Also spf records might also reference the websites a record to allow the website to send email without getting flagged as spam. If the site moves, but emails are still sent from the old IP address for a myriad of reasons it would break email. Like if they used some provider that hosted the site and emails on the same system, which used to be more common than it is today.

Nougat , (edited )

I can speak to Windows DNS and AD.

Yes, the basis of DNS is to match IP addresses with hostnames. But there are plenty of other kinds of DNS records. SPF, DKIM, DMARC use DNS for email validation; AD uses SRV records to point clients to find domain resources. There are also reverse zones, where you send a query for an IP address to learn the hostname(s) associated with it. There are CNAME records that associate a hostname with whatever IP address another hostname is using.

Point being, there are a lot of different interconnected layers, and if some entry is wrong, it can easily have a cascading effect that creates a problem with something entirely different.

I would also extend the "It's always DNS" trope to "It's always name resolution." In a Windows environment, at least, DNS name resolution is only used when a FQDN (fully qualified domain name) is being queried. If your application is only looking for [ServerName], NetBIOS name resolution is used.

When NetBIOS name resolution is used, that is querying a WINS server (if one is specified and exists). In the absence of a WINS server, the query is sent to the "master browser" on your network segment. What machine is the "master browser"? By default, all machines on a network segment (subnet) have a browser election behind the scenes to choose the master browser, based in large part on the machines' hardware capabilities.

This means that any machine on the segment (again, by default) can become the master browser and respond to NetBIOS queries. Laptop, desktop, server, doesn't matter. There are registry entries that can be manipulated to have manual control over what machine is master browser, what machines are and are not allowed to participate in elections, but it is rare that those are configured.

Why do I know all this? Because about 25 years ago, I came across a situation where different machines were configured with different overlapping subnet masks, and users were trying to browse \servername\share, and getting only partial results. It took a long time to narrow that down to the misconfigured subnet masks. At the company I'm currently at, the developers still use NetBIOS names instead of FQDNs in applications.

Always use FQDNs in any in-house development. Always use FQDNs when accessing resources by hostname. And if "some weird, inexplicable, possibly intermittent issue" is happening, check name resolution.

Shadow ,
@Shadow@lemmy.ca avatar

100% of the internet depends on it, and 90% of technical people can’t be bothered to learn how it works and understand it. Partly because they only touch it once every 5 years. They get what they need done but don’t understand why it worked, so it ends up feeling like black magic to them.

skullgiver ,
@skullgiver@popplesburger.hilciferous.nl avatar

The worst part isn’t even that they don’t understand it, but that they think they know everything about it after learning the basics. Suddenly you get people blocking port 53/udp “because DNS uses UDP” and people using .dev and .local as internal domain names.

Still not as misunderstood as NTP, though.

hendrik ,

What's an example of a joke? Because that's not what I experienced... In my world people make similar jokes if you mess up any aspect of networking. Same if you break the routing. Or mess up the servers, replication or virtualization infrastructure. DNS is one aspect and people will crack a similar amount of jokes as they do with any other f...-up. (It's a way to cope with a stressful day or whatever. Or to get some relief.)

domi ,
@domi@lemmy.secnd.me avatar

There’s the famous DNS haiku: i.imgur.com/eAwdKEC.png

tiny ,

When it is the cause of a problem it’s not always obvious at first so you spend hours troubleshooting the broken app until you look at DNS and a simple DNS issue

Landless2029 ,

Often because we know how badly things can go wrong with so many components we start at the end of the app instead of the beginning.

Similar to how tech support always asks of you rebooted. We often don’t confirm basic connectivity issues.

qaz ,

I’ve had a problem like this yesterday. I couldn’t access my paperless instance. I eventually figured out I could access it with an IP + port combination and the DNS lookup failed.

xmunk ,

Because it’s a fucking unauthoritative clown show that is necessarily decentralized which leads to all sorts of difficult to diagnose (and sometimes impossible to quickly fix) issues.

It’s like 100% footguns.

JustARegularNerd ,

Only a support tech chiming in, so far I’ve found when it goes wrong, it causes errors or behaviours that are unusual and could be hard to trace back. Clients might be confused as to why their laptop isn’t connecting to some services but their co-worker still can.

I’ve currently got an infuriating issue where the DNS on my modem just dies at seemingly random intervals. I set up a monitor using Uptime Kuma to let me know when it goes down, and ever since it just hasn’t been a problem yet so I have no idea why it’s going down. I might just set up a pihole and just work around the problem.

dbx12 ,

Might be related to long TTL on DNS entries making it hard to connect one failure to a thing you changed days ago.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •