DNS

Resolve a name through whichever resolver the system is configured to use, and confirm what each layer of the resolver chain returns. getent hosts honors NSS; dig queries directly; resolvectl reports systemd-resolved’s view.

Header

A DNS message starts with a 12-byte fixed header, then a Question section and (in responses) Answer, Authority, and Additional sections. The transaction ID in the first two bytes lets the client match a reply to its query when many are in flight over the same socket.

        packet-beta
    title DNS Message Header
    0-15: "Transaction ID"
    16: "QR"
    17-20: "Opcode"
    21: "AA"
    22: "TC"
    23: "RD"
    24: "RA"
    25-27: "Z / AD / CD"
    28-31: "RCODE"
    32-47: "QDCOUNT"
    48-63: "ANCOUNT"
    64-79: "NSCOUNT"
    80-95: "ARCOUNT"
    

Resolver chain

        sequenceDiagram
    participant App as app
    participant NSS
    participant Hosts as /etc/hosts
    participant SR as systemd-resolved<br/>(cache + stub)
    participant Up as upstream<br/>recursive
    participant Auth as authoritative

    App->>NSS: gethostbyname()
    NSS->>Hosts: files first
    alt hit
        Hosts-->>NSS: address
    else miss
        NSS->>SR: dns lookup
        alt cache hit
            SR-->>NSS: cached A / AAAA
        else cache miss
            SR->>Up: recursive query
            Up->>Auth: authoritative query
            Auth-->>Up: A / AAAA
            Up-->>SR: A / AAAA
            SR-->>NSS: A / AAAA
        end
    end
    NSS-->>App: A / AAAA records
    

• getent hosts exercises the NSS path.

• dig bypasses NSS and queries DNS directly.

$ getent hosts example.com
$ dig example.com
$ dig +short example.com AAAA
$ dig @8.8.8.8 example.com
$ resolvectl status