Visual Learning · 02 · Live
DNS Resolution
Browser → Resolver → Root → TLD → Auth — recursive lookup to an IP.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
DNS Resolution
Lab DNS only — no public amplification.
Real world · Typing a URL triggers recursive DNS before any TCP/TLS — ISPs and corporate resolvers do this millions of times per second.
Attack · DNS spoofing / cache poisoning can redirect users to malicious IPs (see later attack modules).
Defense · DNSSEC, encrypted DNS (DoH/DoT), and pinned resolvers reduce tampering risk.
- Control · Prefer authenticated recursive resolvers
- Control · Short TTLs for critical records during incident response
- Control · Monitor unexpected NXDOMAIN / sudden IP changes
1. Query
Browserstub
Resolverrecursive
Root.
TLD.com
Auth NSzone
Query
Stub asks the recursive resolver for www.lab.example A (RD=1).
A?
- #1 browser → resolver Query A?
Space · ← → · R restart