Before DNS, every computer on the ARPANET found every other computer in one text file.
One file for the whole network
The Network Information Center (NIC) at SRI kept a file called HOSTS.TXT: one line per host, with its name and address. Every site downloaded a fresh copy from time to time. When the network had a few hundred hosts this worked. As it grew, the file changed faster than sites could copy it, names collided, and one office had to approve every change.
1983: the Domain Name System
In November 1983 Paul Mockapetris published RFC 882 and RFC 883, which described a new system with three ideas that still hold today:
- A tree of names. Names read right to left, from the root down:
www.example.com. - Delegation. Each part of the tree is run by whoever owns it. The root only needs to know who runs
.com, and.comonly needs to know who runsexample.com. - Caching. Resolvers keep answers for a time (the TTL), so the top of the tree is not asked every time.
RFC 1034 and RFC 1035 replaced them in November 1987 and are still the core specification. At Berkeley, students wrote BIND, which became the most used DNS server for decades.
1985: the first domains
The first generic top-level domains went live in 1985: .com, .org, .net, .edu, .gov and .mil, next to .arpa. The first .com name, symbolics.com, was registered on 15 March 1985. Country codes such as .uk, .us and .in were added from the ISO 3166 two-letter list. See domain extensions.
1998: ICANN
For years Jon Postel at IANA kept the root zone, largely by hand. In 1998 ICANN was formed to coordinate the root zone, the top-level domains and the rules for registrars. Since 2016 the IANA functions run without US government oversight.
The root itself is served by 13 named root server identities, a to m.root-servers.net, run by 12 organisations. With anycast, each name is answered by many machines around the world, well over a thousand in total.
DNS had no locks
DNS was designed for a small network of people who trusted each other. Answers have no signature: a resolver accepts the first reply that looks right. In 2008 Dan Kaminsky showed how an attacker could poison a resolver's cache in seconds by racing the real server with forged replies. Resolvers added random source ports as a quick fix, and the push to deploy DNSSEC became urgent.
The long road to DNSSEC
| Year | What happened |
|---|---|
| 1997 | First DNSSEC specification, RFC 2065. |
| 2005 | The design used today, RFC 4033, 4034 and 4035. .se is the first top-level domain to sign. |
| 2009 | .org is the first generic top-level domain to sign. |
| 2010 | The root zone is signed on 15 July 2010. Validators now have one trust anchor for the whole tree. |
| 2011 | .com is signed. |
| 2018 | First rollover of the root key (KSK-2017). See KSK, ZSK and rollover. |
Today almost every top-level domain is signed (94% of them, from our weekly check), but most domain names below them are not. That is the gap our checker shows.