🌐 Networking & Transport BEGINNER ⏱️ 20 min study

DNS Resolution Mechanics and the Modern TLS 1.3 Handshake

Master System Design, Distributed Systems, High-Level Design, Low-Level Design, and AI Architecture from first principles.

Concepts: #dns#anycast#tls#cryptography#certificates#sni#session-resumption
Not Started

DNS Resolution and TLS 1.3 Cryptography

When a user opens a web browser and types https://api.example.com/checkout, two critical infrastructure handshakes occur before any application byte is transmitted:

  1. Domain Name System (DNS) Resolution: Translating human-readable domain names into routable IPv4/IPv6 addresses.
  2. Transport Layer Security (TLS 1.3) Handshake: Establishing mutual authentication and encrypted symmetric session keys.

1. The Hierarchical DNS Resolution Pipeline

DNS is the largest, most resilient distributed hierarchical database on earth. It delegates authority through a tree structure:

                  Root Nameservers (.)
                  [13 logical addresses, Anycast worldwide]
                           │
                           ▼
                  Top-Level Domain (TLD) Nameservers (.com, .io, .org)
                  [Managed by registries like Verisign]
                           │
                           ▼
                  Authoritative Nameservers (ns1.example.com)
                  [Managed by Cloudflare, Route 53, or self-hosted]

Step-by-Step Resolution Flow

User Browser
    │  (1. Check OS Cache / /etc/hosts)
    ▼
Recursive Resolver (ISP or 1.1.1.1 / 8.8.8.8)
    │
    ├── (2. Query Root ".") ──────────► Root Server returns TLD IP for ".com"
    │
    ├── (3. Query TLD ".com") ────────► TLD Server returns Authoritative NS for "example.com"
    │
    └── (4. Query Authoritative NS) ──► Authoritative returns "93.184.216.34" (TTL: 300s)

DNS Architectural Patterns

  • Time To Live (TTL): Controls how long recursive resolvers and client operating systems can cache the DNS record. High TTLs (e.g., 86,400s) improve latency and reduce resolver load, but prevent rapid failover during catastrophic datacenter outages. Low TTLs (e.g., 60s) allow real-time traffic switching at the cost of higher query latency.
  • Anycast Routing: Multiple physical servers distributed globally announce the exact same IP address via BGP (Border Gateway Protocol). The internet’s routers naturally route client queries to the topologically closest server, providing instant latency optimization and distributed DDoS absorption.
  • DNS-Based Load Balancing: An authoritative nameserver can return rotating lists of IP addresses (Round-Robin DNS) or resolve users to the closest datacenter based on client IP geolocation (GeoDNS).

2. The TLS 1.3 Cryptographic Handshake

In legacy TLS 1.2, negotiating encryption required 2 full RTTs (ClientHello, ServerHello + Certificate, ClientKeyExchange, Finished).

TLS 1.3 radically simplified the handshake down to 1 RTT (or 0 RTT for repeat visits), while eliminating obsolete, insecure cryptographic ciphers (such as RSA key transport, RC4, and SHA-1).

The TLS 1.3 1-RTT Handshake Flow

Client                                                         Server
  │                                                               │
  │── 1. ClientHello ────────────────────────────────────────────►│
  │      • Supported Cipher Suites (e.g., TLS_AES_256_GCM_SHA384) │
  │      • Key Share (Client's Ephemeral Diffie-Hellman public key)│
  │      • Server Name Indication (SNI)                           │
  │                                                               │
  │◄─ 2. ServerHello ─────────────────────────────────────────────│
  │      • Chosen Cipher Suite                                    │
  │      • Server's Key Share (Server's Ephemeral Diffie-Hellman) │
  │      • [Encrypted Extensions]                                 │
  │      • [Encrypted Certificate]                                │
  │      • [Encrypted CertificateVerify (Signature)]              │
  │      • [Encrypted Finished]                                   │
  │                                                               │
  │==== Symmetric Encryption Established (Shared Master Key) =====│
  │                                                               │
  │── 3. [Encrypted Finished] + HTTP GET Request ────────────────►│
  │                                                               │
  │◄─ 4. [Encrypted HTTP 200 OK Response] ────────────────────────│

Why TLS 1.3 is an Architectural Breakthrough

  1. Zero-RTT Resumption (0-RTT): If a client has previously connected to the server, it can transmit early application data (such as an idempotent GET request) inside the initial ClientHello packet using a pre-shared key ticket, achieving true 0-RTT latency!
  2. Mandatory Perfect Forward Secrecy (PFS): Keys are negotiated exclusively using Ephemeral Diffie-Hellman (ECDHE). Even if an attacker records all encrypted internet traffic today and steals the server’s private SSL certificate 5 years from now, they cannot decrypt historical traffic because ephemeral session keys were discarded immediately after each session.
  3. Encrypted Certificates: In TLS 1.3, the server’s certificate is transmitted after the initial key exchange is calculated, keeping domain identities and certificates encrypted from eavesdropping network middleboxes.