/etc/hosts and DNS Resolv: Navigating by Name

As we discussed in the previous lesson, computers talk to each other using IP addresses (numbers), but humans use domain names. The process of turning a name like shshell.com into an IP is called Resolution.

In Linux, your system doesn't just ask the internet for every name. It has a local "Cheat Sheet" and a "Contact Card" for its preferred DNS servers. If you understand these files, you can speed up your system, block malicious websites, and even "fake" a website's location for development purposes.

In this lesson, we will master the two pillars of Linux name resolution.

1. /etc/hosts: The Local Cheat Sheet

Before your computer asks a DNS server on the internet, it looks at the /etc/hosts file. It is a simple text file that maps IP addresses to hostnames.

The Format:

IP_ADDRESS HOSTNAME ALIASES

127.0.0.1       localhost
192.168.1.100   fileserver.local   fs

Why use /etc/hosts?

Speed: It's instantaneous. No network packets are sent.
Local Networking: If you have two servers in your basement, you can name them pi-1 and pi-2 without needing a complex DNS server.
Development (Redirection): You can redirect google.com to 127.0.0.1 to prevent your computer from talking to the internet during an experiment.

2. /etc/resolv.conf: The Resolver Config

If the name is not in /etc/hosts, Linux looks at /etc/resolv.conf to find out who to ask.

Key Directives:

nameserver: The IP address of a DNS server (e.g., 8.8.8.8).
search: A list of domains to try automatically (e.g., if you type ping server, it might try ping server.mycompany.com).

nameserver 1.1.1.1
nameserver 8.8.4.4
search internal.shshell.com

The "systemd-resolved" Warning:

On modern Ubuntu and Fedora, /etc/resolv.conf is actually a symlink to a file managed by systemd-resolved. If you edit it manually, your changes might be overwritten! You should instead use netplan or NetworkManager to set your DNS.

3. The Order of Operations: nsswitch.conf

How does Linux know to look at hosts first and then dns? This is defined in /etc/nsswitch.conf.

# Look for 'hosts' line
hosts:          files dns

This tells the system: "Check the local files first, then check DNS."

4. Practical: Using /etc/hosts for Web Development

Suppose you are building a new website for myserver.com. It's not live yet, but you have it running on a server at 3.45.67.89. You want to see how it looks in your browser as if it were live.

Edit your local machine's /etc/hosts:
```
sudo nano /etc/hosts
```
Add this line:
```
3.45.67.89   myserver.com
```
Now, when you visit myserver.com in your browser, your computer goes directly to your server, bypassing the real internet DNS.

5. Identifying DNS Latency

Sometimes the internet is fast, but websites take 5 seconds to start loading. This is usually DNS Latency.

# Time how long it takes to resolve a name
time dig +short google.com

If this takes more than 100ms, your DNS server is slow. Try switching to Cloudflare (1.1.1.1) or Google (8.8.8.8).

6. Example: A DNS Health Checker (Python)

If your office network is flaky, you need to know if the problem is the ISP or the DNS provider. Here is a Python script that compares the resolution speeds of multiple DNS servers.

import socket
import time

def test_resolver_speed(hostname, dns_ip=None):
    """
    Measures how long it takes to resolve a hostname.
    """
    # Note: socket.gethostbyname uses the system's default resolver.
    # For a true multi-server test, you'd use the 'dnspython' library.
    
    start = time.time()
    try:
        ip = socket.gethostbyname(hostname)
        end = time.time()
        print(f"Resolved {hostname} to {ip} in {(end - start) * 1000:.2f} ms")
        return True
    except socket.gaierror:
        print(f"Failed to resolve {hostname}")
        return False

if __name__ == "__main__":
    targets = ["google.com", "github.com", "linux.org"]
    print("Performing DNS Latency Test...")
    print("-" * 40)
    for t in targets:
        test_resolver_speed(t)

7. Professional Tip: Use 'localhost' for Security

If you are running a database (like MySQL) on your server, you should configure it to only listen on 127.0.0.1 (localhost). This means no one from the internet can even try to connect to it, because the computer only accepts connections from itself.

8. Summary

Resolution is the first step of every internet interaction.

/etc/hosts is for local overrides and shortcuts.
/etc/resolv.conf tells the system which external experts to ask.
/etc/nsswitch.conf decides the order of lookups.
DNS Latency is often the cause of "slow internet" on a fast server.

In the next lesson, we will move from IP addresses to Port Management—how computers separate traffic for different apps using netstat and ss.

Quiz Questions

Why is it a bad idea to put 10,000 entries into your /etc/hosts file?
What does the nameserver directive in /etc/resolv.conf do?
How can you "fake" a domain name for testing purposes on your local machine?

Continue to Lesson 4: Port Management—netstat and ss.

The Digital Phonebook: /etc/hosts and DNS Resolv