How is a subdomain passed to the webserver?

Question

I know that dns resolves an address like example.com to an IP address like 11.22.33.44, but I'm a little confused about how subdomains are resolved, so that when you type http://subdomain.example.com, what actually gets passed to the server at 11.22.33.44? In other words, example.com = 11.22.33.44, but subdomain.example.com/path = ???

Are "subdomain" and "path" passed as http headers, or mapped in the url in some way, or what?

Thanks in advance.

Edit: If I'm understanding correctly, BloodPhilia says that subdomain.example.com actually is a different domain that in principle could resolve to a totally different IP. But if that's so, then what about hosts that have huge numbers of (what look like) subdomains, but which actually map to some path on the site. For instance, blogspot hosts millions of blogs, and they all look like this:

aaa.blogspot.com
bbb.blogspot.com
...millions more...
yyy.blogspot.com
zzz.blogspot.com

Those are clearly not subdomains with their own IP's, but rather some mapping like aaa.blogspot.com --> www.blogspot.com/aaa, but how is this accomplished? What actually gets passed to the web server at blogspot.com?

Solution 1

Domains, Subdomains, Sub-Sub domains, and Sub(x)-sub-subdomains (made the last two up!), are treated in exactly the same way by DNS to an end user and a webserver.

For example, the DNS server can return different results for domain.com, www.domain.com or mysite.domain.com.

Now, as you are probably aware, there are many more domains than IPs in the world.

Because of this, servers use something known as "Host Headers" in order to serve the correct content.

It does not matter what you actually request, your machine treats everything the same - it will looks up on DNS what IP it should connect to, and once connected, it will send the host header as part of the request. The webserver then sends back the content it was configured to send back.

A good tool for testing/learning/diagnosis is Wfetch, it can be downloaded here.

Here is an example of the headers sent whilst accessing superuser.com

Here is the configuation for host headers in IIS (a webserver):

(Image from here)

If you were interested, Serverfault.com and Superuser.com are on the same IP and this is the technique that is used in order to separate the sites and serve different content.

For more reading on the subject, you may want to read the Wikipedia article on Virtual Hosting.

(I know you understand the basics, but I thought it would be good to say a little more so that anyone Google-ing this may learn a little if they want to!)

Edit

So, As per your example, I would guess that someone as big as blogspot most likely has a wildcard DNS entry (A wildcard entry returns the same result for any query) that points to a load balancer, the load balancer then will send it out to many different webservers who probably do not have a separate site per host header, but instead a single site/script that the address typed (host headers or not) gets parsed on, and pulls the correct content from their CDN there and then.

Although, it would also be possible (but unlikely) that they simply have a few thousand entries per ip, the ip leads to a few servers and they simply have an entry for each site that has a matching host header.

Solution 2

Indeed, if two domains have the same IP address, the server relies on the browser to specify the requested domain. Like:

GET / HTTP/1.1
Host: data.stackexchange.com

Solution 3

Subdomains isn't the right word. Usually a subdomain is domain on its own so sub.example.com is passed to the DNS first, if no specific record is found for this subdomain, the request is passed to the IP of the top domain. (example.com) On that server the request is made again and the server will act accordingly.

In other words, a request to example.com doesn't really differ from a request to sub.example.com.

Solution 4

Subdomain.example.com doesn't resolve to 11.22.33.44 - for the purpose of your question it typically has it's own DNS A record and resolves to a different address.

It is possible to allow the subdomain resolve to the same address as the parent domain and still server up different pages, but if you do that you must host both sites on the same web server and need account for it on your server's configuration. The way you account for this depends on what kind of web server you're running.

View more solutions

Comments

[Joshua Frank]

I think maybe I am not understanding something important here. Let me edit and clarify my question. Thanks.

[Joshua Frank]

Are you saying that, in my blogspot example, "xyz.blogspot.com" will have no dedicated dns entry, so dns will look for "blogspot.com" and find it at 11.22.33.44. But it will send the whole url "xyz.blogspot.com" as the host field, and it's up to the server to parse this and send the xyz page to the browser?

[Arjan]

Nice! Side note: the fact that two websites share an IP address does not necessarily mean they are always hosted on the same machine. A load balancer might in fact also peek into these headers and delegate to different machines. (For Super User et al see also Stack Overflow’s New York Data Center, which I did not really read myself though...)

[William Hilsum]

@Arjan +1 good point... I mentioned load balancers, but it could obviously just be the IP(s) of a load balancer(s), and then they split the requests to many servers.

[Joel Coehoorn]

Yes, that's right.

[Arjan]

nslookup dummy.example.com yields server can't find dummy.example.com — how does that match the above then? (As for the example in @Joshua's comment?)

[Joel Coehoorn]

sorry, you still need an A record for your subdomain - it's just that it can give the same IP if you want.

[Joshua Frank]

Then I'm confused again. If there are millions of xyz.blogspot.com subdomains, they can't all have A records, so how is the routing accomplished? And the A record configuration is server side. I'm interested in how the client would know, given a url, whether the xyz is a proper subdomain or something that's mapped server side. In particular, is it ever safe to cache an IP for a little while, because you know that x.domain.com and y.domain.com are on the same server, or can you never know just by looking at the url?

[Joel Coehoorn]

@Joshua - blogspot is google, and they do all have A records.