DNS in Depth

DNS translates names into addresses. It is also one of the most common causes of outages, because changes are cached all over the internet.

How resolution works

1. Your computer asks a recursive resolver (your ISP, 1.1.1.1 or 8.8.8.8).
2. If it has no cached answer, the resolver asks a root server, which points to the .com servers.
3. The .com servers point to the domain's authoritative nameservers (for example Cloudflare).
4. The authoritative server gives the answer, and the resolver caches it for the record's TTL.

Record types

A CNAME cannot sit at the root (@) of a domain alongside other records. Providers solve this with "ALIAS", "ANAME" or "CNAME flattening".

TTL and propagation

TTL is how long resolvers may cache an answer, in seconds. Before a planned migration, lower the TTL to 300 a day ahead, make the change, then raise it again. "DNS propagation" is just caches expiring.

dig: the DNS tool

dig pandadevhub.com              # A record
dig +short pandadevhub.com AAAA
dig pandadevhub.com MX
dig TXT _dmarc.pandadevhub.com
dig @1.1.1.1 pandadevhub.com     # ask a specific resolver
dig +trace pandadevhub.com       # follow the whole chain from the root
dig pandadevhub.com NS

If dig @<authoritative-nameserver> shows the new value but dig @1.1.1.1 shows the old one, you are waiting for caches to expire, not facing a misconfiguration.

Common DNS mistakes

• Editing records at the registrar while the domain actually uses Cloudflare's nameservers (check NS first).
• A trailing typo in a CNAME target.
• Two SPF TXT records (there must be only one; merge them).
• Forgetting www or the apex when moving hosts.

Local overrides

/etc/hosts (or C:\Windows\System32\drivers\etc\hosts) overrides DNS on one machine. It is handy for testing a new server before switching DNS, and a classic cause of "it works only on my laptop".

Check yourself

• Why lower a TTL before a migration?
• Which records does email authentication use?
• How do you tell propagation delay from a wrong record?