LFCA 44 🐧 What DNS Does
Every time a browser opens a website, a mail client sends a message, or a command reaches a server by name, the system translates a human-friendly name — example.com, mail.google.com, api.github.com — into an IP address. That translation is the Domain Name System, the DNS. It is the phone book of the internet, and it is the service that makes names work. Without it, every connection would need the address typed by hand, and the change of an address would require every client to be updated. The DNS decouples the name from the address, and the decoupling is what makes the internet’s growth and the address’s change manageable. This chapter covers what the DNS does, the resolution process, the record types, the caching, the hierarchy, the recursive and authoritative servers, the tools — dig, nslookup, host, resolvectl — and the failure modes that make the name resolution break.
Key point: The DNS translates domain names into IP addresses. The resolution is recursive on the client side — the client asks the resolver, the resolver asks the root, the TLD, and the authoritative servers, and the answer comes back. The answer is cached at each level, with the TTL (time to live) deciding how long. The record types — A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV — describe the different kinds of DNS data. The /etc/resolv.conf (or systemd-resolved) declares the resolver, and dig and nslookup are the query tools. The whole system is a distributed, hierarchical database with no single owner — the root delegates to the TLD, and the TLD delegates to the domain.
Why the DNS exists
The IP address is the network’s addressing, and it is the number. The human remembers the names, not the numbers. The DNS is the bridge between the two, and it is the reason the names work.
The problem the DNS solves. A network with only IP addresses would require everyone to remember the numbers, and the addresses change. A web server that moves to a new address would need every client updated. The DNS decouples the name from the address, so the name stays and the address changes.
The hierarchy. The DNS is a distributed database, and it is a hierarchy. The root is the top, the TLD (.com, .org, .no) is the next, and the domain (example.com) is the next. Each level is the authority’s, and the delegation is the chain.
The delegation. The root delegates to the TLD, and the TLD delegates to the domain. The delegation is the NS records, and the chain is the resolution. The distributed design is the scalability, and the hierarchy is the organization.
Why the DNS is distributed. The DNS has no single server with all the names. The names are distributed across authorities, and each authority is responsible for its zone. The distribution is the resilience, and the hierarchy is the model.
Why the DNS uses caching. The resolution is expensive, and the cache is the efficiency. The resolver caches the answer for the TTL, and subsequent queries are fast. The cache is the performance, and the TTL is the balance.
Why the DNS is public. The DNS is a public database, and the queries are public. The names are public, and the addresses are public. Privacy is a modern concern, and DoH (DNS over HTTPS) and DoT (DNS over TLS) are the answers.
Why the DNS matters for diagnosis. DNS failure is the common cause of the “the internet is down” symptom. The ping to the IP works, and the ping to the name fails. The DNS is the suspect, and dig is the test.
Why the DNS is the internet’s directory. The DNS is the directory that maps names to addresses, and it is the infrastructure that other services rely on. The email’s
MXrecords, the web’sArecords, the verification’sTXTrecords — the DNS is the source. The DNS is foundational, and the foundational is critical.
The resolution process
The resolution is the process of finding the IP address for a name. It has two modes: recursive and iterative, and the combination is the common.
The client’s query. The client asks its resolver — the one in /etc/resolv.conf — for the name’s address. The query is recursive, and the client expects the final answer.
The resolver’s query. The resolver asks the root servers, which respond with the TLD’s servers. The resolver asks the TLD’s servers, which respond with the domain’s servers. The resolver asks the domain’s servers, which respond with the answer. The resolver’s queries are iterative, and the resolver follows the delegation.
The answer. The authoritative server responds with the address, and the resolver caches the answer for the TTL. The resolver returns the answer to the client, and the client caches it too.
Why the two modes. The client’s query is recursive (the resolver does the work), and the resolver’s queries are iterative (the resolver follows the chain). The two are the division of labor, and the resolver is the agent.
Why the root is first. The root servers are 13 logical (hundreds of physical). The root responds with the TLD’s servers, and the TLD is next. The root is the entry, and the TLD is the level.
Why the TLD is second. The TLD’s servers respond with the domain’s servers, and the domain is next. The .com is the TLD, and the example.com is the domain. The TLD is the level, and the domain is the authority.
Why the authoritative is last. The domain’s servers are authoritative, and they have the answer. The authoritative is the source, and the answer is the truth. The authoritative’s TTL is the cache’s limit, and the resolver’s cache is the performance.
Why caching has layers. The client caches, the resolver caches, and intermediate caches. The cache is the performance, and the TTL is the balance. A short TTL is dynamic, and a long TTL is stable.
Why the first query is slow. The first query is slow (the full chain), and subsequent queries are fast (the cache). dig shows the query time, and +stats is the detail. The cache is the reason, and the first is the anomaly.
The record types
The DNS has record types, and each has a specific purpose. The A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, and SRV are the common ones.
The A record. The A maps the name to the IPv4 address.
dig example.com A
# example.com. 3600 IN A 93.184.216.34The 93.184.216.34 is the IPv4, and the 3600 is the TTL.
The AAAA record. The AAAA maps the name to the IPv6 address.
dig example.com AAAA
# example.com. 3600 IN AAAA 2606:2800:220:1:248:1893:25c8:1946The 2606:2800:... is the IPv6, and the 3600 is the TTL.
Why the two records. The A and AAAA are the two families, and dual-stack is both. The modern is both, and dig is the query.
The CNAME record. The CNAME maps the name to another name (the alias).
dig www.example.com CNAME
# www.example.com. 3600 IN CNAME example.com.The www.example.com is the alias, and the example.com is the canonical. The CNAME is the alias, and the alias is the convenience.
Why the CNAME is the alias. The CNAME is the way to point a name to another, and the canonical is the target. The alias is the convenience, and the use is www.
The MX record. The MX maps the domain to the mail servers.
dig example.com MX
# example.com. 3600 IN MX 10 mail.example.com.The 10 is the priority, and the mail.example.com is the mail server. The lower is preferred.
Why the MX matters. The MX is the email’s routing, and the mail server is the target. The priority is failover, and multiple records are the backup.
The TXT record. The TXT is text, and the use is SPF, DKIM, DMARC, verification.
dig example.com TXT
# example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"The v=spf1 is the SPF, and the ~all is the policy. The TXT is text, and the text is arbitrary.
Why the TXT matters. The TXT is arbitrary text, and the use is email authentication, domain verification, and more. The TXT is flexible, and flexible is common.
The NS record. The NS maps the domain to the name servers.
dig example.com NS
# example.com. 3600 IN NS a.iana-servers.net.
# example.com. 3600 IN NS b.iana-servers.net.The a.iana-servers.net is the name server, and the NS is the delegation. The NS is the authority, and the authority is the source.
The SOA record. The SOA is the zone’s start of authority, and it has the primary server, email, serial, refresh, retry, expire, minimum.
dig example.com SOA
# example.com. 3600 IN SOA sns.dns.icann.org. noc.dns.icann.org. 2022091301 7200 3600 1209600 3600The sns.dns.icann.org is the primary, noc.dns.icann.org is the email, and 2022091301 is the serial. The SOA is the zone’s metadata, and metadata is the authority’s.
The PTR record. The PTR is reverse — address to name.
dig -x 93.184.216.34
# 34.216.184.93.in-addr.arpa. 3600 IN PTR example.com.The -x is reverse, and the PTR is the name. Reverse is the diagnosis, and the use is specific.
The SRV record. The SRV is a service’s location, and it has priority, weight, port, target.
dig _sip._tcp.example.com SRV
# _sip._tcp.example.com. 3600 IN SRV 10 60 5060 sipserver.example.com.The _sip._tcp is the service, 10 is priority, 60 is weight, 5060 is port, and sipserver.example.com is the target. The SRV is the service’s, and the use is SIP, LDAP, and more.
Why the record types are the vocabulary. The record types are the DNS’s data, and each has a purpose. A and AAAA are addresses, CNAME is alias, MX is mail, TXT is text, NS is authority, SOA is zone, PTR is reverse, and SRV is service. The types are the vocabulary, and the knowledge is the fluency.
The caching and the TTL
The cache is the DNS’s performance, and the TTL is the cache’s limit. The two are the balance, and the balance is the design.
The TTL. The TTL is the time to live, and the record’s TTL is the seconds the cache may keep the answer. 3600 is one hour, and 86400 is one day.
Why the TTL matters. The TTL is the balance between performance and freshness. A short TTL is fresh but slow, and a long TTL is fast but stale. 300 is common for dynamic, and 86400 is common for stable.
The cache’s layers. The client caches, the resolver caches, and intermediate caches. systemd-resolved is the modern cache, and /etc/resolv.conf is the resolver’s address.
Why the cache has layers. The layers are performance, and the cache is distributed. The client’s cache is first, the resolver’s is second, and the intermediate’s is third. The layers are speed, and the TTL is the limit.
Why the cache can be stale. The cache’s TTL is the limit, and the record’s change is delayed. dig may show the cached, and +trace is fresh. The stale is the diagnosis, and dig @8.8.8.8 is the alternative.
Why the negative cache exists. The negative cache is the NXDOMAIN‘s cache, and the SOA‘s minimum is the TTL. The nonexistent is cached, and the repeat is fast. The negative is the efficiency, and the minimum is the limit.
Why the TTL should be appropriate. A short TTL is for migration, and a long one is for stable. 300 is for migration, and 86400 is for static. The appropriate is the design, and the design is the balance.
Why the cache can be flushed. resolvectl flush-caches flushes systemd-resolved, and systemctl restart nscd flushes nscd. The flush is the diagnosis, and the restart is the reset.
The hierarchy and the servers
The DNS is a hierarchy, and the servers are the levels. The root, the TLD, the authoritative, and the recursive are the four.
The root servers. The root is the top, and 13 is the logical. The root responds with the TLD’s, and dig . NS is the query.
dig . NS
# . 518400 IN NS a.root-servers.net.
# . 518400 IN NS b.root-servers.net.
# ...The a.root-servers.net is the root, and 13 is the list. The root is the entry, and the entry is first.
The TLD servers. The TLD is next, and .com, .org, .no are the examples. The TLD responds with the domain’s, and dig com NS is the query.
The authoritative servers. The domain’s are authoritative, and the answer is the truth. The NS record declares the authoritative, and dig example.com NS is the query.
The recursive servers. The recursive is the resolver, and it does the work. 8.8.8.8 (Google), 1.1.1.1 (Cloudflare), 9.9.9.9 (Quad9) are public, and the ISP’s is local.
Why the recursive is the resolver. The recursive is the client’s agent, and the client asks the recursive. The recursive asks the root, the TLD, the authoritative, and returns the answer. The recursive is the resolver, and the resolver is the service.
Why the public resolvers exist. The public resolvers are the alternative to the ISP’s, and 8.8.8.8 is the common. Privacy, speed, and filtering are the reasons, and the choice is the user’s.
Why the authoritative is the source. The authoritative has the truth, and the answer is the source. The NS is the delegation, and the SOA is the zone. The authoritative is the source, and the source is the truth.
Why the hierarchy matters. The hierarchy is the distribution, and the distribution is the scalability. The names are distributed, and the authorities are the zones. The hierarchy is the model, and the model is the DNS.
The tools
The DNS’s tools are dig, nslookup, host, resolvectl, and getent. Each has a purpose, and the combination is the diagnosis.
The dig. dig is the modern query tool, and the output is detailed.
dig example.com
# ; <<>> DiG 9.18.1 <<>> example.com
# ;; QUESTION SECTION:
# ;example.com. IN A
# ;; ANSWER SECTION:
# example.com. 3600 IN A 93.184.216.34
# ;; Query time: 12 msecThe question, answer, authority, and additional are the sections. +short is concise, and +trace is the chain.
Why dig is the standard. dig is modern, and the output is detailed. The sections are the diagnosis, and +short is concise. dig is the standard, and the standard is the preference.
The nslookup. nslookup is the classic, and the output is simpler.
nslookup example.com
# Server: 8.8.8.8
# Address: 8.8.8.8#53
# Non-authoritative answer:
# Name: example.com
# Address: 93.184.216.34The Server is the resolver, and Non-authoritative means the cache. nslookup is the classic, and the use is interactive.
The host. host is simple, and the output is one-line.
host example.com
# example.com has address 93.184.216.34
# example.com has IPv6 address 2606:2800:...host is simple, and the use is quick. -t is the type, and host -t MX example.com is the MX.
The resolvectl. resolvectl is systemd-resolved‘s, and the output is the interface’s.
resolvectl status
# Link 2 (eth0)
# Current Scopes: DNS
# DNS Servers: 192.168.1.1
# DNS Domain: ~.
resolvectl query example.com
# example.com: 93.184.216.34resolvectl status is the resolver’s, and resolvectl query is the query. systemd-resolved is modern, and resolvectl is the interface.
The getent. getent is the system’s, and getent hosts example.com is the query.
getent hosts example.com
# 93.184.216.34 example.comgetent is the NSS’s, and hosts is the database. getent is the system’s, and the use is the script’s.
Why the tools have layers. dig is detailed, nslookup is classic, host is simple, resolvectl is modern, and getent is the system’s. The tools are the vocabulary, and the choice is the purpose.
Why dig should be first. dig is detailed, and the diagnosis is the detail. dig +trace is the chain, and dig @8.8.8.8 is the alternative resolver. dig is first, and first is detailed.
Why dig @server matters. dig @8.8.8.8 example.com queries the specific resolver, and dig @192.168.1.1 example.com queries the local. The alternative is the diagnosis, and the comparison is the isolation.
Complete Example Session
# ============================================
# PART 1: THE BASIC QUERY
# ============================================
dig example.com
# ;; QUESTION SECTION:
# ;example.com. IN A
# ;; ANSWER SECTION:
# example.com. 3600 IN A 93.184.216.34
dig +short example.com
# 93.184.216.34
# ============================================
# PART 2: THE RECORD TYPES
# ============================================
dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com TXT
dig example.com NS
dig example.com SOA
# ============================================
# PART 3: THE REVERSE
# ============================================
dig -x 93.184.216.34
# 34.216.184.93.in-addr.arpa. 3600 IN PTR example.com.
# ============================================
# PART 4: THE TRACE
# ============================================
dig +trace example.com
# . 518400 IN NS a.root-servers.net.
# com. 172800 IN NS a.gtld-servers.net.
# example.com. 172800 IN NS a.iana-servers.net.
# example.com. 3600 IN A 93.184.216.34
# ============================================
# PART 5: THE ALTERNATIVE RESOLVER
# ============================================
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com
# ============================================
# PART 6: THE NSLOOKUP
# ============================================
nslookup example.com
# Server: 8.8.8.8
# Address: 8.8.8.8#53
# Non-authoritative answer:
# Name: example.com
# Address: 93.184.216.34
# ============================================
# PART 7: THE HOST
# ============================================
host example.com
# example.com has address 93.184.216.34
# example.com has IPv6 address 2606:2800:...
# ============================================
# PART 8: THE RESOLVECTL
# ============================================
resolvectl status
# Link 2 (eth0)
# DNS Servers: 192.168.1.1
resolvectl query example.com
# example.com: 93.184.216.34
# ============================================
# PART 9: THE RESOLV.CONF
# ============================================
cat /etc/resolv.conf
# nameserver 192.168.1.1
# nameserver 8.8.8.8
# ============================================
# PART 10: WHAT NOT TO DO
# ============================================
# Don't assume the DNS is the problem
# The ping to the IP is the test.
# Don't forget the cache
# The stale answer is the TTL.
# Don't use the short TTL for the stable
# The short TTL is the migration.
# Don't ignore the negative cache
# The NXDOMAIN is cached.
# Don't forget the reverse
# The PTR is the diagnosis.
# Don't use a public resolver without reason
# The ISP's is the default.The ten parts cover the basic query, the record types, the reverse, the trace, the alternative resolver, nslookup, host, resolvectl, the resolv.conf, and the anti-patterns.
Quick Reference
The Record Types
| Type | Purpose |
|---|---|
A | IPv4 address |
AAAA | IPv6 address |
CNAME | Alias |
MX | Mail server |
TXT | Text |
NS | Name server |
SOA | Zone authority |
PTR | Reverse |
SRV | Service |
The Resolution’s Modes
| Mode | Purpose |
|---|---|
| Recursive | Client’s query |
| Iterative | Resolver’s queries |
| Cache | Performance |
| TTL | Cache’s limit |
The Servers
| Server | Purpose |
|---|---|
| Root | Top |
| TLD | .com, .org |
| Authoritative | Zone’s answer |
| Recursive | Resolver |
The Tools
| Command | Purpose |
|---|---|
dig | Detailed query |
dig +short | Concise |
dig +trace | Chain |
dig @server | Specific resolver |
dig -x | Reverse |
nslookup | Classic |
host | Simple |
resolvectl | systemd-resolved’s |
getent hosts | System’s |
The Files
| File | Purpose |
|---|---|
/etc/resolv.conf | Resolver |
/etc/hosts | Local override |
/etc/nsswitch.conf | Order |
/etc/systemd/resolved.conf | systemd-resolved’s |
Best Practices
✅ Do This:
# Use dig for the detailed query
dig example.com # ✅
# Use +short for the concise
dig +short example.com # ✅
# Use +trace for the chain
dig +trace example.com # ✅
# Use @server for the alternative
dig @8.8.8.8 example.com # ✅
# Use -x for the reverse
dig -x 93.184.216.34 # ✅
# Check the resolver
cat /etc/resolv.conf # ✅
# Check systemd-resolved
resolvectl status # ✅
# Test the IP first
ping -c 4 93.184.216.34 # ✅❌ Don’t Do This:
# Don't assume the DNS is the problem
# The ping to the IP is the test. # ⚠️
# Don't forget the cache
# The stale answer is the TTL. # ⚠️
# Don't use the short TTL for the stable
# The short TTL is the migration. # ⚠️
# Don't ignore the negative cache
# The NXDOMAIN is cached. # ⚠️
# Don't forget the reverse
# The PTR is the diagnosis. # ⚠️
# Don't use a public resolver without reason
# The ISP's is the default. # ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
| Stale cache | Old answer | TTL, flush |
| Wrong resolver | Wrong answer | Check resolv.conf |
| Short TTL | Slow | Use longer |
| Negative cache | Cached NXDOMAIN | SOA’s minimum |
| No reverse | Missing PTR | Check the zone |
| Public resolver | Policy | Check the reason |
| DNS vs IP | Wrong suspect | Ping the IP |
Real-World Examples
1. The basic query
dig example.com2. The concise
dig +short example.com3. The trace
dig +trace example.com4. The alternative resolver
dig @8.8.8.8 example.com5. The reverse
dig -x 93.184.216.346. The MX
dig example.com MX7. The TXT
dig example.com TXT8. The NS
dig example.com NS9. The nslookup
nslookup example.com10. The resolvectl
resolvectl query example.comVisual: The Resolution
┌──────────────────────────────────────────────────────────┐
│ THE CLIENT │
│ │ │
│ │ 1. Recursive query │
│ ▼ │
│ THE RESOLVER (8.8.8.8) │
│ │ │
│ │ 2. Root query │
│ ▼ │
│ THE ROOT (a.root-servers.net) │
│ │ TLD's servers │
│ ▼ │
│ THE TLD (a.gtld-servers.net) │
│ │ Domain's servers │
│ ▼ │
│ THE AUTHORITATIVE (a.iana-servers.net) │
│ │ The answer │
│ ▼ │
│ THE RESOLVER │
│ │ Cache, answer │
│ ▼ │
│ THE CLIENT │
│ │
│ The recursive is the client's, and the iterative is │
│ the resolver's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Hierarchy
┌──────────────────────────────────────────────────────────┐
│ THE ROOT (13 logical) │
│ │ │
│ ├── .com ──► .com's servers │
│ │ │ │
│ │ └── example.com ──► example.com's servers │
│ │ │ │
│ │ └── www.example.com ──► A │
│ │ │
│ ├── .org ──► .org's servers │
│ │ │
│ └── .no ──► .no's servers │
│ │
│ The delegation is the chain, and the chain is the │
│ resolution. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Record Types
┌──────────────────────────────────────────────────────────┐
│ A → IPv4 address │
│ AAAA → IPv6 address │
│ CNAME → Alias │
│ MX → Mail server │
│ TXT → Text (SPF, DKIM, verification) │
│ NS → Name server │
│ SOA → Zone authority │
│ PTR → Reverse │
│ SRV → Service │
│ │
│ Each has a purpose, and the combination is the zone. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Cache and the TTL
┌──────────────────────────────────────────────────────────┐
│ THE CLIENT'S CACHE │
│ TTL, answer │
│ │ │
│ ▼ │
│ THE RESOLVER'S CACHE │
│ TTL, answer │
│ │ │
│ ▼ │
│ THE AUTHORITATIVE │
│ TTL, source │
│ │
│ A short TTL is fresh but slow. │
│ A long TTL is fast but stale. │
│ The balance is the design. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The dig’s Output
┌──────────────────────────────────────────────────────────┐
│ dig example.com │
│ │
│ ; <<>> DiG 9.18.1 <<>> example.com │
│ ;; QUESTION SECTION: │
│ ;example.com. IN A │
│ │ │
│ │ the question │
│ ▼ │
│ ;; ANSWER SECTION: │
│ example.com. 3600 IN A 93.184.216.34│
│ │ │ │ │ │ │ │
│ │ │ │ │ │ └── the address │
│ │ │ │ │ └── the type │
│ │ │ │ └── the class │
│ │ │ └── the TTL │
│ │ └── the name │
│ └── the answer │
│ │
│ ;; Query time: 12 msec │
│ ;; SERVER: 8.8.8.8#53 │
│ │
└──────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| The DNS | Name to address |
| Resolution | Recursive and iterative |
| Record types | A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV |
| Cache | TTL |
| Root | 13 logical |
| TLD | .com, .org |
| Authoritative | Zone’s |
| Recursive | Resolver |
| Tools | dig, nslookup, host, resolvectl |
Key takeaways:
- The DNS translates names to IP addresses — it is the internet’s directory, and it decouples the name from the address
- The resolution is recursive and iterative — the client’s query is recursive, and the resolver’s queries are iterative
- The record types are the DNS’s data —
AandAAAAare addresses,CNAMEis alias,MXis mail,TXTis text,NSis authority,SOAis zone,PTRis reverse, andSRVis service - The cache is the performance, and the TTL is the limit — a short TTL is fresh but slow, and a long TTL is fast but stale
- The hierarchy is the root, the TLD, the authoritative, and the recursive — the delegation is the chain, and the chain is the resolution
- The resolver is the client’s agent —
8.8.8.8and1.1.1.1are public, and the ISP’s is local digis the detailed query tool —+shortis concise,+traceis the chain, and@serveris the alternativenslookupandhostare the classic and the simple —nslookupis interactive, andhostis one-lineresolvectlis systemd-resolved’s — modern issystemd-resolved, andresolvectlis the interface- The DNS is the common cause of the “the internet is down” symptom — the
pingto the IP works, and thepingto the name fails
Remember: The DNS translates names to IP addresses. The recursive is the client’s, the iterative is the resolver’s, and the cache is the performance. The record types are the data, the TTL is the limit, and the hierarchy is the model. dig is the tool, resolvectl is the modern, and the /etc/resolv.conf is the configuration. The DNS is foundational, and it is the first thing to check when a name does not resolve.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!