DNS resolution is the process that turns a human-readable domain name, such as example.com, into the IP address a computer needs to connect to a server. This cheat sheet helps students understand how browsers, resolvers, root servers, TLD servers, and authoritative name servers work together. It also summarizes the most common DNS record types used to route web traffic, email, aliases, and verification records.
Understanding DNS is important for networking, cybersecurity, web development, and troubleshooting internet problems.
The core idea is that a client usually asks a recursive resolver for an answer, and the resolver finds or caches the needed record. DNS records are stored in zones managed by authoritative name servers. Each record has a type, name, value, and TTL, which controls how long it can be cached.
Important records include A, AAAA, CNAME, MX, TXT, NS, and SOA records.
Key Facts
- DNS translates domain names into resource records, such as example.com -> 93.184.216.34 for an A record.
- A typical DNS lookup follows this path: client -> recursive resolver -> root server -> TLD server -> authoritative server -> recursive resolver -> client.
- An A record maps a hostname to an IPv4 address, such as www.example.com A 93.184.216.34.
- An AAAA record maps a hostname to an IPv6 address, such as www.example.com AAAA 2606:2800:220:1:248:1893:25c8:1946.
- A CNAME record maps one hostname to another hostname, such as shop.example.com CNAME stores.example.net.
- An MX record tells mail servers where to deliver email and uses priority numbers, such as example.com MX 10 mail.example.com.
- A TXT record stores text data for verification or security, such as SPF, DKIM, and domain ownership checks.
- TTL means Time To Live, and a record with TTL 3600 may be cached for 3600 seconds, or 1 hour.
Vocabulary
- DNS
- DNS, or Domain Name System, is the distributed naming system that matches domain names with records such as IP addresses.
- Recursive resolver
- A recursive resolver is a DNS server that finds the answer for a client by checking cache or asking other DNS servers.
- Authoritative name server
- An authoritative name server is the DNS server that holds the official records for a domain zone.
- TTL
- TTL, or Time To Live, is the number of seconds a DNS record may be stored in cache before it should be refreshed.
- DNS record
- A DNS record is a typed entry in a DNS zone that gives information about a domain name, such as an IP address or mail server.
- TLD server
- A TLD server is a DNS server responsible for top-level domains such as .com, .org, or .edu.
Common Mistakes to Avoid
- Confusing recursive and authoritative DNS servers is wrong because the recursive resolver searches for answers, while the authoritative server provides the official answer for a zone.
- Using a CNAME record as if it were an IP address record is wrong because a CNAME must point to another hostname, not directly to an IPv4 or IPv6 address.
- Ignoring TTL during troubleshooting is wrong because cached records may continue to be used until the TTL expires, even after a DNS change is made.
- Setting up email with only an A record is wrong because mail delivery depends on MX records that identify the mail servers for a domain.
- Assuming DNS always gives one permanent answer is wrong because answers can change due to caching, load balancing, geographic routing, or updated zone records.
Practice Questions
- 1 A DNS record has TTL 1800. How many minutes can a resolver cache this record before refreshing it?
- 2 A domain uses the record www.example.com A 203.0.113.25. What IP address should a browser use for www.example.com?
- 3 An MX record is written as example.com MX 5 mail1.example.com and example.com MX 20 mail2.example.com. Which mail server has higher priority?
- 4 Explain why a website might still load from an old IP address for some users shortly after the domain owner updates the A record.
Understanding DNS Resolution & Record Types Reference
A resolver does not usually receive the final answer from the first server it contacts. It follows referrals. A root server points it toward the server group responsible for the domain ending, such as com or org.
That top level server points it toward the name servers chosen by the domain owner. The final server has authority for the zone and supplies the requested data. This structure spreads responsibility across many organizations.
No single database needs to hold every current internet name. A referral may include glue records, which give the address of a delegated name server. Glue prevents a loop when the name server itself has a name inside the domain it serves.
Caching makes DNS fast, though it can make changes seem confusing. A resolver stores answers until their time limit runs out. It can store referrals too, which reduces later work.
When a site owner changes an address, some users may still receive the earlier answer from a cache. Lowering the TTL before a planned move can shorten that delay, but it does not erase copies already cached under the old limit. Caches can hold negative answers as well.
If a name did not exist recently, a resolver may remember that result for a short time. This is why a newly created subdomain may not work everywhere at the exact same moment.
Record types have rules that affect how services are built. A CNAME is an alias, so it sends the lookup toward a different hostname rather than directly providing an address. This is useful when several names should follow one service, such as a hosted application.
A CNAME cannot normally share its name with ordinary records because the alias must be the only source of data at that name. MX records identify mail destinations, but their targets should resolve to addresses rather than another alias. Their priority values let mail systems try preferred servers first, then backups if needed.
TXT records often support email safety. SPF states which systems may send mail for a domain.
DKIM lets a receiving server check a signed message. DMARC tells receivers how to handle messages that fail those checks.
When troubleshooting, first identify the exact name and record type being requested. A web browser may ask for both IPv4 and IPv6 addresses. If only one is correct, some networks may connect while others fail.
Check whether the authoritative server has the intended record, then consider resolver caches and the record TTL. A response can fail because a domain delegation is wrong, a name server cannot be reached, or a firewall blocks DNS traffic. DNS was designed to be widely distributed, so attackers sometimes try to exploit false answers.
DNSSEC adds signed records that allow validating resolvers to detect certain forged responses. It does not encrypt DNS requests, but it helps confirm that received DNS data came from the proper zone.