DNS Deep Dive for Developers

January 9, 2026 2 min read Infrastructure

dnsnetworkingdomains

DNS is the internet’s phone book. Understanding it helps you troubleshoot issues and configure services correctly.

How DNS Works

Browser: "What's the IP for example.com?"
    ↓
Local Resolver → Root Server → TLD Server → Authoritative Server
    ↓
Answer: "93.184.216.34"

Record Types

A Record

Maps domain to IPv4 address:

example.com.    A    93.184.216.34

AAAA Record

Maps domain to IPv6 address:

example.com.    AAAA    2606:2800:220:1:248:1893:25c8:1946

CNAME Record

Alias to another domain:

www.example.com.    CNAME    example.com.
blog.example.com.   CNAME    myblog.ghost.io.

Note: Can’t coexist with other records at same name.

MX Record

Mail server routing:

example.com.    MX    10 mail1.example.com.
example.com.    MX    20 mail2.example.com.

Lower priority number = preferred.

TXT Record

Text data (SPF, DKIM, verification):

example.com.    TXT    "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com.    TXT    "v=DMARC1; p=reject"

NS Record

Nameserver delegation:

example.com.    NS    ns1.provider.com.
example.com.    NS    ns2.provider.com.

SRV Record

Service location:

_sip._tcp.example.com.    SRV    10 5 5060 sipserver.example.com.

Format: priority weight port target

TTL (Time To Live)

How long to cache the record:

example.com.    300    A    93.184.216.34

300 seconds = 5 minutes cache.

Trade-offs:

Low TTL: Faster changes, more DNS queries
High TTL: Slower changes, fewer queries

Common Patterns

Subdomain Routing

api.example.com.      A       93.184.216.35
app.example.com.      CNAME   myapp.herokuapp.com.
docs.example.com.     CNAME   example.gitbook.io.

Apex Domain with CDN

Some CDNs need CNAME, but apex can’t use CNAME. Solutions:

# ALIAS/ANAME record (provider-specific)
example.com.    ALIAS    d1234.cloudfront.net.

# Or use A records to CDN IPs
example.com.    A    13.32.100.1
example.com.    A    13.32.100.2

Email Configuration

# Mail server
example.com.        MX    10 mail.example.com.
mail.example.com.   A     93.184.216.40

# SPF - who can send email
example.com.        TXT   "v=spf1 include:_spf.google.com ~all"

# DKIM - email signing
selector._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIGf..."

# DMARC - policy
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Debugging DNS

dig

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


# Basic lookup
dig example.com

# Specific record type
dig example.com MX

# Query specific nameserver
dig @8.8.8.8 example.com

# Trace the lookup path
dig +trace example.com

# Short output
dig +short example.com

nslookup

1
2


nslookup example.com
nslookup -type=MX example.com

Check Propagation

1
2
3
4


# Query multiple resolvers
dig @8.8.8.8 example.com +short
dig @1.1.1.1 example.com +short
dig @208.67.222.222 example.com +short

Or use online tools like whatsmydns.net.

DNS Propagation

DNS changes aren’t instant:

You update DNS record
TTL on old record must expire
Resolvers fetch new record
Caches update

Speed up propagation:

Lower TTL before changes (24h ahead)
Make change
Wait for old TTL
Raise TTL again

Security

DNSSEC

Cryptographically sign DNS records:

example.com.    RRSIG    A 8 2 300 20260201000000 20260101000000 12345 example.com. ...

Prevents DNS spoofing.

DNS over HTTPS (DoH)

Encrypt DNS queries:

https://cloudflare-dns.com/dns-query?name=example.com&type=A

Prevents eavesdropping on DNS lookups.

Understanding DNS helps you debug issues faster and configure services correctly. When something doesn’t resolve, now you know where to look.