Domain Name System (DNS): Architecture, Record Types, and Global Resolution

The Domain Name System (DNS) is the distributed hierarchical naming system that translates human-readable hostnames (api.example.com) into machine-routable IP addresses (93.184.216.34 or 2606:2800:220:1:248:1893:25c8:1946). This guide covers DNS hierarchy, iterative vs. recursive resolution, record types, DNSSEC, DoH/DoT, and Anycast routing.

⚡ Quick Dive

Standard DNS Record Types Reference

Record Type Purpose Syntax / Value Example Common Use Case
A Maps hostname to IPv4 address api.example.com. 300 IN A 198.51.100.1 Web services, API endpoints
AAAA Maps hostname to IPv6 address api.example.com. 300 IN AAAA 2001:db8::1 IPv6 routing
CNAME Canonical Name alias (Points to another hostname) www.example.com. CNAME example.com. Hostname aliasing (Never on apex @)
ALIAS / ANAME Flattened virtual alias supported at zone apex example.com. ALIAS d123.cloudfront.net. Root domain routing to CDN/Cloud Load Balancer
MX Mail Exchanger (with priority weighting) example.com. 3600 IN MX 10 mail.example.com. Email routing
TXT Arbitrary human/machine-readable text v=spf1 include:_spf.google.com ~all Email authentication (SPF, DKIM, DMARC), TLS validation
NS Delegates zone to Authoritative Name Server example.com. IN NS ns1.cloudflare.com. DNS authority delegation
SOA Start of Authority (Zone metadata & serial number) Primary NS, contact email, refresh/retry TTL Master zone synchronization
PTR Pointer Record (Reverse DNS: IP $\to$ Hostname) 1.100.51.198.in-addr.arpa. PTR api.example.com. Spam filtering, server identity verification
SRV Service Record (Host, Port, Weight, Priority) _sip._tcp.example.com. 86400 IN SRV 10 60 5060 sip.example.com. Service discovery (Consul, Active Directory)

Essential dig Commands Cheat Sheet

# Basic lookup returning short answer
dig +short A example.com

# Query specific nameserver directly (bypassing local resolver cache)
dig @8.8.8.8 A example.com +trace

# Inspect all mail servers and priority weights
dig MX example.com

# Reverse DNS lookup from IP address
dig -x 8.8.8.8 +short

📖 Extended Guide

1. The Hierarchical DNS Resolution Process

[ User Browser: "https://api.example.com" ]
                       │
                       ▼
       [ Recursive Resolver (ISP / 1.1.1.1) ]
                       │
       ┌───────────────┼───────────────┬───────────────┐
       │ (1. Ask '.')  │ (2. Ask 'com')│ (3. Ask NS)   │
       ▼               ▼               ▼               ▼
[ Root Server ] [ TLD Server ] [ Authoritative NS ] [ Client ]
  (13 Clusters)   (.com Nameserver) (ns1.example.com)  (Gets IP 198.51.100.1)
  1. Client $\to$ Recursive Resolver: The client asks the recursive resolver for api.example.com.
  2. Resolver $\to$ Root Nameserver (.): The root server replies with the referral to the Top-Level Domain (TLD) server handling .com.
  3. Resolver $\to$ TLD Nameserver (.com): The TLD server replies with the Authoritative Nameservers for example.com.
  4. Resolver $\to$ Authoritative Nameserver (ns1.example.com): Returns the A record containing the final IP address.
  5. Resolver Caching: The recursive resolver caches the record for the duration specified in the TTL (Time To Live) and returns the IP to the client.

2. DNS Security & Modern Protocols

  • DNSSEC (Domain Name System Security Extensions): Adds cryptographic signatures (RRSIG, DNSKEY) to DNS records. Prevents DNS cache poisoning and man-in-the-middle spoofing by verifying authenticity against a chain of trust back to the root zone.
  • DNS-over-HTTPS (DoH / RFC 8484) & DNS-over-TLS (DoT / RFC 7858): Encrypts DNS queries between client devices and recursive resolvers, preventing eavesdropping and ISP tracking.

3. Anycast Routing & GeoDNS for Global Scale

  • Anycast BGP: The same IP address (e.g. Cloudflare's 1.1.1.1 or Google's 8.8.8.8) is broadcast from hundreds of datacenters globally via BGP routing. Client queries automatically route to the nearest physical datacenter with lowest latency.
  • GeoDNS (Latency-Based Routing): Authoritative nameservers inspect the client resolver's IP address (or EDNS Client Subnet) and return different A records (e.g. European users receive an EU IP; US users receive a US IP).
⌂ All Guides