Understanding DNS

DNS turns a readable name into an IP address. When a browser says "site not found", the problem often sits in that chain, not on the web server. Understanding who answers and for how long prevents random edits.

A delegated hierarchy

DNS is a tree. The root knows the servers for each extension (.fr, .com). Each extension delegates a domain to authoritative servers that hold the domain's zone. Those servers are designated by NS records.

Between the client and the authority sits a recursive resolver: the ISP's, the company's, or a public service such as 1.1.1.1. It asks questions on your behalf and caches answers.

Three roles not to confuse:

• the registrar registers the name and declares the DNS servers;
• the DNS host holds the zone and answers queries;
• the web host serves the files.

They can be three different providers. Edit the zone at the wrong one and nothing changes.

The zone and its records

A zone is a resource file. It contains a SOA (authority and negative caching settings), NS records, then the useful records: A and AAAA for addresses, CNAME for an alias, MX for mail, TXT for SPF and verification, SRV for a service and its port, CAA to restrict certificate authorities.

Every record carries a TTL in seconds: how long a resolver may reuse the answer without asking again.

Follow a resolution

1. The client asks its configured resolver.
2. The resolver checks its cache. If the answer is valid, it returns it immediately.
3. Otherwise it asks the root, then the extension, then the authoritative servers.
4. It caches the answer for the TTL, then returns it.

dig +trace your-domain.com shows that delegation step by step. It is the most direct way to confirm a domain is delegated to the servers you expect.

TTL, cache and "propagation"

There is no broadcast to the whole world: each resolver keeps an answer until its TTL expires. A change is visible immediately on the authoritative server, but resolvers holding the old answer keep serving it.

A TTL of 3600 means a mistake can stay visible for an hour; a TTL of 300 limits it to five minutes. Before a migration, lower the TTL, wait for the old value to expire, then change the record.

Negative caching exists too: a "this name does not exist" answer is remembered according to the SOA minimum field. Creating a record after an error can therefore take a little patience.

Verify

dig NS your-domain.com +short
dig A your-domain.com +short
dig @1.1.1.1 A your-domain.com +short

Compare the authoritative answer with a public resolver's. If they differ, you are reading a cache. If the NS records are not the expected ones, delegation must be fixed at the registrar. A SERVFAIL often means a broken zone or an incomplete DNSSEC chain, not a client failure.