DNS For People Who Just Want Their Site to Work

#dns#networking#web

DNS is the thing that turns example.com into 93.184.216.34. It sounds simple until you need to actually configure it. Then you are staring at a dashboard full of record types, TTL values, and propagation delays wondering why your site still points to the old server.

The Record Types That Matter

A and AAAA

The most basic. Maps a domain to an IP address:

example.dev.    A      203.0.113.50
example.dev.    AAAA   2001:db8::1

A is IPv4. AAAA is IPv6. You want both if your server supports v6.

CNAME

An alias. Points one name to another:

www.example.dev.    CNAME    example.dev.

This says “www is the same as the bare domain.” The DNS resolver follows the chain and ends up at the A record for example.dev.

The critical rule: you cannot have a CNAME alongside other records for the same name. This means the zone apex (bare domain) usually cannot be a CNAME. Use an A record there instead.

MX

Where to deliver email:

example.dev.    MX    10 mail.example.dev.

The number is priority. Lower means preferred. If you have a backup mail server:

example.dev.    MX    10 mail.example.dev.
example.dev.    MX    20 backup-mail.example.dev.

Senders try priority 10 first, fall back to 20 if it is down.

TXT

Arbitrary text. Used for verification and email authentication:

example.dev.    TXT    "v=spf1 a mx ip4:203.0.113.50 ~all"

SPF tells receiving mail servers which IPs are allowed to send email for your domain. DKIM and DMARC are also TXT records. Google and other services use TXT for domain ownership verification too.

NS

Nameserver delegation. Usually set by your registrar:

example.dev.    NS    ada.ns.cloudflare.com.
example.dev.    NS    greg.ns.cloudflare.com.

This tells the internet “Cloudflare knows the DNS records for example.dev.” You rarely touch these directly.

Debugging With dig

dig is the standard DNS debugging tool:

# Basic lookup
dig example.dev

# Specific record type
dig MX example.dev

# Short output
dig +short example.dev
# 203.0.113.50

# Use a specific DNS server
dig @8.8.8.8 example.dev

# Trace the full resolution path
dig +trace example.dev

The +trace option follows the entire DNS chain from the root servers down. This is invaluable when debugging propagation issues.

TTL

Time To Live. How long DNS resolvers cache a record:

example.dev.    300    IN    A    203.0.113.50

300 means 5 minutes. After that, resolvers ask again. Lower TTL means faster propagation when you change records, but more DNS queries hitting your nameservers.

Before a migration:

  1. Lower TTL to 60 seconds, 24 hours ahead
  2. Wait for the old TTL to expire
  3. Change the record
  4. Verify
  5. Raise TTL back to 3600 or higher

This way, when you change the IP, everyone picks up the new address within a minute.

Common Patterns

Subdomain to a different server

api.example.com.    A    203.0.113.50

Wildcard

*.example.com.    A    93.184.216.34

Matches any subdomain that does not have a more specific record. Useful for catch-all routing.

Email setup

Minimum viable email DNS:

example.com.         MX   10 mail.example.com.
mail.example.com.    A    93.184.216.34
example.com.         TXT  "v=spf1 a mx ~all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine"
sel._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIj..."

Cloudflare proxy vs DNS-only

If you use Cloudflare:

# Proxied (orange cloud) - traffic goes through Cloudflare CDN
example.dev.    A    203.0.113.50    (proxied)

# DNS-only (gray cloud) - direct connection to your server
mail.example.dev.    A    203.0.113.50    (DNS-only)

Proxied records hide your real IP and add DDoS protection. But they break non-HTTP protocols. Mail servers, game servers, and anything that is not HTTP/HTTPS needs DNS-only.

Why Is My DNS Not Working?

In order of likelihood:

  1. Propagation delay. You changed the record 2 minutes ago. Wait for the TTL to expire. Check with dig @8.8.8.8 to see what Google’s DNS returns.

  2. Browser cache. Chrome caches DNS aggressively. Try chrome://net-internals/#dns and clear it, or just use a different browser.

  3. Wrong record type. You added a CNAME where you needed an A record, or vice versa.

  4. Cloudflare proxy interfering. Your service needs direct access but the record is proxied. Switch to DNS-only.

  5. Missing trailing dot. In some DNS configurations, mail.example.com and mail.example.com. are different. The dot makes it fully qualified. Most providers handle this for you, but raw zone files need it.

# Quick sanity check script
for record in A AAAA MX TXT CNAME; do
  echo "=== $record ==="
  dig +short $record example.com
done

DNS is not complicated once you understand the record types. The frustrating part is always the caching and propagation delays. Lower your TTLs before making changes, use dig to verify, and be patient.

← all articles wleeaf.dev →