What Is DNS? Records, Resolvers and Caching

DNS is a distributed system for records associated with domain names. Finding a website's IP address is its best-known use, but mail routing and service verification also use DNS records. Receiving a DNS answer does not prove that the web server is healthy or that HTTPS will succeed.

A resolver and an authoritative server have different jobs

A device usually asks a recursive resolver to resolve a query on its behalf. A cached answer may be reused. When necessary, the resolver follows root, top-level-domain, and authoritative-server information to find the record. It does not necessarily repeat the entire process for every page visit.

An authoritative server publishes records for the relevant DNS zone. The domain registrar and DNS hosting provider need not be the same company. Before editing a record, identify the active authoritative servers rather than assuming that the registrar's DNS panel controls the live zone.

Choose the record type for the question

• A: an IPv4 address record.
• AAAA: an IPv6 address record.
• CNAME: an alias to another DNS name, not an HTTP redirect.
• MX: mail-server names and preference values.
• NS: name servers for a zone.
• TXT: text records used for several purposes, including SPF and service verification.

One name may have several A or AAAA records. A CDN can return different answers according to the query's location. Do not treat a single observed address as an immutable answer for every user.

TTL concerns cached answers

A DNS record's TTL describes its cache lifetime in seconds. Lowering it does not retroactively shorten answers already cached with the old value. Clearing an operating-system cache also does not clear every browser cache or remote resolver.

During a server move, record the old and new answers, the resolver being queried, and the query time. Before calling the problem “propagation,” confirm that the authoritative record actually changed. Negative answers can be cached too, so investigating only successful A responses may miss the problem.

DNSSEC is not DNS encryption

DNSSEC supports origin and integrity validation for signed DNS data through a suitable chain of trust. It does not encrypt queries. DoH and DoT address encryption on particular DNS communication links. Neither makes a fraudulent website trustworthy or replaces HTTPS certificate validation.

Separate name resolution from website access

Query the exact name and record type first. If it resolves correctly, continue with the destination port and application response. Entering an IP address directly in a browser can mislead: the server may require the correct hostname in HTTP and TLS. For internal company names, check the organization's resolver policy rather than switching blindly to a public resolver.

For commands, see DNS lookups with nslookup and dig. For the security distinction, see DNSSEC requirements.