DNS Records

DNS maps domain names → IP addresses. Like a phonebook for the internet.

Core Record Types

Record	Full Name	Purpose	Example
A	Address	Domain → IPv4	google.com → 142.250.1.1
AAAA	Quad-A	Domain → IPv6	google.com → 2607:f8b0::1
CNAME	Canonical Name	Domain → another domain (alias)	www.google.com → google.com
MX	Mail Exchange	Where to send email	google.com → smtp.google.com
NS	Name Server	Who is authoritative for this domain	google.com → ns1.google.com
TXT	Text	Arbitrary text, used for verification	SPF, DKIM, domain ownership
PTR	Pointer	IP → Domain (reverse DNS)	1.1.250.142 → google.com
SOA	Start of Authority	Metadata about the zone	Serial, refresh interval, admin email

DNS Resolution — Full Flow

Browser
  │
  ├── Check local cache / hosts file
  │
  └── Recursive Resolver (your ISP or 8.8.8.8)
        │
        ├── Root Nameserver (.)
        │     "Go ask .com TLD server"
        │
        ├── TLD Nameserver (.com)
        │     "Go ask google's NS"
        │
        └── Authoritative Nameserver (ns1.google.com)
              "Here's the IP: 142.250.1.1"

Got IP, make HTTP request

Important Concepts

TTL (Time To Live)

• How long a record is cached (in seconds).
• Low TTL = changes propagate fast, but more DNS queries.
• High TTL = faster (cached), but slow to update.

Recursive vs Iterative

• Recursive resolver — does all the work for you (your ISP's DNS).
• Authoritative NS — the final source of truth for a domain.

CNAME Rules

• Can't use CNAME on root domain (google.com) — only subdomains (www.google.com).
• CNAME can't coexist with other records on same name.

DNS Security

Attack/Feature	What It Is
DNS Spoofing / Cache Poisoning	Attacker injects fake records into resolver cache
DNSSEC	Digitally signs records to prevent spoofing
DNS over HTTPS (DoH)	Encrypts DNS queries so ISP can't snoop
DNS over TLS (DoT)	Same but over TLS port 853