Chapter 11 — Domain Names & DNS

DNS (Domain Name System) translates human-readable names to IP addresses. It's the phone book of the internet, and misconfiguring it is one of the most common causes of "my site is down."

How DNS Resolution Works

User types: www.example.com │ ▼ ┌─────────────────────┐ │ Browser DNS Cache │ ← Checked first (TTL-based) └──────────┬──────────┘ │ Cache miss ▼ ┌─────────────────────┐ │ OS DNS Cache │ ← /etc/hosts, systemd-resolved └──────────┬──────────┘ │ Cache miss ▼ ┌─────────────────────┐ │ Recursive Resolver │ ← Your ISP's DNS or 1.1.1.1 / 8.8.8.8 │ (e.g., Cloudflare) │ └──────────┬──────────┘ │ Queries hierarchy: ▼ ┌─────────────────────┐ │ Root Name Servers │ ← "Who handles .com?" │ (13 clusters, a-m) │ → "Ask the .com TLD servers" └──────────┬──────────┘ ▼ ┌─────────────────────┐ │ TLD Name Servers │ ← "Who handles example.com?" │ (.com, .org, .io) │ → "Ask ns1.cloudflare.com" └──────────┬──────────┘ ▼ ┌─────────────────────┐ │ Authoritative NS │ ← "What's the A record for www.example.com?" │ (your DNS provider) │ → "93.184.216.34, TTL 300" └──────────┬──────────┘ │ ▼ Result cached at each level for TTL duration Browser connects to 93.184.216.34

DNS Record Types

TypePurposeExample
AMaps name to IPv4 addressexample.com → 93.184.216.34
AAAAMaps name to IPv6 addressexample.com → 2606:2800:220:1:...
CNAMEAlias to another namewww.example.com → example.com
MXMail server for the domainexample.com → mail.example.com (priority 10)
TXTArbitrary text (verification, SPF, DKIM)example.com → "v=spf1 include:_spf.google.com ~all"
NSNameservers for the domainexample.com → ns1.cloudflare.com
SRVService location (port + priority)_sip._tcp.example.com → sipserver.example.com:5060
CAAWhich CAs can issue certificatesexample.com → "0 issue letsencrypt.org"

Practical DNS Configuration

# Typical DNS setup for a web app:

# Root domain → your server
example.com.        A       93.184.216.34
example.com.        AAAA    2606:2800:220:1::248

# www subdomain → alias to root
www.example.com.    CNAME   example.com.

# API subdomain → different server or load balancer
api.example.com.    A       10.20.30.40

# Email (Google Workspace example)
example.com.        MX      1  aspmx.l.google.com.
example.com.        MX      5  alt1.aspmx.l.google.com.
example.com.        TXT     "v=spf1 include:_spf.google.com ~all"

# DKIM (email authentication)
google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0..."

# DMARC (email policy)
_dmarc.example.com. TXT     "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

# Let's Encrypt verification
_acme-challenge.example.com.  TXT  "random-verification-string"

TTL (Time To Live)

TTL tells resolvers how long to cache a record (in seconds):

Before a migration: Lower TTL to 300 seconds 24-48 hours before changing the record. This ensures the old high TTL expires, and when you make the change, it propagates within 5 minutes instead of hours.

DNS Providers

ProviderFree TierBest FeatureBest For
CloudflareUnlimited zonesCDN + DDoS + DNS in oneMost websites (recommended default)
AWS Route 53None ($0.50/zone)Latency/geo routing, health checksAWS-heavy infrastructure
Google Cloud DNSNoneLow latency, DNSSECGCP infrastructure
NS1Limited freeAdvanced traffic managementComplex routing needs

CDN Integration

A CDN (Content Delivery Network) caches your content at edge locations worldwide. DNS is how you route users to the nearest edge:

# Without CDN: Users hit your origin server directly
example.com.  A  YOUR_SERVER_IP

# With Cloudflare (proxy mode): Users hit Cloudflare edge, which proxies to origin
# Just enable the orange cloud icon in Cloudflare dashboard
# DNS resolves to Cloudflare's anycast IPs, not your server

# With AWS CloudFront: Point domain to CloudFront distribution
example.com.  ALIAS  d1234567890.cloudfront.net.
# (ALIAS is AWS-specific; equivalent to CNAME at zone apex)