DNS Lookup
Articles, guides, and in-depth tips for the DNS Lookup — everything you need to get the most out of it.
✦ AI-powered — understands natural language
Why You Can't CNAME Your Root Domain (and What to Do)
DNSSEC Protects Against Cache Poisoning — Not the Attacks That Actually Cause DNS Outages
DNSSEC signs DNS records cryptographically — protecting against cache poisoning (Kaminsky's 2008 attack) but doing nothing about registrar account compromise, BGP hijacking, or misconfigured records. Here's how DNSSEC's chain of trust works (root → TLD → domain), why expired RRSIG signatures cause SERVFAIL for DNSSEC-validating resolvers including Google and Cloudflare, and why only ~3-5% of .com domains have DNSSEC despite most TLDs being signed.
The Four-Layer DNS Cache — Why the Same Domain Resolves Differently From Different Locations During Propagation
A DNS query might return an answer cached by your browser, your OS, your ISP's resolver, or a CDN's resolver — and each cache has a different expiry time. Here's the four-layer DNS caching chain, why the TTL on your old record controls propagation speed (not the TTL on the new one), how to read the remaining cache TTL from dig output, negative caching (why "doesn't exist" responses are also cached), and why Anycast DNS means propagation isn't geographically simultaneous.
DNS Propagation, TTLs, and Caching: What Actually Happens When You Change a DNS Record
"DNS propagation takes up to 48 hours" is true but vague — the actual mechanism is TTL-governed caching at thousands of independent resolvers, each expiring on its own schedule. Here's how TTL actually controls this, why lowering TTL before a planned change matters, negative caching for new records, and why different users can genuinely see different DNS results during a transition.
DNS over HTTPS: Why Your Browser and Your DNS Lookup Tool Might Be Talking to Different Servers
Your computer's DNS settings and your browser's actual DNS resolution might be using completely different servers — DNS over HTTPS (DoH), increasingly implemented at the browser level, can bypass OS-level DNS settings entirely. Here's why DoH/DoT exist (encrypting DNS queries for privacy), why "dig shows the new record but my browser doesn't" can happen due to separate resolver caches, and how DoH interacts with network-level DNS filtering.
DNS as a Security Tool and Target: Cache Poisoning, Hijacking, and DNSSEC
DNS cache poisoning, DNS hijacking, and DNS tunneling are real attack vectors. Here's how each works, what DNSSEC does (and doesn't) protect against, how to monitor your own DNS records for unexpected changes, and what domain shadowing is.
Every DNS Record Type Explained: A Practical Reference for A, CNAME, MX, TXT, NS & More
A practical reference for every DNS record type: A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA — what each does, critical constraints, TTL strategy, and common use cases developers encounter regularly.
DNS Lookup — Query Any Record Type for Any Domain Instantly
Learn how DNS works, what record types mean (A, MX, TXT, CNAME, NS), how to diagnose common DNS problems, and how to use a free DNS lookup tool to check any domain's records.
