Learn DNS

One question per article, the command that proves the answer, and what breaks when it is ignored.

• What is a nameserver — and why you need at least two

  The servers that answer for your domain, and why two of them on the same network is one of them.

• DNS delegation: where it actually lives

  The pointer that says which nameservers own your domain is not stored in your zone — it lives at the parent.

• DNSSEC: what it protects — and what it does not

  Cryptographic signatures that make DNS answers verifiable. Not encryption, and not optional to keep healthy once on.

• The DS record: the link that closes the DNSSEC chain

  A fingerprint of your signing key, published at the parent zone through your registrar. Without it, signatures validate nothing.

• SPF: the 10-lookup limit that silently breaks e-mail

  One TXT record lists who may send e-mail as your domain. Its most common failure produces no error message at all.

• DMARC: why SPF alone does not stop spoofing

  SPF checks a field users never see. DMARC is what protects the From: line they do — and it starts in observation mode for a reason.

• TTL: the number that decides how fast your changes happen

  Every DNS record carries an expiry time for caches. Set it high and changes crawl; measure it wrong and you debug ghosts.

• Glue records: solving DNS’s chicken-and-egg problem

  When your nameserver lives inside the domain it serves, someone has to break the loop. That someone is the parent zone.