Every time you type google.com into your browser, some magic happens. Your computer doesn’t know where that site physically lives. To find out, it asks the DNS (Domain Name System) — a giant distributed database often called “the Internet’s phone book.”

This book consists of records, each of which tells the world something specific about your domain: where your site lives, where to send email, or how to verify that you own the domain.

But before we dive into record types, let’s cover two fundamental principles that everything rests on.

⚙️ How does DNS work? Two pillars: TTL and Delegation

1. TTL (Time To Live) — Cache lifetime

Every DNS record has a TTL parameter. It’s a number (in seconds) that tells other DNS servers and your browser:

“Once you’ve learned this IP address, how long can you remember (cache) it before asking me again?”

Recommendations:

• For stable records (A, MX) use from 1 to 24 hours.
• Before a migration temporarily lower TTL to 5–15 minutes 1–2 days before changes.

2. Delegation to multiple NS servers

No domain exists alone. It is delegated — meaning the parent zone (e.g., .com) hands control of your zone (example.com) to your DNS servers.

This is handled by the NS (Name Server) record. And important: never use only one NS server. RFC 2182 requires at least two independent NS servers for redundancy.

If ns1.example.com stops responding, the world will automatically query ns2.example.com — preferably located in another data center or with another provider.

That’s how DNS provides reliability without a single point of failure.

🏛️ Main “residents” of DNS: Basic record types

These are the basic records that almost every domain uses.

CNAME cannot be placed on the apex domain (example.com) — only on subdomains (RFC 1912).

🗂️ Service and verification records

5. NS record (Name Server)

Exists in two places:

1. At the domain registrar — indicating which DNS servers the zone is delegated to: example.com → ns1.my-hosting.com, ns2.my-hosting.com
2. Inside your zone — confirming that these are the servers answering for your domain.

6. SOA record (Start of Authority)

This is the “passport” of your zone. There is always one and it’s always the first record in the zone.

example.com. IN SOA ns1.example.com. admin.example.com. (
    2025111101   ; Serial (YYYYMMDDXX)
    7200         ; Refresh (2 hours)
    3600         ; Retry (1 hour)
    1209600      ; Expire (2 weeks)
    86400        ; Minimum TTL (Negative caching TTL)
)

Serial — critically important! Each time you edit the zone, increment this number. The YYYYMMDDXX (year, month, day, version) format is a convenient standard.

7. TXT record (Text)

Stores arbitrary text. Used for SPF, DKIM, DMARC, verifications, and other purposes.

example.com. TXT "v=spf1 include:_spf.google.com ~all"
example.com. TXT "google-site-verification=abc123"
example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

💎 Special attention: GeoDNS, ALIAS and SRV

8. GeoDNS — not a record type, but a technology

GeoDNS allows serving different IP addresses depending on the user’s geolocation (via EDNS Client Subnet, RFC 7871).

Use cases:

• CDN: Germany → Frankfurt, Japan → Tokyo
• Localization: one domain, different versions of a site per region

Where it’s found: Cloudflare, Akamai, AWS Global Accelerator.

9. ALIAS record (aka ANAME)

Solves the problem that CNAME cannot be set on the root (apex) domain.

How it works: example.com ALIAS app-123.heroku.com → the DNS provider itself queries app-123.heroku.com and returns A/AAAA records to the end user.

10. SRV record (Service Record)

Defines the server and port for a specific service.

_minecraft._tcp.play.example.com. IN SRV 10 5 25565 mc-server.example.com.

Used in VoIP (SIP), XMPP, Minecraft, Kerberos, and other services.

📚 Other record types (Quick reference)

🚀 Practical checklist: Is DNS ready for action?

dig NS example.com +trace        # Check delegation
dig A example.com                # Check A/AAAA records
dig MX example.com               # Check mail servers
dig TXT example.com              # SPF/DKIM/DMARC and verifications
dig SOA example.com              # Zone passport
dig SRV _minecraft._tcp.play...  # Check SRV records
dig example.com +dnssec          # Check DNSSEC

🔧 TTL during migration — practical plan

D-7: TTL → 86400 (1 day)
D-1: TTL → 300 (5 minutes)
Migration
D+0: TTL → 3600 (1 hour)
D+1: TTL → 86400 (return to normal value)

This ensures instant updates during migration without sacrificing stability afterward.

🎯 Summary

DNS is not just “an A-record and a CNAME.” It’s a complex and powerful system that lets you:

• Manage traffic with GeoDNS
• Ensure resilience via NS and MX
• Work with PaaS platforms via ALIAS
• Automate service routing via SRV
• Protect users using DNSSEC

Understanding DNS is the key to building fast, reliable, and secure web projects.

Resources:

• RFC 1035 — Domain Names
• RFC 2182 — Selection and Operation of Secondary DNS Servers
• Cloudflare DNS Documentation
• AWS Route 53 Docs