TopicIT Networking →

⌚ About 3 min read

View my favorites

DNSBeginner to advanced8 sections · 32 reference points

DNS reference for records, resolvers, authoritative servers, delegation, caching and Active Directory zones.

Record types

Name → IPv4

IPv4 address for a hostname.

AAAA

Name → IPv6

IPv6 address for a hostname.

CNAME

Alias → nom canonique

A CNAME points to a name, not directly to an IP address.

Servers de messaging + priorité

Lower numeric preference is tried first.

Other useful records

TXT

Texte libre / SPF / validations

Can hold multiple independent purposes.

Servers DNS autoritaires

Should match delegation and authoritative zone.

PTR

Adresse IP → nom

Stored in a separate reverse zone.

SRV

_service._proto → cible:port

Widely used by Active Directory and service discovery.

Windows commands

Standard lookup

Resolve-DnsName exemple.fr

Shows answers, type, TTL and resolver.

Query a specific DNS

Resolve-DnsName exemple.fr -Server 1.1.1.1

Compares answers without changing NIC settings.

Resolve-DnsName exemple.fr -Type MX

Checks mail targets and preferences.

TXT

Resolve-DnsName exemple.fr -Type TXT

Useful for SPF, SaaS validations and policies.

Linux / macOS commands

Short dig

dig +short exemple.fr A

Minimal output for scripts or quick comparisons.

Full answer

dig exemple.fr A

Shows flags, authority, additional records and timing.

Specific server

dig @8.8.8.8 exemple.fr A

Queries a specific resolver.

Delegation trace

dig +trace exemple.fr

Follows root, TLD and authoritative servers to diagnose delegation.

Authority, SOA & delegation

SOA

Resolve-DnsName exemple.fr -Type SOA

Shows primary server, serial and zone timers.

Parent delegation

dig +short exemple.fr NS

Compare with the authoritative servers actually answering.

Zone serial

Numéro de série SOA

A secondary with an older serial may serve stale data.

Glue records

A/AAAA du serveur NS dans la zone parente

Required when a nameserver is inside the delegated domain.

Cache, TTL & propagation

TTL

Duration de cache en secondes

High TTL delays visibility of a published change.

Negative caching

NXDOMAIN mis en cache selon SOA

A fix may remain hidden until negative cache expires.

Flush Windows cache

ipconfig /flushdns

Only clears the local client cache.

systemd-resolved cache

sudo resolvectl flush-caches

Use on systems running systemd-resolved.

Active Directory DNS

Member DNS

DNS internes AD uniquement

AD clients must resolve domain SRV records.

Locate DCs

Resolve-DnsName _ldap._tcp.dc._msdcs.exemple.local -Type SRV

Checks DC LDAP SRV registration.

Netlogon DNS registration

nltest /dsregdns

Asks a DC to register its DNS records again.

DC DNS diagnostics

dcdiag /test:dns /v

Runs AD DNS diagnostics; output can be long.

Common symptoms

NXDOMAIN

Le nom n’existe pas selon le résolveur interrogé

Check spelling, zone, delegation and negative cache.

SERVFAIL

Le serveur n’a pas pu produire une réponse valide

Check DNSSEC, authoritative timeouts, loops or zone errors.

Different answers

Split DNS / cache / géo-DNS

Compare resolvers and query authoritative servers directly.

Timeout

Pas de réponse DNS dans le délai

Check UDP/TCP 53, firewall, routing and DNS server health.

Key points

Avoid changing multiple critical records at once; lower TTL ahead of planned migrations.
A domain may work for HTTP while delegation or mail DNS is still wrong.
DNSSEC adds a validation chain; expired signatures can cause SERVFAIL.
In Active Directory, check DNS and time before Kerberos or secure-channel troubleshooting.

← All cheat sheets