DNS reference for records, resolvers, authoritative servers, delegation, caching and Active Directory zones.
Record types
- A — Nom → IPv4IPv4 address for a hostname.
- AAAA — Nom → IPv6IPv6 address for a hostname.
- CNAME — Alias → nom canoniqueA CNAME points to a name, not directly to an IP address.
- MX — Mail servers and preference values. Lower numeric preference is tried first.
Other useful records
- TXT — Texte libre / SPF / validationsCan hold multiple independent purposes.
- NS — Serveurs DNS autoritairesShould match delegation and authoritative zone.
- PTR — Adresse IP → nomStored in a separate reverse zone.
- SRV — _service._proto → cible:portWidely used by Active Directory and service discovery.
Windows commands
- Standard lookup — Resolve-DnsName exemple.frShows answers, type, TTL and resolver.
- Query a specific DNS — Resolve-DnsName exemple.fr -Server 1.1.1.1Compares answers without changing NIC settings.
- MX — Resolve-DnsName exemple.fr -Type MXChecks mail targets and preferences.
- TXT — Resolve-DnsName exemple.fr -Type TXTUseful for SPF, SaaS validations and policies.
Linux / macOS commands
- Short dig — dig +short exemple.fr AMinimal output for scripts or quick comparisons.
- Full answer — dig exemple.fr AShows flags, authority, additional records and timing.
- Specific server — dig @8.8.8.8 exemple.fr AQueries a specific resolver.
- Delegation trace — dig +trace exemple.frFollows root, TLD and authoritative servers to diagnose delegation.
Authority, SOA & delegation
- SOA — Resolve-DnsName exemple.fr -Type SOAShows primary server, serial and zone timers.
- Parent delegation — dig +short exemple.fr NSCompare with the authoritative servers actually answering.
- Zone serial — SOA serial number. A secondary with an older serial may serve stale data.
- Glue records — Nameserver A/AAAA records in the parent zone. Required when a nameserver is inside the delegated domain.
Cache, TTL & propagation
- TTL — Cache lifetime in seconds. High TTL delays visibility of a published change.
- Negative caching — NXDOMAIN mis en cache selon SOAA fix may remain hidden until negative cache expires.
- Flush Windows cache — ipconfig /flushdnsOnly clears the local client cache.
- systemd-resolved cache — sudo resolvectl flush-cachesUse on systems running systemd-resolved.
Active Directory DNS
- Member DNS — DNS internes AD uniquementAD clients must resolve domain SRV records.
- Locate DCs — Resolve-DnsName _ldap._tcp.dc._msdcs.exemple.local -Type SRVChecks DC LDAP SRV registration.
- Netlogon DNS registration — nltest /dsregdnsAsks a DC to register its DNS records again.
- DC DNS diagnostics — dcdiag /test:dns /vRuns AD DNS diagnostics; output can be long.
Common symptoms
- NXDOMAIN — The queried resolver reports that the name does not exist. Check spelling, zone, delegation and negative cache.
- SERVFAIL — The server could not produce a valid response. Check DNSSEC, authoritative timeouts, loops or zone errors.
- Different answers — Split DNS / cache / geo-DNS. Compare resolvers and query authoritative servers directly.
- Timeout — No DNS response before the timeout. Check UDP/TCP 53, firewall, routing and DNS server health.
Key points
- Avoid changing multiple critical records at once; lower TTL ahead of planned migrations.
- A domain may work for HTTP while delegation or mail DNS is still wrong.
- DNSSEC adds a validation chain; expired signatures can cause SERVFAIL.
- In Active Directory, check DNS and time before Kerberos or secure-channel troubleshooting.