Six DNS records worth knowing
IPv4 address
IPv6 address
DNS hostname alias
Mail exchangers
Verification and policy text
Service location (e.g. Active Directory)
Simple definition
DNS stands for “Domain Name System”. DNS lets you use easy-to-remember names, such as boiteaoutilsinformatique.fr, instead of entering a server’s IP address directly.
Technical definition
The Domain Name System is a distributed, hierarchical naming system. Resolvers query DNS servers for records such as A, AAAA, CNAME, MX or TXT and temporarily cache the answers.
- Browser Requests a hostname
- DNS resolver Handles the query
- DNS cache May already have an answer
- DNS servers Queried when necessary
- IP address A or AAAA response
When a valid cached answer exists, the resolver does not need to query the authoritative servers again.
What is it used for?
DNS is used to find a website’s address, locate a mail server, or allow computers in a Windows domain to discover domain controllers and other services.
Practical example
Before opening a website over HTTPS, a browser resolves the site’s domain name to an IP address and then connects to the corresponding server.
Common issues
- DNS server unavailable
- Missing or incorrect DNS record
- Stale answer stored in cache
- Propagation delay after a DNS change
What happens during a DNS lookup?
A device normally asks a recursive resolver operated by its organization, ISP or a public DNS provider. The resolver first checks its cache. If no valid answer is available, it may follow the DNS hierarchy: root servers, top-level domain servers and the authoritative nameservers for the requested domain. The reply may contain an IPv4 address (A), an IPv6 address (AAAA) or a canonical-name alias (CNAME). Establishing an HTTPS connection happens afterward: a DNS answer alone does not mean the website is reachable.
The Time To Live (TTL) controls how long a response may be cached. After DNS changes, different resolvers can temporarily return different answers until cached records expire.
What do common DNS records represent?
- A maps a hostname to IPv4; AAAA maps it to IPv6.
- CNAME points to another DNS name that must be resolved; standard DNS imposes restrictions, including on CNAME use at a zone apex.
- MX lists mail reception servers for a domain with relative priorities.
- TXT stores text values frequently used for SPF, ownership checks and other policies.
- NS identifies authoritative nameservers; SRV locates particular services and ports, including services used by Active Directory.
Internal DNS, public DNS and security
Organizations may use public DNS zones for Internet-facing names and separate internal DNS zones for servers, workstations and Active Directory. Domain-joined Windows devices commonly rely on domain-controller SRV records to discover authentication services. Changing only the DNS settings used by a browser therefore cannot be assumed to fix a domain sign-in failure.
Traditional DNS traffic is generally not encrypted. DNS over HTTPS and DNS over TLS protect transport to the resolver, while DNSSEC validates signed DNS data. They solve different problems and none proves that the destination website is trustworthy.
Related terms
Key takeaway: DNS resolves names and locates services; caching, authoritative zones and published records explain many differences between clients.
Recursive and authoritative resolution
When an application looks up an address, it usually queries the resolver configured on its device. That resolver may answer from cache; otherwise it follows the DNS hierarchy through root servers, top-level domain servers and the authoritative servers for the requested zone. Authoritative servers publish records for their zones; recursive resolvers perform the lookup work on behalf of clients. The distinction helps isolate whether a failure originates at the workstation, cache, resolver provider or authoritative zone.
Common DNS record types
A and AAAA map names to IPv4 and IPv6 addresses. CNAME defines an alias to another name, while MX identifies mail exchangers with priorities. TXT supports SPF and other domain verification or policy data; SRV identifies a service endpoint using priority, weight and port. NS delegates a zone to name servers. SOA contains essential zone metadata. PTR supports reverse resolution when the appropriate reverse zone is configured.
TTL, caching and propagation
TTL specifies how long a DNS response can be cached by resolvers. Changing an address in a zone does not erase previously cached answers: clients may continue receiving the old value until its TTL expires. Before migrations, lower relevant TTLs ahead of time, verify the served values and keep old endpoints available during the transition if needed. DNS 'propagation' often mainly refers to caches expiring rather than a single update being broadcast simultaneously to every server.
Internal DNS and Active Directory
Active Directory depends on DNS to locate domain controllers. Workstations query SRV records such as _ldap._tcp.dc._msdcs.domain before connecting to appropriate services. If domain devices query only a public resolver that cannot resolve internal zones, domain sign-in, Group Policy and related services can fail. AD-integrated DNS servers may forward external lookups while answering authoritatively for internal zones. Check AD sites and subnet mappings when clients select an unexpected domain controller.
Step-by-step troubleshooting
Start by checking the exact queried name, client resolver address and expected record type. On Windows, ipconfig /all shows DNS settings; Resolve-DnsName name.example -Type A provides a focused lookup. Comparing answers from internal resolvers, authoritative servers and an external resolver using nslookup or dig can reveal stale caches or incorrectly published zones. Then inspect CNAME chains, NXDOMAIN or SERVFAIL responses, TTLs and UDP/TCP reachability on port 53. A correct DNS answer does not guarantee that the application port is reachable or that the service works.
DNS security, DNSSEC and encrypted DNS
DNSSEC provides signatures so validating resolvers can verify authenticity and integrity of signed data along a chain of trust; it does not encrypt queries. DoT and DoH encrypt transport between clients and resolvers, but do not guarantee answer correctness without other appropriate security controls. Audit zone changes, secure registrar and DNS-console access, restrict zone transfers and monitor critical record changes. For mail domains, verify SPF, DKIM, DMARC and MX as separate DNS-based configurations.