DNS FAQ

What is DNS?

DNS, the Domain Name System, is how names turn into the things computers need. When you type example.com into a browser, DNS is what finds the IP address of the server to connect to. It also says where email for the domain should be delivered, and it holds other settings such as the domain's nameservers and which certificate authorities may issue certificates for it. It works a bit like a phone book that anyone can read.

What is a DNS lookup?

A DNS lookup is a question sent to a DNS server, such as "what is the A record for example.com?", and the answer that comes back. Each kind of information is stored as a record type: A for IPv4 addresses, AAAA for IPv6, MX for mail servers, TXT for free-form text, and so on. digwolf looks up 13 record types and shows the answers together. Try it on iana.org, for example.

Why aren't my DNS changes showing up?

Caching is a common cause, though not the only one. DNS servers keep answers for a while so they don't have to ask again for every request, and the length of time is set by each record's TTL. Until the old answer expires, a resolver can keep serving it. A resolver that recently found that a name didn't exist can also remember that for a short time.

Some things to check:

• Look at the TTL the record had before you changed it. That's roughly how long the old value can linger.
• Check that you changed the record where the domain's DNS is actually hosted. If the domain's nameservers point to one provider and you edited records at another, nothing changes.
• Check the record itself for mistakes, such as a typo in the name or value, or a record added under the wrong name.
• Changing the nameservers themselves can take longer, because the records that point to them are kept by the parent zone and often have long TTLs, sometimes up to 48 hours.
• Look the domain up on digwolf to see what a public resolver says now. digwolf's own resolver keeps answers for five minutes at most.

Your own computer, browser and router also keep DNS caches, so a lookup tool can show the new value before your machine does.

What is DNS TTL?

TTL stands for time to live. It's a number of seconds attached to a record that tells resolvers how long they may keep the answer before asking again. A TTL of 300 means five minutes, and 3600 means an hour. Low TTLs make changes show up sooner but mean more queries. High TTLs reduce load but make changes slower to spread. A common habit is to lower the TTL a day or so before a planned change, then raise it again afterwards.

The TTL you see in digwolf is what the resolver reports, which counts down while the answer sits in its cache. It can be lower than the value configured in the domain's zone.

What is the difference between NXDOMAIN and a missing DNS record?

NXDOMAIN means the name itself doesn't exist: no records of any type. That points to a typo, a domain that isn't registered or has expired, or a subdomain that was never created.

A missing record is different. The name exists, but it has no record of the type you asked for. For example, a domain can have an A record and no MX record. DNS servers answer this with an empty, successful response, often called NODATA. digwolf shows this as "No records" for that type, and shows a separate notice when the whole name doesn't exist.

What does DNSSEC validation failed mean?

DNSSEC adds digital signatures to DNS records so a resolver can check they haven't been altered. A validation failure means the signatures didn't check out. Common causes are expired signatures, or a mismatch between the DS record at the registrar and the keys the domain's DNS now uses, which often happens after moving DNS providers.

Resolvers that validate DNSSEC refuse to return the data and report an error (SERVFAIL). Resolvers that don't validate keep working, which is why a domain can look fine for some people and be unreachable for others. When digwolf's first resolver reports a DNSSEC failure, it asks a second validating resolver as well and shows both results. You can see a deliberately broken example at dnssec-failed.org.

Why might different DNS resolvers return different answers?

Several ordinary things can cause it:

• Caching. Each resolver cached the answer at a different moment, so after a change some still hold the old one.
• Location. Large sites and CDNs deliberately return different addresses depending on where the question comes from.
• DNSSEC. A validating resolver refuses a broken answer that a non-validating one happily returns.
• Filtering. Some resolvers block certain domains, such as malware or ad domains.

digwolf shows which resolver gave each answer. If its resolvers disagree about DNSSEC, it says so instead of choosing quietly.

What are MX records used for?

MX records say which servers accept email for a domain. Each has a priority number, and the lowest number is tried first. If that server is down, senders try the next one. An MX record points to a hostname, not an IP address, and that hostname needs its own A or AAAA record. It shouldn't be a CNAME. If a domain has no MX records at all, senders fall back to its A or AAAA record, which is rarely what you want.

What are TXT records?

TXT records hold text. They started as a place for notes and are now used mostly for machine-readable settings: SPF lists the servers allowed to send email for a domain, and services such as Google, Microsoft and certificate authorities ask you to add a TXT record to prove you control a domain. A name can have several TXT records, and a long value is stored as several strings that are joined together.

Some email settings live at other names. DMARC is at _dmarc followed by the domain, and DKIM keys sit under _domainkey. You can enter names like these into digwolf directly.

What is the difference between authoritative and recursive DNS?

An authoritative server holds the actual records for a domain and gives the official answer. A domain's NS records say which servers those are, and they're usually run by a DNS host or registrar.

A recursive resolver does the searching for you. It starts at the root, follows the chain of nameservers to the authoritative one, and keeps the answer for the TTL. Your internet provider, Cloudflare (1.1.1.1) and Google (8.8.8.8) run recursive resolvers. digwolf talks to recursive resolvers, so it shows what they currently hold, not necessarily what the authoritative server would say this second.