Recall reference for engineers. Not "phone book for the internet" — the actual resolution chain, caching layers, record types, transport, and the gotchas that cause 3am incidents.
Your app calls getaddrinfo() → the OS stub resolver asks a recursive resolver (ISP/1.1.1.1/8.8.8.8). If uncached, the recursor walks the hierarchy iteratively: root (→ TLD servers) → TLD (→ authoritative NS) → authoritative (→ the answer). Every hop is cached with a TTL. Transport is UDP/53 (TCP fallback for large/zone-transfer, EDNS0 for bigger UDP, DoT/DoH for encryption). "Propagation" isn't a thing — you're just waiting out cached TTLs.
| Actor | Role |
|---|---|
| Stub resolver | In the OS/libc (getaddrinfo). Dumb: forwards one query, expects a full answer. Reads /etc/resolv.conf, nsswitch, hosts file. Has its own tiny cache (e.g. systemd-resolved, mDNSResponder). |
| Recursive resolver | The workhorse (ISP, 1.1.1.1, 8.8.8.8). Does the actual walking, holds the big cache. This is what resolv.conf points at. |
| Root & TLD servers | Authoritative only for delegations, not final answers. Root (13 named letters, anycast to 1000s of instances) points to TLD servers; TLD (.com) points to the domain's authoritative NS. |
| Authoritative NS | Holds the real records for a zone (your Route53 / Cloudflare / NS1). The source of truth; sets the TTLs everyone else caches by. |
The stub asks the recursor a recursive query ("give me the final answer"). The recursor asks root/TLD/auth iterative queries ("give me the answer or a referral to who's closer"). Two different query modes, one lookup.
Resolving shop.example.com A record with an empty cache:
.com. (Root hints are baked in — the one bootstrap.)example.com (+ glue A records so you don't loop resolving the NS names).aa flag set), with a TTL..com or example.com skips the earlier hops.If example.com's NS is ns1.example.com, you can't resolve the NS without already resolving the zone → chicken/egg. The parent zone ships glue (the NS's A record) in the referral to break it.
A query can be answered at any of these — first hit wins, so debugging means knowing which layer lied to you:
Nothing propagates. Authoritative changes are instant. What you wait for is downstream caches expiring their TTL. Pre-lower TTL to 60s a day ahead → near-instant cutover.
| Type | Purpose / gotcha |
|---|---|
| A / AAAA | name → IPv4 / IPv6. |
| CNAME | alias → another name. Can't coexist with other records at the same name, so never at the zone apex (apex needs SOA/NS). Providers fake apex aliasing via ALIAS/ANAME/flattening. |
| NS | Delegation — who's authoritative for a zone. Must match at parent (registrar) and child. |
| SOA | Zone metadata: primary NS, serial, refresh/retry/expire, and the minimum (negative-cache TTL). |
| MX | Mail servers + priority. Points to a name (which needs an A/AAAA — not a CNAME per spec). |
| TXT | SPF / DKIM / DMARC / domain verification. Watch the 255-char string chunking. |
| PTR | Reverse (IP → name) in in-addr.arpa. Matters for mail deliverability. |
One message, five sections. Query and response share the format — the response echoes your question and appends answers.
Header id(16) | flags(QR OPCODE AA TC RD RA RCODE) | qd/an/ns/ar counts Question QNAME (length-prefixed labels) | QTYPE | QCLASS Answer RRs: NAME TYPE CLASS TTL RDLENGTH RDATA Authority NS RRs (referrals live here) Additional glue / EDNS0 OPT pseudo-record
| Mode | When |
|---|---|
| UDP/53 | Default. Fast, one datagram. If response > 512B (classic) it sets TC. |
| EDNS0 | OPT record advertises larger UDP buffers (e.g. 1232B), avoiding TCP for moderately large answers. Required for DNSSEC. |
| TCP/53 | Truncated responses, and zone transfers (AXFR/IXFR between primary/secondary NS). |
| DoT / DoH | DNS over TLS (853) / HTTPS (443). Encrypts stub↔recursor — privacy, not integrity. |
| DNSSEC | Signs records (RRSIG/DNSKEY/DS) so the resolver can verify authenticity. Failed validation → SERVFAIL. Solves spoofing, not privacy. |
dig +trace name — walk root→TLD→auth yourself.dig @1.1.1.1 name vs @auth-ns — isolate cache vs source.TTL countdown across repeated digs to spot who's caching.