“When a website won’t open, which part of DNS should you suspect?”
“I don’t know where to look in the output of dig.”
DNS is the mechanism that runs at the start of almost every connection: browsing the web, delivering email, signing in to Active Directory, and calls between cloud services. Most of the time nobody notices it. But when it stops, or returns a wrong answer, it shows up as a failure whose cause is hard to see.
The 12-part series “DNS Fundamentals” explains what happens behind the scenes when a name is looked up, starting with the key players and the flow of delegation, and aims to get you to the point where you can design DNS and isolate failures on your own. This page is the entry point to the series: it summarizes what each part covers and the order to read them in.
What you will learn
- The big picture of name resolution: the three key players (stub resolver, caching DNS server, and authoritative DNS server) and the flow of a single lookup
- How DNS is structured: the domain name hierarchy, the root and TLDs, zones and delegation, caching and TTL
- How to write records: from SOA, NS, A/AAAA, and CNAME to MX, SPF, DKIM, DMARC, SRV, PTR, CAA, and HTTPS records
- Operations and investigation: zone transfers, TTL design and safe change procedures, and how to read the output of dig, nslookup, and Resolve-DnsName
- Protecting and using DNS: cache poisoning and DNSSEC, encrypted DNS, and how DNS is used in Route 53, AD-integrated DNS, and Kubernetes
- Troubleshooting and design: isolation steps, common failures, and design exercises based on five cases
Specifications and figures are current as of September 2026.
Who this series is for
- People who have just started working with servers or networks and want to learn DNS from the basics
- People who want to be able to isolate a failure on their own when they suspect DNS
- People who want to safely change zones and records, transfer domains, or move sites
- People who want to organize their thinking about DNS when designing AWS (Route 53) or Active Directory
Reading order
The 12 parts are divided into three groups. If you are new to DNS, read from Part 1 in order. Each article takes about 15 minutes to read.
How it works (Parts 1–4)
How DNS grew out of the hosts file, the two steps of name resolution, the roles of the stub resolver, caching DNS, and authoritative DNS, and the flow of a single lookup.
- The Domain Name Hierarchy and Delegation: Understanding the Root, TLDs, Zones, and Glue (November 15, 2026)
The tree structure of domain names, the root and TLDs, FQDNs and the trailing dot, the difference between a domain and a zone, delegation (NS) and glue, registries and registrars.
- How Name Resolution Works: Recursive and Iterative Queries, Caching and TTL, and Forwarding (November 16, 2026)
Recursive and iterative queries, caching and TTL, negative caching, forwarding, and how the stub resolvers in Linux and Windows behave.
- DNS Messages and Transport: Reading UDP/TCP, EDNS, and Response Codes (November 16, 2026)
The five sections of a message and its flags, when UDP and TCP are used, EDNS(0) and the reason for 1232 bytes, RCODEs and Extended DNS Errors (EDE).
Records and operations (Parts 5–8)
- Resource Records, Part 1: Writing Zone Files, SOA, NS, A/AAAA, and CNAME (November 17, 2026)
How to write a zone file and the trailing-dot pitfall, SOA, NS, A/AAAA, CNAME, ALIAS for pointing the zone apex at another name, and wildcards.
- Resource Records, Part 2: MX, SPF, DKIM, DMARC, SRV, PTR, CAA, and HTTPS Records (November 17, 2026)
MX and email sender authentication (SPF, DKIM, DMARC), SRV used by AD, PTR for reverse lookup, CAA for certificates, and HTTPS/SVCB records.
- Running Authoritative DNS Servers: Zone Transfers, TTL Design, and Safe Change Procedures (November 18, 2026)
Primary and secondary servers, zone transfers, serial numbers, TTL design and how to change records before a migration, split horizon, and choosing a DNS product.
- Investigating with Commands: How to Read dig, nslookup, Resolve-DnsName, and resolvectl (November 18, 2026)
How to read the output of dig and its main options, +trace, delv, nslookup, Resolve-DnsName, resolvectl, and packet captures.
Protect, use, and fix (Parts 9–12)
- DNS Security: Cache Poisoning, DNSSEC, Encrypted DNS, and Operational Gaps (November 19, 2026)
Cache poisoning, DNSSEC and the chain of trust, the root KSK rollover, reflection attacks, subdomain takeover, and DoT, DoH, and DoQ.
- DNS in the Cloud and on Corporate Networks: Route 53, Hybrid Name Resolution, AD-Integrated DNS, Kubernetes (November 19, 2026)
Route 53 hosted zones and routing, DNS in a VPC and Resolver endpoints, hybrid name resolution, AD-integrated DNS, and CoreDNS in Kubernetes.
- DNS Troubleshooting: Isolation Steps, Common Failures, and a Series Wrap-Up (November 20, 2026)
Isolating problems in the order client → caching DNS → authoritative DNS → delegation, common failures such as “changes not showing up” and SERVFAIL, and a quick-reference sheet for the series.
- DNS Design Exercises: AD Domain Names, Site Migration, Hybrid DNS, Outage Response, and a Domain Review (November 20, 2026)
Five exercises: an AD domain name, moving a site without downtime, name resolution between on-premises and AWS, isolating an outage, and reviewing your domains.
Where to start for your problem
If you don’t have time to read everything, start with the part closest to your problem.
| Your problem or question | Start with |
|---|---|
| Names don’t resolve, or a site won’t open for only some users | Part 11 → Part 8 |
| You changed a record but the change isn’t showing up | Part 3 (caching and TTL) → Part 7 (change procedures) |
| You can’t read the output of dig or nslookup | Part 8 → Part 4 |
| Email isn’t delivered, or you want to stop spoofing | Part 6 |
| You are moving a server or a website | Part 7 → Part 12 |
| You are designing DNS for AWS or Active Directory | Part 10 → Part 12 |
| You want to know about attacks on DNS and how to defend against them | Part 9 |
Frequently asked questions
How much background knowledge do I need?
It is enough if you have heard of IP addresses, port numbers, and UDP and TCP. Terms are explained where they first appear.
Which part should I start with?
If you are new to DNS, read from Part 1 in order. Once you have the big picture from Parts 1–3, the later parts are easier to follow. If you have a specific problem, you can also start from “Where to start for your problem” above.
How current is the information?
Specifications and figures are current as of September 2026. The basic mechanisms of DNS rarely change, but product features and security trends do, so dates are given in the articles where it matters.
Is this the same as the Japanese series?
Yes. This is the English edition of the Japanese series 【DNS入門】. The text and diagrams have been translated into English, and the example domain names use .com instead of .jp.