.png)
DNS is the internet's distributed directory — it translates human-friendly names like idenety.com into the IP addresses machines use. It's so fundamental that when DNS breaks, everything appears "down." This is the detailed guide.
The resolution chain
When a device needs www.idenety.com, the query passes through four roles:
- Recursive resolver — does the legwork and caches results (usually at your ISP or a public resolver like 1.1.1.1 or 8.8.8.8).
- Root servers (.) — refer the resolver to the correct TLD servers.
- TLD servers (.com) — refer to the domain's authoritative servers.
- Authoritative server — the source of truth that returns the actual record.
Each answer is cached for its TTL (Time To Live), so repeat lookups are instant until it expires.
Recursive vs. iterative vs. authoritative
- Recursive query: "Get me the final answer" — the resolver keeps asking on your behalf.
- Iterative query: each server returns a referral to the next server.
- Authoritative answer: comes from the server that holds the zone, not from cache.
The zone file & record types
| Record | Purpose | Common use |
|---|---|---|
| A / AAAA | Name → IPv4 / IPv6 address | Point domain to server |
| CNAME | Alias one name to another | www → apex, CDN hostnames |
| MX | Directs email to mail servers (priority-ordered) | Microsoft 365, Google Workspace |
| NS | Delegates the zone to authoritative servers | Nameserver delegation |
| SOA | Start of Authority — serial, refresh, default TTL | Zone metadata |
| TXT / SPF | Text records; authorize mail senders | Email authentication |
| DKIM | Public key to verify signed outbound mail | Email integrity |
| DMARC | Policy for SPF/DKIM failures + reporting | Email fraud prevention |
| SRV | Locates services (SIP, Autodiscover) | VoIP, Teams, Exchange |
| CAA | Declares which CAs may issue TLS certs | Certificate issuance control |
DNSSEC — integrity & authenticity
Plain DNS can be spoofed via cache poisoning. DNSSEC cryptographically signs records (RRSIG) and validates them up a chain of trust from the root — guaranteeing the answer wasn't tampered with. Note it provides integrity, not confidentiality.
Encrypted DNS: DoH & DoT
Traditional queries are plaintext and visible to anyone on the path. DoT (DNS over TLS, port 853) and DoH (DNS over HTTPS, port 443) encrypt them for privacy — critical for roaming users and zero-trust environments.
Anycast — the architecture behind fast, resilient DNS
With Anycast, the same IP is announced from many global locations via BGP, so each user is routed to the nearest, healthiest node. See our Anycast guide for the full architecture.
Contact our engineers to discuss DNS architecture, DNSSEC implementation, or email authentication hardening.