DNS
Most important commands to remember
dig NAME A— ask for IPv4 address records.dig NAME AAAA— ask for IPv6 address records.
Commands and flags
| Argument or option | Meaning |
|---|---|
example.com |
A reserved example domain used for these public DNS queries. |
A / AAAA |
Request IPv4 / IPv6 address records. |
+time=2 / +tries=1 |
Set a two-second query timeout and one UDP attempt. |
Without an explicit server, dig uses the configured resolver. DNS queries can populate caches but do not change authoritative records.
The concepts that matter
1. DNS maps names to typed records
DNS, the Domain Name System, stores records under names. An A record holds an IPv4 address; AAAA holds IPv6. Other record types describe mail routing, aliases, or service information.
A name is not necessarily one machine. It can have several addresses, and different names can share an address. Resolving a website name finds addressing information; it does not fetch the page or check its certificate.
2. Resolvers find answers from authorities
A recursive resolver answers on behalf of clients, using cached data or consulting the DNS hierarchy. Authoritative servers publish records for zones they serve. Delegations connect the hierarchy from the root toward the relevant zone.
Your laptop usually asks a resolver rather than independently querying every authoritative server. Split DNS can intentionally return different answers inside and outside a private network. Always consider which resolver answered.
3. TTL controls reuse, not packet lifetime
A DNS record’s TTL is a cache lifetime in seconds. Resolvers can reuse an answer while its cached lifetime remains valid. Changing an authoritative record does not instantly replace every already cached answer.
This TTL is different from the hop budget in an IP header. A decreasing DNS TTL in repeated queries can reflect cache aging, not a worsening network path. Negative answers can also be cached according to DNS rules.
4. An answer and a failure are different observations
NXDOMAIN means the queried name does not exist according to the response. NOERROR with no answer of the requested type can mean the name exists but lacks that record type. SERVFAIL means the resolver could not complete the query successfully.
A timeout supplies no DNS answer at all. It can reflect an unreachable resolver, dropped traffic, or an overloaded service. DNS success still does not prove that the returned address accepts your application’s connection.
One small example
Optional: run these two queries from a terminal with BIND dig. They contact your configured DNS resolver.
dig example.com A +time=2 +tries=1
dig example.com AAAA +time=2 +tries=1Read the header status, then the ANSWER SECTION. Each record shows a name, TTL in seconds, class (usually IN), type, and value. The SERVER line identifies the responder, which may be a local forwarding stub rather than the ultimate recursive resolver.
Compare A and AAAA independently; do not assume that one successful lookup guarantees the other has answers. Actual addresses, record counts, TTLs, and timing can change. No records shown is not automatically an error: inspect the status and authority section.
These commands bypass some application-specific name-resolution paths, so browser caches or local hosts-file behavior may differ. No cleanup is needed.
Keep this idea: DNS answers a name-and-record-type question; check the resolver, status, and TTL before testing the application.