DNS fundamentals, troubleshooting, security, and practical workflows -- written by the team that builds this tool.
A CNAME aliases a name, not an address
www.example.com
CNAME record
cdn.provider.net
target hostname
192.0.2.10
A record, final answer
Understand how CNAME records create alias chains, how resolvers reach A and AAAA addresses, and what to check when a chain breaks.
Three roles, often three different companies
Learn how parent zones delegate domains to authoritative nameservers and why editing records at the wrong DNS provider has no public effect.
One hostname, several A records
1st answer
93.184.216.34
2nd answer
93.184.216.35
3rd answer
93.184.216.36
The resolver hands back every record, usually in rotating order
Four different mechanisms produce several addresses for one name. Telling them apart explains why your answer differs from someone else's.
Picking a TTL in practice
Copy-paste commands for every platform — and the diagnostic that tells you whether flushing will help before you bother.
Public vs. private address space
Public IP
192.0.2.10
globally unique -- routable from anywhere
Private ranges
not routable on the public internet
Your device has two addresses at once, and only one of them exists on the internet. Here is why, and what the reserved ranges mean.
Reverse DNS runs the lookup backwards
IP address
93.184.216.34
the starting point
PTR lookup
in-addr.arpa -- their zone, not yours
Hostname
the answer
The reverse zone belongs to whoever owns the IP block -- not the domain owner
The lookup that runs backwards — why your hosting provider controls it, and why missing it quietly sends your email to spam.
What is actually behind the address you resolved
Shared IP
Many sites on one address -- the Host header picks yours
Dedicated IP
Only you -- you control its reverse DNS
CDN edge
Not the origin -- the edge terminates the connection
The honest answer: most websites do not need a dedicated IP. Here is when it genuinely matters, and which supposed benefits are myths.
Why a lookup shows the CDN, not the origin
Visitor
looks up the domain
CDN edge
104.21.x.x
this is what DNS returns
Origin server
real IP, never exposed
Looked up a domain and got a Cloudflare address? That is the system working correctly. Here is what sits behind it and why you cannot see through.
Picking a TTL in practice
DNS TTL decides how fast your changes take effect. Learn what TTL means, how to look up a domain's TTL with dig, and which value to pick.
"Propagation" is really just caches expiring
0 min
you save the change
0-5 min
your DNS host updates
up to TTL
old answer still cached
after TTL
everyone sees the new one
Nothing is pushed anywhere -- each cache just stops reusing its copy
Nothing propagates anywhere. Understanding what actually happens during the wait tells you exactly how long it will take and how to shorten it.
A recursive DNS lookup, one hop at a time
Browser
wants example.com
Resolver
your ISP / 1.1.1.1
Root + TLD
who runs .com?
Authoritative
the real answer
Every hop down this chain is itself a DNS lookup, cached afterward
The single setting that decides which provider controls your DNS — and the reason your record edits sometimes have no effect at all.
The records you will meet in nearly every zone
Three TXT records stand between your email and the spam folder. What each one does, how to read the syntax, and the safe order to deploy them.