DNS

DNS maps names to addresses and service endpoints. Its caching, TTLs, and record types shape failover speed, latency, and how users reach your system.

networking

Definition

The Domain Name System (DNS) is a hierarchical, distributed naming system that resolves human-readable names into IP addresses and other records, using recursive resolvers, authoritative servers, delegation, and TTL-based caching.

Context and scope

DNS is the first network dependency for nearly every request. It also carries mail routing, service discovery through SRV records, and verification records for certificates, so mistakes can take down email and certificate issuance as well as web traffic.

Common misconceptions

DNS changes propagate instantly once saved
A lower TTL guarantees fast and reliable failover
DNS is only about mapping names to IPv4 addresses

Anti-patterns

Setting TTLs of 24 hours on records used for failover
Running critical services on a single DNS provider with no secondary
Placing a CNAME at a zone apex where it is not supported

Related concepts

Authoritative source

https://www.rfc-editor.org/rfc/rfc1035.html

How it works

Resolution walks a hierarchy: browser and operating system caches, the recursive resolver, the root servers, the TLD servers, and finally the authoritative nameserver for the zone. Each answer is cached for its TTL, and negative answers are cached too. Records include A and AAAA for addresses, CNAME for aliases, MX for mail, NS for delegation, TXT for verification and policy, and CAA for certificate authorities.

dig +short api.example.com A
dig +noall +answer example.com MX
dig +trace www.example.com

When to use it

DNS is involved in every request, so use it deliberately for failover, CDN routing, mail, and service discovery. For failover, lower TTLs before an expected change, use health-checked records or a global traffic manager, and keep a secondary provider. Compared with load balancers, which react in milliseconds, DNS failover is coarse and limited by resolver caching.

Trade-offs

Low TTLs speed failover but raise query volume and cost, and some resolvers respect TTLs poorly. High TTLs reduce load but delay changes. DNS-based failover cannot see per-user health, and clients may cache addresses for the life of a process. DNSSEC adds integrity but also operational risk during key rollover.

Concrete example

During a regional outage, a team updates a health-checked record to the standby region. Because the record TTL is 60 seconds, most users move within minutes, but a mobile carrier resolver keeps the old address for ten minutes, so the team pairs DNS failover with client retries and connection timeouts.

DNS changes do not propagate instantly; they expire from caches. A low TTL does not override resolvers or application-level caches, and DNS is not only about A records. Related concepts include Content Delivery Network, TLS, and HSTS.

DNS