--- tags: - networking - l1 - flashcard-deck - dns --- [Portal](../../../../library/portal/index.md) | **Level:** [L1: Foundations](../../../../library/portal/levels.md) | **Topics:** [DNS](../../../../library/portal/topics.md) | **Domain:** Networking id category difficulty tags question answer source_path dns/a3b7c1d2e4f0 dns easy dns, records, A, AAAA What happens when a client queries for an A record vs an AAAA record for the same hostname? An A record returns an IPv4 address (e.g., 10.0.1.50), while an AAAA record returns an IPv6 address (e.g., 2001:db8::1). Both can exist for the same hostname, and the client's network stack or application decides which to use (dual-stack). training/library/topics/dns-ops/primer.md dns/b4c8d2e5f1a3 dns easy dns, records, CNAME What happens when you create a CNAME record at the zone apex (e.g., example.com)? It violates the DNS RFC and is illegal. A CNAME at the zone apex conflicts with the mandatory SOA and NS records that must also exist there. Use ALIAS, ANAME, or A records instead if your DNS provider supports them. training/library/topics/dns-ops/primer.md dns/c5d9e3f6a2b4 dns easy dns, resolution, caching What happens when a recursive resolver receives a query for a domain it has never seen before? It walks the DNS hierarchy: first querying root servers (.) to find the TLD servers, then the TLD servers (e.g., .com) to find the authoritative nameservers, then the authoritative server for the final answer. Each response is cached per its TTL. training/library/topics/dns-ops/primer.md dns/d6eaf4a7b3c5 dns easy dns, records, MX What happens when you send email to a domain that has no MX record? The sending mail server falls back to the domain's A record as the delivery target (per RFC 5321). However, many modern mail systems treat missing MX records as suspicious, and email delivery may be unreliable or rejected by spam filters. training/library/topics/dns-ops/primer.md dns/e7fba5b8c4d6 dns easy dns, records, PTR What happens when a mail server receives email from an IP address that has no PTR record? Many receiving mail servers perform a reverse DNS lookup to verify the sender. A missing PTR record causes this check to fail, which often results in the email being rejected or marked as spam. PTR records are also used by SSH host verification and logging systems. training/library/topics/dns-ops/primer.md dns/f8acb6c9d5e7 dns medium dns, TTL, migration What happens if you change a DNS record's IP address while the TTL is set to 86400 seconds? Some clients and resolvers will continue using the old cached IP for up to 24 hours. The correct strategy is to lower the TTL to 60 seconds at least 48 hours before a planned migration, keep it low during the change, then raise it back to the normal value once the new IP is verified. training/library/topics/dns-ops/primer.md dns/a9bdc7dae6f8 dns medium dns, BIND, zone, SOA What happens when you edit a BIND zone file but forget to increment the SOA serial number? Secondary (slave) nameservers compare the serial to their cached copy. If the serial has not increased, they assume nothing changed and do not transfer the updated zone. The change only takes effect on the primary server, causing inconsistent DNS responses depending on which server a client queries. training/library/topics/dns-ops/primer.md dns/bacea8ebf7a9 dns medium dns, split-horizon What happens when an internal client resolves a hostname in a split-horizon DNS setup but is connected from an unexpected network? Split-horizon DNS uses BIND views with match-clients rules to serve different zone files based on the source IP. If a client connects from a network not matching the internal view (e.g., VPN misconfiguration), it falls through to the external view and receives the public IP instead of the private one, making internal services unreachable. training/library/topics/dns-ops/primer.md dns/cbdfb9fca8ba dns medium dns, dig, debugging What happens when you run "dig +trace" against a domain compared to a normal dig query? A normal dig query asks your configured recursive resolver and returns the final answer. "dig +trace" bypasses the recursive resolver and performs iterative resolution from the root servers down, showing each delegation step. This reveals where in the chain a resolution problem occurs. training/library/topics/dns-ops/primer.md dns/dceacafdb9cb dns medium dns, zone-transfer, security What happens when a DNS server is configured with "allow-transfer { any; }" instead of restricting zone transfers? Anyone on the internet can perform an AXFR query and download the entire zone file, exposing all hostnames, IP addresses, and internal network topology. Zone transfers should be restricted to secondary nameserver IPs only (e.g., allow-transfer { 10.0.1.11; }). training/library/topics/dns-ops/primer.md dns/edfbdbaea0dc dns hard dns, coredns, kubernetes, ndots What happens when a Kubernetes pod with the default ndots:5 setting tries to resolve "api.github.com"? Because "api.github.com" has fewer than 5 dots, the resolver first appends each search domain suffix (e.g., api.github.com.default.svc.cluster.local, api.github.com.svc.cluster.local, api.github.com.cluster.local) before trying the absolute name. This generates 4+ failed queries before the real lookup succeeds, adding latency. Override with dnsConfig for pods making many external calls. training/library/topics/dns-ops/primer.md dns/feacecbfb1ed dns hard dns, coredns, kubernetes What happens when CoreDNS in a Kubernetes cluster receives a query for a service name with no namespace qualifier? CoreDNS appends the pod's namespace from the search domain in /etc/resolv.conf. So a query for "my-service" from a pod in the "default" namespace resolves to my-service.default.svc.cluster.local. If the service exists in a different namespace, the lookup fails with NXDOMAIN unless the full name (my-service.other-ns) is used. training/library/topics/dns-ops/primer.md dns/abfdfdc0c2fe dns hard dns, DNSSEC What happens when a DNSSEC-validating resolver receives a DNS response with an invalid signature? The resolver rejects the response entirely and returns a SERVFAIL to the client, even if the underlying data is correct. This is by design — DNSSEC prioritizes authenticity over availability. A misconfigured DNSSEC zone (expired signatures, wrong keys) causes total resolution failure for validating resolvers, while non-validating resolvers continue to work. training/library/topics/dns-ops/primer.md dns/bcaeaed1d3af dns hard dns, records, SRV What happens when a client queries an SRV record and receives multiple entries with different priorities and weights? The client must first group entries by priority (lower number = higher priority) and attempt the lowest priority group first. Within the same priority group, entries are selected randomly proportional to their weight values. This enables both failover (via priority) and load distribution (via weight) at the DNS level. training/library/topics/dns-ops/primer.md dns/cdbfbfe2e4b0 dns hard dns, resolv.conf, search What happens when /etc/resolv.conf has "search example.com" and a user queries for a short name like "app"? The resolver first tries "app.example.com" (appending the search domain) before trying "app" as an absolute name. If an internal service named "app.example.com" exists, it resolves silently. This becomes dangerous when internal and external names collide — a query intended for an external service may resolve to an internal IP or vice versa, causing subtle routing or security issues. training/library/topics/dns-ops/primer.md dns/z1a2b3c4d5e6 dns easy dns,hierarchy,root What role do root nameservers play in DNS resolution? Root nameservers are the starting point for recursive resolution. They do not know individual domain answers but direct resolvers to the correct TLD nameserver (e.g., .com, .org). Their IP addresses are bootstrap data built into resolver software. zines/how.dns.works.wizard.zines.cleaned.notes dns/z2b3c4d5e6f7 dns easy dns,records,A,AAAA,difference What is the difference between an A record and an AAAA record? An A record maps a hostname to an IPv4 address. An AAAA record maps a hostname to an IPv6 address. Both can coexist for the same hostname (dual-stack).\n\nName origin: AAAA is called 'quad-A' because an IPv6 address is 4x the size of IPv4 (128 bits vs 32 bits).\n\nRemember: A = Address (IPv4). AAAA = quad-A (IPv6). CNAME = Canonical Name (alias). MX = Mail Exchange. NS = Name Server. PTR = Pointer (reverse DNS). zines/how.dns.works.wizard.zines.cleaned.notes dns/z3c4d5e6f7a8 dns medium dns,negative-caching,NXDOMAIN What is negative caching in DNS and why does it cause problems? Resolvers cache "does not exist" (NXDOMAIN) answers. If a record is queried before it is created, the NXDOMAIN may be cached, making the new record invisible to that resolver until the negative cache TTL expires.\n\nGotcha: the negative cache TTL comes from the SOA record's minimum field (last number in the SOA). Lower this before creating records that might be queried prematurely.\n\nDebug clue: if a newly created record does not resolve, wait for the SOA minimum TTL to expire, or flush the resolver cache. zines/how.dns.works.wizard.zines.cleaned.notes dns/z4d5e6f7a8b9 dns medium dns,resolver,lies Name three ways a recursive resolver can give misleading answers. Resolvers may: synthesize answers (e.g., redirect NXDOMAIN to a search page), block domains (filtering/censorship), or behave differently due to local policy (ISP-specific overrides). Comparing results from multiple resolvers reveals discrepancies. zines/how.dns.works.wizard.zines.cleaned.notes dns/z5e6f7a8b9c0 dns medium dns,dig,trace What does dig +trace do and when should you use it? It performs iterative resolution from root servers down, showing each delegation step. Use it to find where in the DNS chain a resolution problem occurs, bypassing your configured recursive resolver.\n\nExample: dig +trace example.com shows: root -> .com TLD -> example.com authoritative. If delegation fails at the TLD level, you know NS records are wrong at the registrar.\n\nRemember: dig +trace bypasses your local resolver. dig +short uses your resolver. Compare both to isolate whether the issue is caching or authoritative. zines/how.dns.works.wizard.zines.cleaned.notes dns/z6f7a8b9c0d1 dns medium dns,NS,delegation,glue What are glue records and when are they needed? Glue records are A/AAAA records for nameservers included in the parent zone's delegation. They are needed when the authoritative nameserver's hostname is inside the zone it serves (e.g., ns1.example.com serving example.com), to break the circular dependency. zines/how.dns.works.wizard.zines.cleaned.notes dns/z7a8b9c0d1e2 dns hard dns,nameserver-change,risk Why is changing authoritative nameservers riskier than changing individual records? Changing nameservers modifies the parent zone's NS delegation. This involves more moving parts: parent zone TTL, old NS still serving stale data, multiple cache layers. An A record change stays within one authoritative service. zines/how.dns.works.wizard.zines.cleaned.notes dns/z8b9c0d1e2f3 dns medium dns,TCP,UDP When does DNS use TCP instead of UDP? DNS uses TCP for: large responses that exceed the UDP limit (~512 bytes without EDNS), truncated responses (TC flag set), zone transfers (AXFR/IXFR), and newer encrypted transports like DNS-over-TLS.\n\nGotcha: firewalls that block TCP port 53 can break DNSSEC (large responses) and zone transfers. Always allow both TCP and UDP on port 53.\n\nFun fact: EDNS (Extension mechanisms for DNS, RFC 6891) increased the UDP payload size to 4096 bytes, reducing the need for TCP fallback. zines/how.dns.works.wizard.zines.cleaned.notes dns/z9c0d1e2f3a4 dns hard dns,getaddrinfo,application Why can dig and an application resolve the same hostname differently? Applications use getaddrinfo() which applies hosts file entries, NSS rules, search domains, local caching, and IPv4/IPv6 policy. dig bypasses all of this and queries DNS directly. The two can give different answers. zines/how.dns.works.wizard.zines.cleaned.notes dns/zad1e2f3a4b5 dns easy dns,records,NS What does an NS record specify? An NS record declares which nameservers are authoritative for a DNS zone. For example, example.com NS ns1.provider.com delegates authority for example.com to that nameserver.\n\nRemember: NS = Name Server. Every zone must have at least 2 NS records for redundancy. The parent zone (e.g., .com) holds the delegation NS records.\n\nGotcha: NS records at the zone apex and the parent zone must match. Mismatches cause 'lame delegation' — queries fail because the parent points to the wrong server. zines/how.dns.works.wizard.zines.cleaned.notes --- ## Wiki Navigation ### Related Content - [AWS Route 53](../../../../library/topics/aws-route53/index.md) (Topic Pack, L2) — DNS - [Case Study: CoreDNS Timeout Pod DNS](../../../../library/case-studies/kubernetes_ops/coredns-timeout-pod-dns/README.md) (Case Study, L2) — DNS - [Case Study: DNS Looks Broken — TLS Expired, Fix Is Cert-Manager](../../../../library/case-studies/cross-domain/dns-tls-certmanager/README.md) (Case Study, L2) — DNS - [Case Study: DNS Resolution Slow](../../../../library/case-studies/networking/dns-resolution-slow/README.md) (Case Study, L1) — DNS - [Case Study: DNS Split Horizon Confusion](../../../../library/case-studies/networking/dns-split-horizon-confusion/README.md) (Case Study, L2) — DNS - [DHCP & IP Address Management](../../../../library/topics/dhcp-ipam/index.md) (Topic Pack, L1) — DNS - [DNS Deep Dive](../../../../library/topics/dns-deep-dive/index.md) (Topic Pack, L1) — DNS - [DNS Operations](../../../../library/topics/dns-ops/index.md) (Topic Pack, L2) — DNS - Incident Simulator (18 scenarios) *(CLI)* (Exercise Set, L2) — DNS - [Networking Deep Dive](../../../../library/topics/networking/index.md) (Topic Pack, L1) — DNS