DNS Deep Dive — From Domain Name to Your VPS

We now go one layer deeper.

You already understand:

Browser
 ↓
Domain
 ↓
DNS
 ↓
IP
 ↓
Network
 ↓
Port 443
 ↓
Nginx
 ↓
WordPress

The question now is:

How does DNS actually turn learn.cresignsys.com into an IP address?

---

1. Domain Name Is Not the Server

When you type:

learn.cresignsys.com

your computer does not initially know where that server is.

It needs DNS.

Think:

learn.cresignsys.com
        ↓
      DNS
        ↓
   IP address
        ↓
      server

---

2. DNS Means Domain Name System

DNS is essentially a distributed naming system.

It maps names to information such as:

domain → IPv4 address
domain → IPv6 address
domain → mail server
domain → another domain

and more.

---

3. Why DNS Exists

Humans prefer:

learn.cresignsys.com

Computers ultimately need network addresses such as:

203.0.113.25

So DNS provides the translation mechanism.

---

4. Domain Hierarchy

Look at:

learn.cresignsys.com

Break it apart:

learn
   .
cresignsys
   .
com

There is also an invisible final dot:

learn.cresignsys.com.

That final dot represents the DNS root.

---

5. DNS Root

At the top is:

.

called the:

Root

Below the root are:

com
org
net
in
...

These are:

TLDs

Top-Level Domains.

---

6. TLD

For:

cresignsys.com

the TLD is:

com

For:

example.in

the TLD is:

in

---

7. Domain

In:

learn.cresignsys.com

the registered domain is:

cresignsys.com

and:

learn

is a subdomain label.

---

8. Subdomain

Therefore:

learn.cresignsys.com

means approximately:

learn
 ↓
cresignsys.com
 ↓
com
 ↓
root

The DNS hierarchy works from right to left.

---

9. Example

Consider:

shop.cresignsys.com

Hierarchy:

.
└── com
    └── cresignsys
        └── shop

---

10. Root Servers

The DNS root system points resolvers toward the appropriate TLD name servers.

Conceptually:

Resolver
   ↓
Root
   ↓
.com servers
   ↓
cresignsys.com authoritative servers
   ↓
shop.cresignsys.com

---

11. TLD Servers

The .com infrastructure knows which authoritative nameservers are responsible for:

cresignsys.com

It doesn’t necessarily contain the final IP address for every subdomain.

It directs the resolver to the authoritative DNS service for the domain.

---

12. Authoritative Nameserver

The authoritative DNS server is the source of truth for the DNS zone.

For example:

cresignsys.com
      ↓
authoritative nameserver
      ↓
DNS records

---

13. DNS Zone

A DNS zone contains records such as:

A
AAAA
CNAME
MX
TXT
NS
CAA

and others.

---

14. A Record

The most important record for basic web hosting:

A

It maps a hostname to an IPv4 address.

Conceptually:

learn.cresignsys.com
        ↓
A
        ↓
203.0.113.25

---

15. Example

A DNS zone might contain:

learn     A     203.0.113.25

This means:

learn.cresignsys.com
        ↓
203.0.113.25

assuming learn is within the cresignsys.com zone.

---

16. AAAA Record

For IPv6:

AAAA

Example:

learn.cresignsys.com
        ↓
AAAA
        ↓
2001:db8::25

---

17. A vs AAAA

Remember:

A
=
IPv4

AAAA
=
IPv6

---

18. Why IPv6 Can Cause Confusion

Suppose you configure:

A
↓
correct IPv4

but also have:

AAAA
↓
incorrect IPv6

Some clients may attempt IPv6 connectivity and encounter problems.

Then you might see:

Website works on one network
Website fails on another

even though the IPv4 configuration is correct.

---

19. CNAME

Another important record:

CNAME

It maps one hostname to another hostname.

Example:

www.cresignsys.com
        ↓
CNAME
        ↓
cresignsys.com

Conceptually:

www
 ↓
cresignsys.com
 ↓
A/AAAA
 ↓
IP

---

20. CNAME Is Not an IP Address

An A record contains:

hostname → IPv4

A CNAME contains:

hostname → hostname

This distinction matters.

---

21. Example

You might configure:

shop.cresignsys.com
A
203.0.113.25

and:

www.shop.cresignsys.com
CNAME
shop.cresignsys.com

Then:

www.shop.cresignsys.com
 ↓
shop.cresignsys.com
 ↓
203.0.113.25

---

22. MX Record

MX means:

Mail Exchange

It tells mail systems where email for a domain should be delivered.

Example concept:

cresignsys.com
 ↓
MX
 ↓
mail.example.com

This is for email, not normal website traffic.

---

23. TXT Record

TXT records store text-based DNS information.

They are commonly used for:

domain verification
SPF
DKIM-related records
DMARC-related records
other verification/configuration

---

24. NS Record

NS means:

Name Server

It identifies authoritative nameservers for a DNS zone.

Conceptually:

cresignsys.com
 ↓
NS
 ↓
ns1.example-dns.com
ns2.example-dns.com

---

25. CAA Record

CAA records can specify which certificate authorities are authorized to issue certificates for a domain.

This is useful for controlling certificate issuance.

---

26. TTL

TTL means:

Time To Live

It tells DNS resolvers how long a record may be cached.

Example:

A record
TTL = 3600

means roughly:

3600 seconds
=
1 hour

for caching purposes.

---

27. Why DNS Changes Don’t Always Appear Immediately

Suppose you change:

A record
old IP
 ↓
new IP

Some DNS resolvers may still have the old value cached until its TTL expires.

Therefore:

Your computer
 ↓
old cached DNS

while:

another user
 ↓
new DNS

can temporarily happen.

---

28. DNS Is Distributed

There isn’t one single DNS server containing everything.

Instead:

Browser
 ↓
Recursive resolver
 ↓
DNS hierarchy
 ↓
Authoritative server

and cached answers are used where appropriate.

---

29. Recursive Resolver

Your computer usually asks a:

Recursive DNS Resolver

For example, a resolver operated by:

ISP
public DNS provider
enterprise network
local network

The resolver does the work of finding the answer.

---

30. Typical Query

Your computer asks:

What is the IP of learn.cresignsys.com?

The recursive resolver checks its cache.

If it doesn’t have a valid cached answer, it resolves the name.

---

31. Simplified Resolution

Conceptually:

Client
 ↓
Recursive Resolver
 ↓
Root
 ↓
.com
 ↓
cresignsys.com authoritative DNS
 ↓
A record
 ↓
IP

The resolver then returns the answer to the client.

---

32. Caching

Suppose:

learn.cresignsys.com
A
203.0.113.25
TTL 3600

A recursive resolver can cache that result.

The next user asking the same resolver may receive the cached answer without the resolver querying the authoritative server again.

---

33. Why Caching Is Useful

Without caching:

every request
 ↓
DNS hierarchy

With caching:

request
 ↓
local resolver cache
 ↓
answer

This greatly reduces DNS traffic and improves speed.

---

34. Local DNS Cache

Your own computer, browser, operating system, router, or network resolver may also cache DNS responses.

So sometimes:

DNS changed

but:

your computer

still has an older answer cached.

---

35. dig

One of the best DNS troubleshooting tools is:

dig

Example:

dig learn.cresignsys.com

---

36. Short Answer

Use:

dig +short learn.cresignsys.com

Example:

203.0.113.25

This gives you the returned IP address directly.

---

37. Query A Specifically

dig A learn.cresignsys.com

---

38. Query AAAA

dig AAAA learn.cresignsys.com

This checks IPv6.

---

39. Query CNAME

dig CNAME www.cresignsys.com

---

40. Query MX

dig MX cresignsys.com

---

41. Query NS

dig NS cresignsys.com

---

42. Query TXT

dig TXT cresignsys.com

---

43. Different DNS Resolvers

You can ask a specific DNS resolver.

For example:

dig @8.8.8.8 learn.cresignsys.com

This asks Google’s public resolver.

You can also use another resolver such as:

dig @1.1.1.1 learn.cresignsys.com

The returned results can sometimes differ temporarily because of caching or propagation.

---

44. Authoritative Server Directly

You can investigate authoritative DNS using:

dig NS cresignsys.com

Then query an authoritative server directly:

dig @AUTHORITATIVE_SERVER learn.cresignsys.com

This helps distinguish:

authoritative DNS

from:

cached recursive DNS

---

45. +trace

A very useful advanced command:

dig +trace learn.cresignsys.com

This walks through DNS delegation.

Conceptually:

root
 ↓
.com
 ↓
cresignsys.com
 ↓
learn.cresignsys.com

This is excellent for understanding DNS deeply.

---

46. DNS Delegation

Suppose you register:

cresignsys.com

with a registrar.

The registrar records which nameservers are authoritative for your domain.

For example:

cresignsys.com
 ↓
NS
 ↓
DNS provider

---

47. Registrar vs DNS Provider

These are different concepts.

Registrar

Manages your domain registration.

DNS provider

Hosts/manages the DNS zone.

They can be:

same company

or:

different companies

---

48. Example

You might:

buy domain
 ↓
registrar

but use:

DNS
 ↓
Cloudflare

or another DNS provider.

The registrar points the domain delegation to the DNS provider’s nameservers.

---

49. Nameserver Change

Suppose your domain currently uses:

DNS Provider A

and you change nameservers to:

DNS Provider B

Then the authoritative source changes.

The DNS records you configured at Provider A may no longer control the domain.

This is a common source of confusion.

---

50. Important Hosting Principle

Before editing DNS, determine:

Who is authoritative for the domain?

Run:

dig NS cresignsys.com

---

51. Domain vs Subdomain

If you have:

cresignsys.com

you can create:

learn.cresignsys.com
shop.cresignsys.com
manage.cresignsys.com

These are different DNS names.

---

52. Wildcard DNS

You can also use a wildcard record:

*.cresignsys.com

For example:

*.cresignsys.com
A
203.0.113.25

This can cause many otherwise-unconfigured subdomains to resolve to the same IP, subject to DNS rules and any more-specific records.

---

53. Why Wildcard DNS Can Be Useful for Hosting

Imagine your hosting platform creates:

site1.cresignsys.com
site2.cresignsys.com
site3.cresignsys.com

A wildcard can reduce the need to create an individual DNS A record for every subdomain under a controlled zone.

However, for customer-owned domains such as:

customer.com

the customer still needs appropriate DNS configuration at their domain.

---

54. DNS Doesn’t Configure Nginx

This is extremely important.

Suppose DNS says:

shop.cresignsys.com
 ↓
203.0.113.25

That only means:

Send traffic toward this IP.

It does not tell Nginx which website to serve.

---

55. Nginx Has Its Own Configuration

For example:

server {
    server_name shop.cresignsys.com;

    root /storage/websites/shop.cresignsys.com/public;
}

Now the two systems connect:

DNS
 ↓
203.0.113.25

Nginx
 ↓
shop.cresignsys.com
 ↓
/storage/websites/shop.cresignsys.com/public

---

56. DNS + Nginx

Both must be correct.

DNS

shop.cresignsys.com
        ↓
correct IP

Nginx

shop.cresignsys.com
        ↓
correct document root

If either is wrong, the website can fail.

---

57. Same IP, Multiple Websites

This is one of the most important hosting concepts.

Suppose:

siteA.com
siteB.com
siteC.com

all point to:

203.0.113.25

How does Nginx know which website to serve?

The HTTP request contains the hostname.

---

58. HTTP Host Header

A request may contain:

GET /
Host: siteB.com

Nginx sees:

Host = siteB.com

and selects the corresponding server configuration.

---

59. HTTPS SNI

HTTPS adds another important mechanism:

SNI

Server Name Indication.

During TLS setup, the client indicates the hostname it wants.

This allows one IP address to serve certificates for many domains.

Conceptually:

203.0.113.25:443
        │
        ├── siteA.com
        ├── siteB.com
        └── siteC.com

---

60. One IP, Many Domains

This is the foundation of:

Virtual Hosting

Example:

siteA.com
     ↓
203.0.113.25

siteB.com
     ↓
203.0.113.25

siteC.com
     ↓
203.0.113.25

Nginx separates them using hostname information.

---

61. This Is Exactly What Your Hosting Platform Does

Your CresignSys Hosting Platform can create:

Domain
 ↓
DNS configuration
 ↓
Nginx server block
 ↓
Document root
 ↓
PHP-FPM pool
 ↓
Database

That is the basic architecture of automated hosting.

---

62. www Problem

Suppose:

cresignsys.com

works.

But:

www.cresignsys.com

doesn’t.

Possible reason:

root domain DNS configured
www DNS missing

For example:

cresignsys.com
A
203.0.113.25

but:

www.cresignsys.com

has no A/CNAME record.

---

63. Another www Problem

DNS may be correct:

www
 ↓
203.0.113.25

but Nginx may only have:

server_name cresignsys.com;

instead of:

server_name cresignsys.com www.cresignsys.com;

Then Nginx configuration can still cause unexpected behavior.

---

64. DNS and SSL Are Different

Suppose:

DNS ✓

but:

SSL certificate ✗

The domain can resolve correctly while HTTPS still produces certificate errors.

---

65. DNS and WordPress Are Different

Suppose:

DNS ✓
Nginx ✓
SSL ✓

but:

WordPress

has:

home = wrong URL
siteurl = wrong URL

The site can still behave incorrectly.

---

66. DNS Is Only One Layer

Memorize:

DNS
≠
Website

DNS only answers:

Where should traffic go?

Nginx answers:

Which website should this request receive?

PHP answers:

How should the dynamic request be processed?

WordPress answers:

What content should be generated?

MySQL answers:

What stored data is needed?

---

67. DNS Troubleshooting Workflow

When a new domain doesn’t work:

Step 1

dig +short domain.com

Check the IP.

Step 2

dig A domain.com

Check the A record.

Step 3

dig AAAA domain.com

Check for unexpected IPv6.

Step 4

dig NS domain.com

Find authoritative nameservers.

Step 5

Check Nginx:

sudo nginx -t

Step 6

Check listener:

sudo ss -ltnp | grep ':443'

---

68. nginx -t

This is extremely important.

Run:

sudo nginx -t

It checks the Nginx configuration syntax.

You want something like:

syntax is ok
test is successful

before reloading Nginx.

---

69. Reload Nginx

After a valid configuration change:

sudo systemctl reload nginx

Reload is generally preferable to a full restart for configuration changes because it allows existing connections to be handled more gracefully.

---

70. DNS + Nginx + SSL

A new website generally needs:

1. DNS
   ↓
2. Nginx
   ↓
3. Port 80/443
   ↓
4. SSL certificate
   ↓
5. PHP-FPM
   ↓
6. WordPress

If any layer is missing, the site may not work.

---

71. Why Let’s Encrypt Needs DNS/HTTP Reachability

When obtaining a certificate, the certificate authority must verify control of the domain using an ACME challenge.

Common challenge methods include:

HTTP-01
DNS-01
TLS-ALPN-01

The exact method depends on your setup.

---

72. HTTP-01

For HTTP-01, a challenge is served through HTTP.

Conceptually:

Certificate Authority
        ↓
http://domain/.well-known/acme-challenge/...
        ↓
your server

Therefore port 80 and the domain’s DNS/reachability can matter.

---

73. DNS-01

DNS-01 proves control through a special TXT record.

Conceptually:

Certificate Authority
        ↓
DNS
        ↓
TXT challenge

This can be useful when HTTP exposure isn’t suitable.

---

74. Why DNS Knowledge Helps SSL

If:

DNS

is wrong, certificate issuance may fail.

Therefore:

 ↓
SSL

are connected.

---

75. DNS Propagation

The phrase:

DNS propagation

is often used loosely.

Technically, changes become visible through a combination of:

authoritative DNS updates
+
resolver caching
+
TTL expiration

It’s not simply a single global switch that takes exactly a certain number of hours.

---

76. Check Multiple Resolvers

You can compare:

dig @8.8.8.8 +short learn.cresignsys.com

and:

dig @1.1.1.1 +short learn.cresignsys.com

If they differ, caching or delegation issues may be involved.

---

77. Check Authoritative DNS

First:

dig NS cresignsys.com

Then:

dig @authoritative-server +short learn.cresignsys.com

Now you can determine whether the authoritative server itself has the expected record.

---

78. The Most Important DNS Commands

Memorize:

dig +short domain.com

dig A domain.com

dig AAAA domain.com

dig CNAME www.domain.com

dig NS domain.com

dig MX domain.com

dig +trace domain.com

---

79. Your Domain Hosting Mental Model

For:

learn.cresignsys.com

think:

                    DOMAIN
                       │
                       ▼
                      DNS
                       │
                  A / AAAA
                       │
                       ▼
                  PUBLIC IP
                       │
                       ▼
                OCI NETWORK
                       │
                       ▼
                     VNIC
                       │
                       ▼
                    UBUNTU
                       │
                       ▼
                  TCP :443
                       │
                       ▼
                    NGINX
                       │
                 server_name
                       │
                       ▼
        /storage/websites/learn.../public
                       │
                       ▼
                   PHP-FPM
                       │
                       ▼
                  WORDPRESS
                       │
                       ▼
                    MYSQL

---

80. Lesson 057 — Core Principle

The most important idea:

DNS does not deliver the website. DNS tells the client where to find the network endpoint for the hostname.

Then the rest of the stack takes over:

DNS
 ↓
IP
 ↓
Routing
 ↓
Port
 ↓
Nginx
 ↓
TLS
 ↓
PHP
 ↓
WordPress
 ↓
MySQL

Once you understand this, a domain name stops being mysterious. It becomes the first lookup in a long, measurable chain.

---

Next Lesson — 058

HTTP Deep Dive — What Actually Happens After DNS

We will now go deeper into the protocol that carries your WordPress website:

HTTP
 ↓
Request
 ↓
Response
 ↓
Headers
 ↓
Status codes
 ↓
Methods
 ↓
GET
 ↓
POST
 ↓
Cookies
 ↓
Sessions
 ↓
Cache-Control
 ↓
Compression
 ↓
HTTP/1.1
 ↓
HTTP/2
 ↓
HTTP/3

Then we will follow an actual WordPress request:

GET /about/
        ↓
Nginx
        ↓
PHP-FPM
        ↓
WordPress
        ↓
MySQL
        ↓
HTML
        ↓
Browser

and explain exactly what each layer does.