DNS Records Deep Dive

We now know:

Domain
 ↓
DNS
 ↓
IP address
 ↓
Network
 ↓
TCP
 ↓
TLS
 ↓
HTTP
 ↓
Nginx

Now we go one level deeper into what DNS actually stores.

1. DNS Is Made of Records

DNS does not simply contain:

domain → IP

It contains different types of records.

Think of a DNS zone as a database table:

NAME                         TYPE       VALUE
────────────────────────────────────────────────────
cresignsys.com               A          IP
templates.cresignsys.com    A          IP
www.cresignsys.com           CNAME      cresignsys.com
cresignsys.com               MX         mail server
cresignsys.com               TXT        verification data
cresignsys.com               NS         nameserver
cresignsys.com               SOA        zone information

Each record has a specific purpose.

2. The Most Important Records

For web hosting, learn these first:

A
AAAA
CNAME
NS
SOA
MX
TXT
CAA

Later:

PTR
SRV
NAPTR
DNSSEC records

3. A Record

The A record maps a name to an IPv4 address.

Example:

templates.cresignsys.com
        ↓
       A
        ↓
203.0.113.10

Again, 203.0.113.10 is only an example.

4. What Happens After an A Record?

Suppose:

templates.cresignsys.com
A
203.0.113.10

The browser can then attempt:

203.0.113.10:443

The path becomes:

Domain
 ↓
A record
 ↓
IPv4
 ↓
TCP 443
 ↓
TLS
 ↓
Nginx

5. AAAA Record

AAAA performs the equivalent function for IPv6.

Example:

templates.cresignsys.com
AAAA
2001:db8::10

Conceptually:

A
 ↓
IPv4

AAAA
 ↓
IPv6

6. Why Both Can Exist

A website can have:

templates.cresignsys.com
 ├── A
 │    └── IPv4 address
 │
 └── AAAA
      └── IPv6 address

A client may use IPv6 when available and appropriate, or IPv4 otherwise.

The actual connection behavior depends on the client and network.

7. CNAME

CNAME means:

Canonical Name

It creates an alias.

Example:

www.cresignsys.com
        ↓
      CNAME
        ↓
cresignsys.com

Then DNS can resolve:

cresignsys.com
 ↓
A / AAAA
 ↓
IP

8. CNAME Does Not Mean Redirect

This is a common misunderstanding.

DNS CNAME:

www.example.com
      ↓
CNAME
      ↓
example.com

is not an HTTP redirect.

It happens at the DNS level.

An HTTP redirect happens later:

Browser
 ↓
HTTP request
 ↓
Web server
 ↓
301/302
 ↓
new URL

These are completely different mechanisms.

9. CNAME Example

Suppose:

www.cresignsys.com
CNAME
cresignsys.com

The browser asks DNS:

What is www.cresignsys.com?

DNS follows the CNAME relationship and ultimately obtains the relevant address information for:

cresignsys.com

10. CNAME and IP Address

Remember:

A:
name → IPv4

while:

CNAME:
name → another name

So:

A
 ↓
192.0.2.10

but:

CNAME
 ↓
another.example.com

11. NS Record

NS means:

Name Server

It tells DNS which authoritative nameservers are responsible for a zone.

Conceptually:

cresignsys.com
      ↓
     NS
      ↓
ns1.example-dns.com
ns2.example-dns.com

These nameservers are responsible for serving authoritative DNS information.

12. Why NS Is Important

Imagine your domain registrar knows:

cresignsys.com

but doesn’t itself necessarily store all your DNS records.

You tell the DNS system:

Use these nameservers for cresignsys.com.

Conceptually:

Registrar / parent zone
        ↓
NS delegation
        ↓
Authoritative DNS
        ↓
A / AAAA / MX / TXT / etc.

13. Delegation

This is one of the deepest DNS concepts.

The parent zone can delegate responsibility for a child domain.

For example:

.com
 ↓
cresignsys.com

The .com infrastructure knows which nameservers are authoritative for:

cresignsys.com

Then those servers manage the records within that domain’s zone.

14. SOA Record

SOA means:

Start of Authority

It contains information about the DNS zone.

Conceptually:

cresignsys.com
      ↓
     SOA
      ↓
Zone information

It includes things such as:

Primary/authoritative server information
Administrative contact information
Serial number
Refresh-related timing
Retry-related timing
Expiration-related timing
Minimum/negative caching-related information

The exact semantics of these fields are defined by DNS standards.

15. DNS Serial Number

The SOA record contains a serial value.

It can be used by secondary DNS systems to determine whether zone data has changed.

Conceptually:

Old zone
Serial = 100

New zone
Serial = 101

The secondary can recognize that the zone has been updated.

Modern DNS providers often manage this automatically.

16. MX Record

MX means:

Mail Exchange

It tells mail systems where email for a domain should be delivered.

Example:

cresignsys.com
MX
mail.example.com

It also has a priority value.

Conceptually:

Priority 10 → mail1
Priority 20 → mail2

Lower numeric preference values generally have higher priority.

17. Website vs Email

Your website might use:

while email uses:

MX

Therefore:

cresignsys.com
 ├── Website → A / AAAA
 │
 └── Email   → MX

The same domain can support completely different services.

18. TXT Record

TXT records contain text data.

They are heavily used for verification and policy mechanisms.

Examples include:

Domain ownership verification
SPF
DKIM
DMARC
ACME DNS challenges
Other service verification

19. SPF

SPF means:

Sender Policy Framework

It is an email authentication mechanism that uses DNS TXT records to publish which servers are authorized to send mail for a domain.

Conceptually:

cresignsys.com
      ↓
     TXT
      ↓
SPF policy
      ↓
Mail receiver checks

SPF is about email, not web hosting.

20. DKIM

DKIM means:

DomainKeys Identified Mail

It uses cryptographic signatures to help verify that an email is associated with a domain and has not been modified in transit in ways detectable by the signature.

The public key is published in DNS.

Conceptually:

Email
 ↓
DKIM signature
 ↓
Receiver
 ↓
DNS
 ↓
Public key
 ↓
Verify signature

21. DMARC

DMARC means:

Domain-based Message Authentication, Reporting, and Conformance

It builds on email authentication mechanisms such as:

SPF
DKIM

and lets a domain publish policy/reporting instructions through DNS.

Conceptually:

SPF
 +
DKIM
 +
DMARC policy

This belongs to email security rather than website HTTPS.

22. CAA Record

CAA is particularly relevant to your SSL learning.

CAA stands for:

Certification Authority Authorization

It allows a domain to publish which certificate authorities are authorized to issue certificates for it.

Conceptually:

cresignsys.com
      ↓
     CAA
      ↓
Authorized certificate authority

23. CAA and Let’s Encrypt

Suppose your DNS policy allows:

Let's Encrypt

to issue certificates.

Conceptually:

Let's Encrypt
      ↓
Check CAA
      ↓
Is this CA authorized?
      ↓
Yes
      ↓
Continue certificate issuance

If the CAA policy prohibits that CA, issuance can fail.

CAA is an additional control; certificate authorities also perform their required domain-control validation.

24. PTR Record

PTR is essentially the reverse of an A-style mapping.

Forward DNS:

name
 ↓
IP

Reverse DNS:

IP
 ↓
name

This is called:

Reverse DNS

25. Reverse DNS

Suppose:

server.example.com
A
203.0.113.10

Reverse DNS could conceptually provide:

203.0.113.10
 ↓
server.example.com

The reverse namespace for IPv4 uses:

in-addr.arpa

IPv6 uses:

ip6.arpa

26. Why Reverse DNS Matters

Reverse DNS can be important for:

Mail servers
Server identification
Logging
Network troubleshooting
Some reputation systems

For a web server, it is not generally what makes HTTPS work.

27. SRV Record

SRV records provide information about services, including:

service
protocol
priority
weight
port
target

Conceptually:

_service._tcp.example.com
        ↓
SRV
        ↓
server + port

They are used by various network services and applications.

28. DNS Record Comparison

Record	Main purpose
A	Name → IPv4
AAAA	Name → IPv6
CNAME	Name → another name
NS	Authoritative nameserver delegation
SOA	Zone authority/metadata
MX	Mail delivery
TXT	Text/policy/verification
CAA	Certificate authority authorization
PTR	Reverse DNS
SRV	Service discovery

29. A Realistic Hosting Zone

Imagine your DNS zone contains:

cresignsys.com

A       → server IP
AAAA    → server IPv6

templates.cresignsys.com
A       → server IP

learn.cresignsys.com
A       → server IP

shop.cresignsys.com
A       → server IP

www
CNAME   → cresignsys.com

MX      → mail server

TXT     → verification/email policies

CAA     → certificate authority policy

This creates the DNS side of your hosting architecture.

30. DNS Does Not Create the Website

This is one of the most important concepts.

Suppose DNS says:

templates.cresignsys.com
A
SERVER-IP

That does not mean the website automatically exists.

You still need:

Server
 ↓
Network access
 ↓
Port 443
 ↓
Nginx
 ↓
Server block
 ↓
Website files

DNS only gets the client to the appropriate network destination.

31. DNS + Nginx

Now connect the two systems.

DNS:

templates.cresignsys.com
       ↓
     A record
       ↓
    Server IP

Nginx:

Server IP:443
       ↓
Hostname
       ↓
templates.cresignsys.com
       ↓
Website configuration
       ↓
/storage/websites/templates.cresignsys.com/public

This is the key relationship between DNS and web hosting.

32. Same IP, Multiple Websites

This is where hosting becomes interesting.

Suppose:

templates.cresignsys.com
learn.cresignsys.com
shop.cresignsys.com

all point to:

same server IP

How can Nginx know which website the visitor wants?

Because the HTTP request contains the hostname, and TLS also uses the hostname during the HTTPS connection setup through SNI.

Conceptually:

                 Same IP
                   │
          ┌────────┼────────┐
          ↓        ↓        ↓
      templates   learn    shop
          │        │        │
          ↓        ↓        ↓
        Nginx    Nginx    Nginx
          │        │        │
          ↓        ↓        ↓
       Site A    Site B   Site C

33. One Server, Many Domains

This is the foundation of shared hosting.

                    VPS
                     │
                Public IP
                     │
                    Nginx
        ┌────────────┼────────────┐
        ↓            ↓            ↓
     Site A        Site B       Site C
        │            │            │
        ↓            ↓            ↓
   WordPress      WordPress      HTML

DNS makes all those names point toward the server.

Nginx separates them.

34. Domain → DNS → Nginx

The complete chain:

templates.cresignsys.com
          ↓
         DNS
          ↓
       Server IP
          ↓
     TCP port 443
          ↓
         TLS
          ↓
        Nginx
          ↓
Hostname matching
          ↓
templates.cresignsys.com
          ↓
Website directory

35. Why the Hostname Is Important

Suppose three domains use one IP:

A → 203.0.113.10
B → 203.0.113.10
C → 203.0.113.10

The IP alone cannot tell Nginx which website is wanted.

The application-level hostname helps.

For HTTPS, TLS also has:

SNI

Server Name Indication.

36. SNI

SNI allows the client to indicate the hostname it wants during the TLS handshake.

Conceptually:

Client
 ↓
TLS ClientHello
 ↓
SNI:
templates.cresignsys.com
 ↓
Server

Nginx can then select the appropriate certificate/configuration for the requested hostname.

This is crucial for modern HTTPS hosting.

37. Certificate + SNI

Suppose one server hosts:

templates.cresignsys.com
learn.cresignsys.com
shop.cresignsys.com

It may have certificates covering these different names.

The TLS connection indicates the requested hostname through SNI.

Conceptually:

Client
 ↓
SNI = templates.cresignsys.com
 ↓
Nginx
 ↓
Select appropriate TLS configuration
 ↓
Certificate for requested hostname

38. DNS Does Not Choose the Certificate

This is subtle.

DNS says:

templates.cresignsys.com
 ↓
IP

SNI says:

TLS connection wants:
templates.cresignsys.com

Nginx then uses its configuration to select an appropriate certificate/server block.

So:

DNS
 ↓
network destination

SNI
 ↓
TLS hostname

Nginx
 ↓
virtual host

39. Practical DNS Inspection

Install/use dig if available:

dig templates.cresignsys.com A

You can inspect the answer.

For CNAME:

dig www.cresignsys.com CNAME

For nameservers:

dig cresignsys.com NS

For mail:

dig cresignsys.com MX

For TXT:

dig cresignsys.com TXT

For certificate authority policy:

dig cresignsys.com CAA

40. Short Form

You can also use:

dig +short templates.cresignsys.com A

This focuses on the answer.

For example:

203.0.113.10

if that were the actual result.

41. Follow CNAMEs

Try:

dig +short www.cresignsys.com

If www is a CNAME, the result can help show the eventual address information after resolution.

42. Check Your Nameservers

Run:

dig +short cresignsys.com NS

This tells you which nameservers are authoritative for the domain.

This is one of the first things to check when debugging DNS.

43. Check the Authoritative Answer

You can use:

dig +trace templates.cresignsys.com

This is particularly useful for understanding:

Root
 ↓
TLD
 ↓
Domain delegation
 ↓
Authoritative server
 ↓
Record

44. The DNS Hierarchy as a Tree

Think of DNS like this:

.
│
├── com
│   │
│   ├── cresignsys
│   │    │
│   │    ├── templates
│   │    ├── learn
│   │    ├── shop
│   │    └── www
│   │
│   └── other domains
│
├── org
│
├── net
│
└── in

Each label is a node in a hierarchical namespace.

45. Subdomains Are Just Labels

For example:

templates.cresignsys.com

has:

templates

as one label beneath:

cresignsys.com

You could have:

learn.cresignsys.com
shop.cresignsys.com
manage.cresignsys.com

Each is another DNS name.

46. DNS Doesn’t Require Separate Servers

These can all point to the same server:

templates.cresignsys.com
learn.cresignsys.com
shop.cresignsys.com

For example:

templates → 203.0.113.10
learn     → 203.0.113.10
shop      → 203.0.113.10

One VPS can serve all three.

47. Different Servers Are Also Possible

You could instead have:

templates → Server A
learn     → Server B
shop      → Server C

DNS makes this possible.

Therefore DNS provides a layer of infrastructure abstraction.

48. DNS and Cloud Hosting

In a cloud environment:

DNS
 ↓
Public IP
 ↓
Cloud networking
 ↓
VNIC / virtual network interface
 ↓
Security rules
 ↓
VM
 ↓
Nginx

So DNS is only the first part of the network path.

49. Security Rules

Even if DNS is correct:

templates.cresignsys.com
 ↓
correct IP

cloud security rules may still block:

TCP 80
TCP 443

Then the website will not be reachable.

So troubleshooting must continue layer by layer.

50. The Three Different Configurations

For a working HTTPS website, you can think in terms of three separate configurations:

DNS

Name
 ↓
IP

Cloud/network firewall

Internet
 ↓
TCP 443
 ↓
Allowed?

Nginx

Port 443
 ↓
Hostname
 ↓
Certificate
 ↓
Website

All three need to cooperate.

51. Example Failure

Suppose:

DNS = correct
Firewall = correct
Nginx = stopped

Result:

DNS
 ↓
works

TCP 443
 ↓
connection refused/failed

52. Another Failure

DNS = wrong
Firewall = correct
Nginx = correct

Result:

Browser
 ↓
DNS
 ↓
wrong server

Your Nginx configuration can be completely correct and the user still won’t reach it.

53. Another Failure

DNS = correct
Firewall = correct
Nginx = correct
Certificate = wrong

Result:

TCP
 ↓
works

TLS
 ↓
certificate error

This layered diagnosis is one of the most valuable skills in web hosting.

54. Your Hosting Platform

You are gradually building a hosting architecture that can be represented as:

                 INTERNET
                     │
                     ▼
                    DNS
                     │
            ┌────────┼────────┐
            ▼        ▼        ▼
        templates   learn    shop
            │        │        │
            └────────┼────────┘
                     ▼
                  Public IP
                     │
                     ▼
                Cloud Network
                     │
                     ▼
                   Ubuntu
                     │
                     ▼
                  Nginx
          ┌──────────┼──────────┐
          ▼          ▼          ▼
       Site A      Site B      Site C
          │          │          │
          ▼          ▼          ▼
      WordPress   WordPress    HTML

That is the basic architecture behind a multi-site hosting server.

55. The Next Level: DNS Resolution in Detail

We can now go deeper into exactly what happens inside a DNS lookup:

Browser
 ↓
OS resolver
 ↓
Recursive resolver
 ↓
Cache
 ↓
Root hints
 ↓
Root nameserver
 ↓
TLD nameserver
 ↓
Authoritative nameserver
 ↓
A record
 ↓
TTL
 ↓
Cache
 ↓
Browser

Then we can connect DNS directly to:

TCP
 ↓
SNI
 ↓
TLS certificate
 ↓
Nginx server block

56. Practical Exercise for Your Server

Run these and record the output:

dig +short templates.cresignsys.com A

dig +short templates.cresignsys.com AAAA

dig +short cresignsys.com NS

dig +short cresignsys.com MX

dig +short cresignsys.com TXT

dig +short cresignsys.com CAA

Then:

dig +trace templates.cresignsys.com

These commands are read-only.

Do not modify DNS yet.

Lesson 026 Summary

The most important concepts are:

A
 ↓
IPv4

AAAA
 ↓
IPv6

CNAME
 ↓
Another DNS name

NS
 ↓
Authoritative nameservers

SOA
 ↓
Zone authority information

MX
 ↓
Email

TXT
 ↓
Policies / verification

CAA
 ↓
Certificate authority authorization

PTR
 ↓
Reverse DNS

SRV
 ↓
Service discovery

And the complete hosting connection is:

DOMAIN
   ↓
DNS RECORD
   ↓
IP ADDRESS
   ↓
CLOUD NETWORK
   ↓
FIREWALL
   ↓
TCP 443
   ↓
TLS + SNI
   ↓
NGINX
   ↓
SERVER BLOCK
   ↓
WEBSITE DIRECTORY

Next Lesson — 027

DNS Resolution — What Happens Inside the Resolver?

We will go even deeper into:

Stub Resolver
 ↓
Recursive Resolver
 ↓
Root Hints
 ↓
Root Server
 ↓
TLD Server
 ↓
Authoritative Server
 ↓
Caching
 ↓
TTL
 ↓
Negative Caching
 ↓
DNS Response

Then we will use dig +trace to understand the actual journey of templates.cresignsys.com from the DNS root to your domain.

CresignSys Learn — Lesson 026

DNS Records Deep Dive

1. DNS Is Made of Records

2. The Most Important Records

3. A Record

4. What Happens After an A Record?

5. AAAA Record

6. Why Both Can Exist

7. CNAME

Canonical Name

8. CNAME Does Not Mean Redirect

9. CNAME Example

10. CNAME and IP Address

11. NS Record

Name Server

12. Why NS Is Important

13. Delegation

14. SOA Record

Start of Authority

15. DNS Serial Number

16. MX Record

Mail Exchange

17. Website vs Email

18. TXT Record

19. SPF

Sender Policy Framework

20. DKIM

DomainKeys Identified Mail

21. DMARC

Domain-based Message Authentication, Reporting, and Conformance

22. CAA Record

Certification Authority Authorization

23. CAA and Let’s Encrypt

24. PTR Record

Reverse DNS

25. Reverse DNS

26. Why Reverse DNS Matters

27. SRV Record

28. DNS Record Comparison

29. A Realistic Hosting Zone

30. DNS Does Not Create the Website

31. DNS + Nginx

32. Same IP, Multiple Websites

33. One Server, Many Domains

34. Domain → DNS → Nginx

35. Why the Hostname Is Important

SNI

36. SNI

37. Certificate + SNI

38. DNS Does Not Choose the Certificate

39. Practical DNS Inspection

40. Short Form

41. Follow CNAMEs

42. Check Your Nameservers

43. Check the Authoritative Answer

44. The DNS Hierarchy as a Tree

45. Subdomains Are Just Labels

46. DNS Doesn’t Require Separate Servers

47. Different Servers Are Also Possible

48. DNS and Cloud Hosting

49. Security Rules

50. The Three Different Configurations

DNS

Cloud/network firewall

Nginx

51. Example Failure

52. Another Failure

53. Another Failure

54. Your Hosting Platform

55. The Next Level: DNS Resolution in Detail

56. Practical Exercise for Your Server

Lesson 026 Summary

Next Lesson — 027

DNS Resolution — What Happens Inside the Resolver?

Comments

Leave a Reply Cancel reply

More posts

CresignSys Learn — Lesson 045

CresignSys Learn — Lesson 044

CresignSys Learn — Lesson 043