DNS — From `templates.cresignsys.com` to Your VPS

We now go one layer earlier than TCP/TLS.

When a user enters:

https://templates.cresignsys.com

the browser first needs to answer:

Where is templates.cresignsys.com?

That is the job of DNS.

1. What DNS Really Does

DNS means:

Domain Name System

Its basic purpose is to translate names into information used by network applications.

The simplest example:

templates.cresignsys.com
        ↓
IP address

For example, conceptually:

templates.cresignsys.com
        ↓
203.0.113.50

The IP above is only an example.

Your actual public IP is whatever is currently configured for the domain.

2. Why DNS Exists

Computers communicate using network addresses.

Humans prefer names.

Compare:

203.0.113.50

with:

templates.cresignsys.com

A domain name is easier to remember and manage.

DNS provides the mapping system.

3. DNS Is Not the Internet

DNS is one service operating over the Internet.

Don’t think:

DNS = Internet

Think:

Internet
├── DNS
├── HTTP
├── HTTPS
├── SMTP
├── SSH
└── many other protocols

4. Domain Name Structure

Take:

templates.cresignsys.com

Break it down:

templates
   .
cresignsys
   .
com

There are multiple levels.

5. Root of DNS

At the very top is the:

DNS Root

Conceptually:

Then:

.
└── com

Then:

.
└── com
    └── cresignsys

Then:

.
└── com
    └── cresignsys
        └── templates

The final dot is normally hidden in everyday domain names.

6. Fully Qualified Domain Name

Technically:

templates.cresignsys.com.

is a fully qualified domain name.

The final:

represents the DNS root.

Browsers and DNS tools normally allow you to omit it.

7. TLD

.com is a:

Top-Level Domain

Examples:

.com
.org
.net
.in
.edu

There are many more modern TLDs.

8. Second-Level Domain

In:

cresignsys.com

the:

cresignsys

portion is the second-level domain under .com.

9. Subdomain

In:

templates.cresignsys.com

the:

templates

portion is a subdomain label.

Other examples from your hosting architecture:

learn.cresignsys.com
shop.cresignsys.com
templates.cresignsys.com

These are separate DNS names under:

cresignsys.com

10. DNS Names Are Hierarchical

Think:

DNS Root
   ↓
.com
   ↓
cresignsys.com
   ↓
templates.cresignsys.com

This hierarchy is fundamental to understanding DNS.

11. Registrar

When you register:

cresignsys.com

you normally do so through a:

Domain Registrar

The registrar handles domain registration and related management.

Examples include many commercial registrars.

The registrar is not necessarily the same company that hosts your website.

12. Registrar vs DNS Provider

These are different concepts.

Registrar

Manages the domain registration.

DNS provider

Hosts/manages the DNS zone and authoritative DNS service.

They can be the same company or different companies.

13. DNS Zone

A DNS zone contains DNS records for a domain or part of the DNS namespace.

For example, a simplified zone for:

cresignsys.com

might contain:

cresignsys.com
www.cresignsys.com
templates.cresignsys.com
mail.cresignsys.com

with different records.

14. DNS Records

DNS doesn’t only store IP addresses.

It supports many record types.

Important ones:

A
AAAA
CNAME
MX
TXT
NS
SOA
CAA

We will study each.

15. A Record

The most important record for a basic IPv4 website is:

A

An A record maps a hostname to an IPv4 address.

Conceptually:

templates.cresignsys.com
        ↓
A
        ↓
203.0.113.50

16. AAAA Record

An:

AAAA

record maps a hostname to an IPv6 address.

Conceptually:

templates.cresignsys.com
        ↓
AAAA
        ↓
2001:db8::50

Again, that IPv6 address is an example.

17. A vs AAAA

Remember:

A
 ↓
IPv4

AAAA
 ↓
IPv6

A domain can have both.

18. CNAME

CNAME means:

Canonical Name

It creates an alias from one DNS name to another DNS name.

For example:

www.example.com
      ↓
CNAME
      ↓
example.com

The DNS resolver then follows the canonical name.

19. CNAME Is Not an IP Record

This is important.

An A record:

name → IPv4

A CNAME:

name → another name

For example:

cdn.example.com
      ↓
CNAME
      ↓
provider.example.net

20. MX

MX means:

Mail Exchange

It tells mail systems which servers handle email for a domain.

For example:

cresignsys.com
      ↓
MX
      ↓
mail provider

This does not control your website.

21. TXT

TXT records contain text data used for various purposes.

Common uses include:

Domain verification
SPF
DKIM-related configuration
DMARC-related mechanisms
Certificate authority policies

The exact syntax depends on the purpose.

22. NS

NS means:

Name Server

NS records identify authoritative nameservers for a DNS zone.

Conceptually:

cresignsys.com
      ↓
NS
      ↓
ns1.provider.example
ns2.provider.example

23. SOA

SOA means:

Start of Authority

It contains administrative information about the DNS zone.

It includes things such as:

Primary/authoritative server information
Zone serial
Refresh
Retry
Expire
Negative caching TTL

The exact semantics are part of DNS zone management.

24. CAA

CAA means:

Certification Authority Authorization

It can specify which certificate authorities are authorized to issue certificates for a domain.

For example, a domain owner may configure a CAA record to authorize a particular CA.

This can be useful as an additional control around certificate issuance.

25. Your HTTPS Domain

For:

templates.cresignsys.com

you might have something conceptually like:

templates.cresignsys.com
        ↓
A
        ↓
YOUR VPS PUBLIC IPv4

Then:

Browser
 ↓
DNS
 ↓
VPS IP
 ↓
TCP 443

26. DNS Lookup Does Not Connect to Nginx

This distinction is important.

DNS answers:

What DNS information corresponds to this name?

DNS does not itself establish the HTTPS connection.

The sequence is:

DNS lookup
     ↓
IP address obtained
     ↓
TCP connection
     ↓
TLS
     ↓
HTTP

27. DNS Resolver

Your browser doesn’t necessarily contact the authoritative DNS server directly.

It commonly asks a:

Recursive DNS Resolver

Examples include resolver services operated by:

ISPs
public DNS providers
organizations
local networks

28. Recursive Resolver

The resolver’s job is roughly:

Find the answer for this DNS query, using DNS hierarchy and caching.

Conceptually:

Browser
 ↓
Recursive resolver
 ↓
DNS hierarchy
 ↓
Answer
 ↓
Browser

29. DNS Cache

DNS results are cached.

Suppose the resolver previously learned:

templates.cresignsys.com
        ↓
203.0.113.50

It may keep that answer for a period determined by the record’s TTL.

Then another user may receive the cached answer without the resolver needing to repeat the entire lookup.

30. TTL

TTL means:

Time To Live

A DNS record can have a TTL such as:

meaning roughly:

300 seconds
=
5 minutes

The exact caching behavior can involve additional considerations.

31. Why TTL Matters

Suppose:

Old IP
 ↓
203.0.113.50

and you change it to:

New IP
 ↓
203.0.113.60

Existing cached DNS answers may continue to be used until their TTL expires.

Therefore DNS changes aren’t necessarily visible everywhere immediately.

32. DNS Propagation

People often say:

DNS propagation takes 24–48 hours.

This is an oversimplification.

More accurately:

Different caches may retain the previous answer until their applicable TTLs expire, while resolver behavior and other factors can affect when users observe the change.

DNS doesn’t literally send a new record around the world.

33. Authoritative Nameserver

An authoritative nameserver is a server that has authoritative information for a DNS zone.

For example:

cresignsys.com
        ↓
authoritative DNS servers
        ↓
records

The authoritative server is the source of truth for the zone.

34. Root Servers

At the top of the DNS hierarchy are:

Root DNS servers

They don’t normally tell the resolver:

templates.cresignsys.com → VPS IP

Instead, they help direct the resolver toward the appropriate TLD nameservers.

35. TLD Nameservers

For .com domains, the resolver can be directed to the .com TLD nameservers.

Conceptually:

Root
 ↓
.com TLD
 ↓
cresignsys.com authoritative DNS

36. Full Recursive Lookup

Suppose the resolver has no cached answer.

The simplified process is:

Browser
   ↓
Recursive Resolver
   ↓
Root
   ↓
.com TLD
   ↓
cresignsys.com authoritative nameserver
   ↓
templates.cresignsys.com
   ↓
IP address

Then the resolver returns the answer to the browser.

37. The Root Doesn’t Know Everything

The DNS root doesn’t store every domain’s IP address.

Instead, DNS is hierarchical.

Each layer delegates responsibility.

Think:

Root
 ↓
Who handles .com?
 ↓
.com
 ↓
Who handles cresignsys.com?
 ↓
Authoritative server
 ↓
What is templates?
 ↓
A/AAAA answer

38. Delegation

This is a fundamental DNS concept.

A parent zone delegates authority to nameservers responsible for a child zone.

Conceptually:

.com
 ↓
delegates cresignsys.com
 ↓
cresignsys.com nameservers

39. Nameserver Configuration

At the domain-registration level, you normally specify nameservers.

For example:

ns1.provider.example
ns2.provider.example

This tells the DNS hierarchy where the authoritative DNS service for the domain can be found.

40. The DNS Zone

Once the authoritative nameserver is identified, it can answer questions such as:

What is the A record?
What is the AAAA record?
What are the MX records?
What are the TXT records?

41. Example Zone

A simplified conceptual zone might be:

cresignsys.com.       A       203.0.113.50

www                   CNAME   cresignsys.com.

templates             A       203.0.113.50

learn                 A       203.0.113.50

shop                  A       203.0.113.50

cresignsys.com.       MX      mail.example.com.

The exact records on your real domain may be different.

42. Multiple Websites on One IP

This is extremely important for your hosting platform.

You can have:

templates.cresignsys.com
learn.cresignsys.com
shop.cresignsys.com

all pointing to:

same public IP

For example:

templates → 203.0.113.50
learn     → 203.0.113.50
shop      → 203.0.113.50

DNS doesn’t need a separate IP for every website.

43. How Does Nginx Know Which Website?

This is where DNS ends and HTTP/Nginx begins.

The browser connects to:

203.0.113.50:443

but sends information identifying the requested hostname through TLS/HTTP mechanisms.

Nginx can then choose the appropriate:

server block

for:

templates.cresignsys.com

or:

shop.cresignsys.com

44. One IP, Many Domains

Conceptually:

                    Public IP
                 203.0.113.50
                       │
              ┌────────┼────────┐
              ▼        ▼        ▼
          templates   learn    shop
              │        │        │
              ▼        ▼        ▼
           Nginx server blocks

This is a fundamental reason modern hosting can put many websites on one server/IP.

45. DNS Does Not Select the Website

DNS only gets you to the IP.

Then the web server uses the hostname/request information to determine the website.

So:

DNS
 ↓
IP

then:

HTTP/TLS
 ↓
hostname
 ↓
Nginx server block

46. SNI

For HTTPS, the hostname is typically communicated during the TLS handshake using:

SNI — Server Name Indication

Conceptually:

Client
 ↓
TLS ClientHello
 ↓
SNI = templates.cresignsys.com
 ↓
Nginx

This allows the server to select the appropriate certificate for the hostname.

47. Why SNI Was Important

Suppose one IP hosts:

site1.com
site2.com
site3.com

Each may have a different certificate.

SNI allows the client to tell the server which hostname it wants during the TLS handshake.

Conceptually:

203.0.113.50:443
       │
       ├── site1.com
       ├── site2.com
       └── site3.com

48. DNS + SNI + Nginx

This is a critical hosting relationship:

DNS
 ↓
IP address

SNI
 ↓
requested hostname

Nginx
 ↓
correct certificate/server block

49. DNS + Nginx Configuration

Suppose DNS has:

templates.cresignsys.com
        ↓
YOUR_PUBLIC_IP

Nginx might have:

server {
    server_name templates.cresignsys.com;

    root /storage/websites/templates.cresignsys.com/public;
}

Now the pieces connect.

50. Complete Flow for Your Domain

When a user enters:

https://templates.cresignsys.com

the simplified sequence is:

1. Browser checks local DNS cache
             ↓
2. Resolver lookup
             ↓
3. Authoritative DNS
             ↓
4. A/AAAA answer
             ↓
5. Browser obtains IP
             ↓
6. TCP connection to :443
             ↓
7. TLS handshake
             ↓
8. SNI = templates.cresignsys.com
             ↓
9. Nginx selects certificate/server block
             ↓
10. HTTP request
             ↓
11. WordPress if required

51. Local DNS Cache

The browser or operating system may already know the answer.

So the browser might not perform a new DNS query every time.

Conceptually:

Browser cache
   ↓
OS cache
   ↓
local resolver
   ↓
recursive resolver

The exact caching layers vary.

52. `dig`

You can inspect DNS directly.

Run:

dig templates.cresignsys.com

You may see an answer section containing an A record.

53. Query Only A

dig A templates.cresignsys.com

This asks specifically for IPv4.

54. Query AAAA

dig AAAA templates.cresignsys.com

This asks for IPv6.

55. Query CNAME

dig CNAME templates.cresignsys.com

This checks whether the name is a CNAME.

56. Query NS

dig NS cresignsys.com

This shows nameserver information.

57. Query MX

dig MX cresignsys.com

This checks mail exchange records.

58. Query TXT

dig TXT cresignsys.com

This can show TXT records used for verification and email-related policies.

59. `+short`

For concise results:

dig +short A templates.cresignsys.com

This is very useful in server scripts.

60. Trace DNS

You can ask dig to trace the DNS delegation process:

dig +trace templates.cresignsys.com

Conceptually, this allows you to observe the hierarchy:

Root
 ↓
.com
 ↓
cresignsys.com
 ↓
templates.cresignsys.com

61. Why `+trace` Is Educational

It makes the hierarchy visible.

You can actually see that DNS isn’t:

one giant database

Instead, it is:

distributed
hierarchical
delegated
cached

62. DNS Uses UDP and TCP

Traditional DNS commonly uses:

UDP 53

but DNS can also use:

TCP 53

under certain circumstances.

Modern DNS-related technologies can also use other transports, such as DNS over HTTPS or DNS over TLS, which we will study later.

63. Why UDP?

Traditional DNS queries are often small and benefit from low overhead.

Conceptually:

DNS query
 ↓
UDP
 ↓
DNS response

But DNS is not limited to UDP.

64. DNS Over HTTPS

There is also:

DoH

DNS over HTTPS.

Conceptually:

Browser
 ↓
HTTPS
 ↓
DNS resolver

This encrypts DNS queries between the client and the DoH resolver.

65. DNS Over TLS

There is also:

DoT

DNS over TLS.

Conceptually:

Client
 ↓
TLS
 ↓
DNS resolver

Both DoH and DoT protect DNS traffic between the client and resolver, but they use different transport/application mechanisms.

66. Traditional DNS vs DoH/DoT

Traditional:

Client
 ↓
DNS
 ↓
Resolver

DoT:

Client
 ↓
TLS
 ↓
DNS
 ↓
Resolver

DoH:

Client
 ↓
HTTPS
 ↓
DNS
 ↓
Resolver

67. DNS Security vs HTTPS Security

Don’t confuse:

DNS security

with:

website TLS

For example:

DNS lookup

can be protected with DoH/DoT, while:

https://templates.cresignsys.com

uses TLS to protect the actual web session.

They are separate layers.

68. DNSSEC

Another important technology is:

DNSSEC

DNSSEC adds cryptographic authentication to DNS data.

Its purpose is to help detect forged/manipulated DNS responses.

Conceptually:

DNS data
 ↓
cryptographic signatures
 ↓
resolver validation

69. DNSSEC Does Not Encrypt DNS

This is important.

DNSSEC primarily provides:

Authenticity
Integrity

It does not make ordinary DNS queries confidential.

So:

DNSSEC
≠
DNS encryption

DoH/DoT address confidentiality between client and resolver.

70. DNSSEC Chain of Trust

DNSSEC uses a hierarchical chain of trust.

Conceptually:

Root trust
   ↓
TLD
   ↓
Domain
   ↓
DNS record

This mirrors the hierarchical nature of DNS itself.

71. DNS and Let’s Encrypt

Now connect DNS to your SSL lesson.

Let’s Encrypt needs to verify control of a domain before issuing a certificate.

One validation method is:

DNS-01

The certificate authority asks you to create a specific DNS record.

Conceptually:

Let's Encrypt
      ↓
DNS challenge
      ↓
TXT record
      ↓
Authoritative DNS
      ↓
validation

72. HTTP-01

Another common validation method is:

HTTP-01

Let’s Encrypt checks a special URL over HTTP.

Conceptually:

Let's Encrypt
      ↓
http://domain/.well-known/acme-challenge/...
      ↓
Your web server
      ↓
challenge response

This is one reason port 80 can be useful even when your site ultimately uses HTTPS.

73. Your SSL Installation

Earlier you received:

Successfully received certificate.

Behind the scenes, the process involved:

Certbot
 ↓
Let's Encrypt
 ↓
Domain validation
 ↓
Certificate issuance
 ↓
Certificate installation
 ↓
Nginx

DNS is part of the larger domain-validation infrastructure, though the exact challenge type depends on the Certbot configuration.

74. DNS Is a Dependency of Hosting

Your website can have:

Perfect Nginx
Perfect WordPress
Perfect SSL

but if:

DNS
 ↓
wrong IP

users still won’t reach the correct server.

75. DNS Failure Example

Suppose:

templates.cresignsys.com

points to:

Old VPS

while your website is on:

New VPS

Then:

Browser
 ↓
DNS
 ↓
Old VPS

Your new Nginx server may be completely healthy but invisible to those users.

76. DNS Record Change

Suppose:

Before:

templates → 203.0.113.50

Then:

After:

templates → 203.0.113.80

Users with cached answers may continue reaching the old IP until their cached data expires or is refreshed.

77. DNS Is Distributed

This is one of the deepest concepts.

There isn’t one server where everyone asks:

"What is templates.cresignsys.com?"

Instead:

Browser
 ↓
Resolver
 ↓
Cache / hierarchy
 ↓
Authoritative server

Different users may use different recursive resolvers.

78. The DNS Hierarchy

Memorize this:

                    ROOT
                      │
                      ▼
                    .COM
                      │
                      ▼
               cresignsys.com
                      │
                      ▼
          templates.cresignsys.com

The actual lookup involves delegation and authoritative data.

79. DNS Is Data, Not Traffic Routing

Another important distinction:

DNS says:

"Use this address/name."

It doesn’t carry your website’s HTTP content.

The actual website traffic comes later:

DNS
 ↓
IP
 ↓
TCP
 ↓
TLS
 ↓
HTTP

80. Complete Technology Chain

You now know:

DOMAIN
  ↓
DNS
  ↓
IP
  ↓
ROUTING
  ↓
VNIC
  ↓
FIREWALL
  ↓
TCP
  ↓
TLS
  ↓
HTTP
  ↓
NGINX
  ↓
PHP-FPM
  ↓
WORDPRESS
  ↓
MYSQL
  ↓
FILESYSTEM
  ↓
STORAGE

This is the backbone of modern web hosting.

81. Your `templates.cresignsys.com`

The complete conceptual journey is:

templates.cresignsys.com
          │
          ▼
     DNS A/AAAA
          │
          ▼
     Public IP
          │
          ▼
    Oracle Cloud VCN
          │
          ▼
        VNIC
          │
          ▼
     Ubuntu network
          │
          ▼
       TCP :443
          │
          ▼
       TLS/SNI
          │
          ▼
        Nginx
          │
          ▼
server_name templates.cresignsys.com
          │
          ▼
root /storage/websites/templates.cresignsys.com/public
          │
          ▼
       WordPress

82. Practical DNS Investigation

For your actual domain, these commands are worth learning:

dig A templates.cresignsys.com

dig AAAA templates.cresignsys.com

dig NS cresignsys.com

dig MX cresignsys.com

dig TXT cresignsys.com

dig +trace templates.cresignsys.com

And:

curl -v https://templates.cresignsys.com

83. The Most Important Concepts

Memorize:

Domain
=
human-friendly hierarchical name

DNS
=
distributed naming system

A
=
IPv4 address

AAAA
=
IPv6 address

CNAME
=
alias to another DNS name

MX
=
mail server information

TXT
=
text/verification/policy data

NS
=
authoritative nameserver delegation

TTL
=
cache lifetime

Resolver
=
finds DNS answers for clients

Authoritative server
=
source of authoritative zone data

84. The Key Difference

Don’t mix these three:

DNS
 ↓
Where is the server?

TCP
 ↓
Can I establish a reliable connection?

TLS
 ↓
Can I securely communicate with/authenticate the server?

Then:

HTTP
 ↓
What web resource do I want?

Lesson 036 Summary

When a user enters:

https://templates.cresignsys.com

the first major operation is:

templates.cresignsys.com
        ↓
DNS
        ↓
IP address

Then:

IP
 ↓
routing
 ↓
VNIC
 ↓
firewall
 ↓
TCP :443
 ↓
TLS
 ↓
SNI
 ↓
Nginx
 ↓
HTTP

That is the beginning-to-end relationship between DNS, networking, TLS and web hosting.

Next Lesson — 037

TCP — The Deepest Basics

We will go below DNS and study what happens after the IP address is known:

IP address
 ↓
TCP
 ↓
Port
 ↓
Socket
 ↓
SYN
 ↓
SYN-ACK
 ↓
ACK
 ↓
Sequence numbers
 ↓
Acknowledgements
 ↓
Retransmission
 ↓
Flow control
 ↓
Congestion control
 ↓
Connection termination

Then we will trace a real HTTPS connection:

Browser
     ↓
TCP SYN
     ↓
Oracle Cloud
     ↓
Ubuntu
     ↓
Nginx :443
     ↓
TCP connection
     ↓
TLS handshake

This will form the foundation for understanding why websites sometimes show connection timeout, connection refused, reset, 502, 503, or 504 errors.

CresignSys Learn — Lesson 036

DNS — From templates.cresignsys.com to Your VPS

1. What DNS Really Does

Domain Name System

2. Why DNS Exists

3. DNS Is Not the Internet

4. Domain Name Structure

5. Root of DNS

DNS Root

6. Fully Qualified Domain Name

7. TLD

Top-Level Domain

8. Second-Level Domain

9. Subdomain

10. DNS Names Are Hierarchical

11. Registrar

Domain Registrar

12. Registrar vs DNS Provider

Registrar

DNS provider

13. DNS Zone

14. DNS Records

15. A Record

A

16. AAAA Record

AAAA

17. A vs AAAA

18. CNAME

Canonical Name

19. CNAME Is Not an IP Record

20. MX

Mail Exchange

21. TXT

22. NS

Name Server

23. SOA

Start of Authority

24. CAA

Certification Authority Authorization

25. Your HTTPS Domain

26. DNS Lookup Does Not Connect to Nginx

27. DNS Resolver

Recursive DNS Resolver

28. Recursive Resolver

29. DNS Cache

30. TTL

Time To Live

31. Why TTL Matters

32. DNS Propagation

33. Authoritative Nameserver

34. Root Servers

Root DNS servers

35. TLD Nameservers

36. Full Recursive Lookup

37. The Root Doesn’t Know Everything

38. Delegation

39. Nameserver Configuration

40. The DNS Zone

41. Example Zone

42. Multiple Websites on One IP

43. How Does Nginx Know Which Website?

44. One IP, Many Domains

45. DNS Does Not Select the Website

46. SNI

SNI — Server Name Indication

47. Why SNI Was Important

48. DNS + SNI + Nginx

49. DNS + Nginx Configuration

50. Complete Flow for Your Domain

51. Local DNS Cache

52. dig

53. Query Only A

54. Query AAAA

55. Query CNAME

56. Query NS

57. Query MX

58. Query TXT

59. +short

60. Trace DNS

61. Why +trace Is Educational

DNS — From `templates.cresignsys.com` to Your VPS

52. `dig`

59. `+short`

61. Why `+trace` Is Educational

81. Your `templates.cresignsys.com`