Cheat Sheet
Key takeaway
DNS maps names to addresses through a delegated hierarchy, absorbs load with multi-layer caching, stays up via anycast replication and stateless UDP, and accepts eventual consistency on purpose. It is the internet's directory and your first, coarsest load balancer.
Key terms
| Term | One line |
|---|---|
| Resource record (RR) | Smallest unit of DNS data: type, name, value (plus TTL) |
| Name server | Any server that answers DNS queries |
| Resolver | Server that resolves on the client's behalf and caches; usually the ISP's |
| Authoritative server | Holds the real records for a zone — the source of truth |
| Zone | The slice of namespace one operator is authoritative for |
| Delegation | Handing a subtree to another operator, via NS records |
| TTL | How long a resolver may cache a record |
| Anycast | Many machines sharing one IP; routing picks the nearest |
| NXDOMAIN | "Name does not exist" — cached too (negative caching) |
| GSLB | Global server load balancing — DNS-level region selection |
Record types
| Type | Maps | Name | Value | Example |
|---|---|---|---|---|
| A | Hostname to IP | Hostname | IP address | (A, relay1.main.educative.io, 104.18.2.119) |
| NS | Domain to its authoritative DNS | Domain name | Hostname | (NS, educative.io, dns.educative.io) |
| CNAME | Alias to canonical hostname | Hostname | Canonical name | (CNAME, educative.io, server1.primary.educative.io) |
| MX | Mail alias to mail server | Hostname | Canonical name | (MX, mail.educative.io, mailserver1.backup.educative.io) |
Also: AAAA (IPv6) · TXT (verification, SPF/DKIM) · SRV (service+port) · PTR (reverse) · SOA (zone metadata)
Only A terminates a lookup. NS = delegation, CNAME = indirection, MX = service pointer. CNAME cannot sit at the zone apex — use ALIAS/ANAME.
The hierarchy
Resolver -> Root -> TLD -> Authoritative -> IP
(caches) (.io?) (which (the actual
which server records)
TLD) for it)
| Tier | Knows | Doesn't know |
|---|---|---|
| Root | Name servers for every TLD | Anything about a specific domain |
| TLD | Authoritative servers per domain | Any individual host's IP |
| Authoritative | Every record in its zone | Anything outside it |
Names read RIGHT to LEFT — educative.io resolves .io first. That's what makes delegation work: adding a domain touches one TLD server.
Resolution modes
| Iterative | Recursive | |
|---|---|---|
| Who navigates | The local server | Each server in turn |
| Upstream returns | A referral | The final answer |
| Load on root/TLD | Low, stateless | High, holds state |
| Used for | Resolver → hierarchy | Client → resolver |
Real answer: both. Stub resolver → resolver is recursive; resolver → hierarchy is iterative, so shared infrastructure stays stateless.
Caching
Browser -> OS -> Local/ISP resolver -> Hierarchy (hit stops the lookup at that layer)
Even on a miss, the resolver may hold cached TLD or authoritative addresses and skip the root entirely.
| TTL | Hit rate | Your DNS load | Propagation | Good for |
|---|---|---|---|---|
| 30–60 s | Low | High | Minutes | Failover targets, imminent migrations |
| 300 s | Good | Moderate | Reasonable | General default |
| 24 h | Very high | Low | A day+ | NS, MX, apex — stable records |
TTL is a request, not a guarantee. Resolvers clamp it, browsers have their own logic, and long-lived processes resolve once at startup.
The migration playbook
1. Lower TTL 2. WAIT OUT THE OLD TTL 3. Change the record 4. Dual-run both IPs 5. Drain, decommission 6. Raise TTL back
Step 2 is the one people skip and the one that matters. Better: CNAME to a load balancer so the address never changes.
Distributed system properties
- Scalable — hierarchy divides labor; ~1,000 instances back the 13 logical roots (A–M), run by 12 organizations
- Anycast — 13 addresses, not machines; routing picks the nearest. Gives scale + proximity + failover in one mechanism
- Reliable — caching survives server loss · global replication · UDP + retransmit (no connection state to recover)
- UDP → TCP when responses exceed 512 bytes or for zone transfers. DoH/DoT for privacy
- Consistency — eventual, deliberately. Propagation takes seconds to days. The canonical AP system: a stale IP usually still works; unresolvable names break everything
Traffic steering
| Policy | Decides by | Use for |
|---|---|---|
| Round robin | Rotating address order | Crude free distribution |
| Weighted | Configured ratio | Canaries, gradual migration |
| Geolocation | Resolver's location | Data residency |
| Latency-based | Measured latency | Fastest region |
| Failover | Health checks | Active-passive DR |
Two-tier pattern: DNS picks the region; a load balancer inside picks the server.
Limits: slow (TTL + non-compliant resolvers) · skewed (one resolver caches one answer for thousands) · blind to server load · resolver location ≠ user location.
Inspecting it
| Command | Shows |
|---|---|
nslookup example.com | Quick answer; "Non-authoritative" = from cache |
dig example.com | Full record, TTL, query time |
dig +trace example.com | The whole iterative walk, root → TLD → authoritative |
dig example.com MX | Mail records |
dig +short example.com | Just the answer |
Run dig twice: the TTL counts down. That's the resolver showing you how much life its cached copy has left.
Quick decision cues
- Need global region selection → DNS / GSLB
- Need failover in seconds → not DNS; anycast or a load balancer
- Putting a CDN in front → CNAME (ALIAS at the apex)
- Planning an IP change → lower TTL first, wait out the old one
- Record must move fast someday → keep its TTL permanently short
- Want the address never to change → point at a load balancer, swap behind it
- Debugging "some users see the old site" → check TTL and cache state per region
Work the Interview Walkthrough for the full design and the Concept Drills for rapid-fire practice.