3.3 DNS & Subdomains
The Domain Name System (DNS) maps human-readable names to IP addresses. It is hierarchical, distributed, cached, and the source of more outages than its quiet reputation suggests.
3.3 DNS and Subdomains
DNS resolution flow
Record types
| Type | Purpose |
|---|---|
| A | IPv4 address for a name |
| AAAA | IPv6 address for a name |
| CNAME | Alias to another name |
| MX | Mail exchanger for the domain |
| NS | Authoritative nameserver for the zone |
| TXT | Free-form; SPF, DKIM, ownership proof |
| SRV | Service location (port + host) |
| CAA | Which CAs may issue certificates for this name |
TTL strategy
| Range | Trade-off |
|---|---|
| Short (60-300 sec) | Fast failover; more queries; more cost |
| Default (3600 sec) | Hourly refresh; balanced |
| Long (86400+ sec) | Cheap, slow to change |
Plan TTL drops a day before a planned change.
DNS security pitfalls
| Pitfall | Risk |
|---|---|
| No DNSSEC | Forged answers in transit |
| Old MX records | Mail to dead servers; silent loss |
| Wildcards (*.example.ph) | Matches subdomains you forgot |
| CNAMEs to expired domains | Subdomain takeover |
Mentor’s tip: DNS is a distributed cache, not a database. Plan TTL drops before changes. Audit MX, TXT, and wildcards yearly. DNSSEC + CAA + monitoring are the difference between quiet DNS and headline DNS.
Discussion
Loading…