Network notes / DNS

A name is not an address.

DNS connects a hostname to records. Those records can point to addresses or other names, and the answer you receive may have spent time in a cache.

Know which record you are reading

An A record provides an IPv4 address. An AAAA record provides an IPv6 address. A CNAME points one name at another name; the resolver still needs to follow that name to its address records.

A CNAME changes name resolution. It does not redirect a browser, replace the hostname in a URL, issue a certificate, or tell a client which port to use. An HTTP redirect is a separate response from a web server.

What a TTL does

The time to live (TTL) is the period a DNS response may be cached. Reducing a record's TTL does not recall answers that were already cached with the previous value. Browsers, operating systems and recursive resolvers can each have their own cache.

Negative answers can also be cached. If a name did not exist moments ago, creating it does not mean every resolver will immediately forget its earlier answer. Some resolvers can serve stale records during upstream failures.

Compare answers before changing settings

On a system with dig, inspect each address family and the authoritative nameservers separately:

dig yoooyo.co.uk A
dig yoooyo.co.uk AAAA
dig yoooyo.co.uk NS

On Windows, PowerShell's Resolve-DnsName yoooyo.co.uk provides a built-in lookup. Record the time, answer, record type and resolver you used. An empty AAAA answer can simply mean that no IPv6 address is published.

To ask a specific authoritative server, take one of the names returned by the NS lookup and use dig @nameserver hostname A, replacing both words with the names you are investigating. Compare that answer with your ordinary resolver. Authoritative agreement narrows a DNS investigation; it does not test the destination service.

Keep resolution separate from reachability

If DNS returns an expected address but HTTPS fails, move to the next layer. The server can be unreachable, the port can be blocked, or TLS can reject the hostname. Repeatedly changing DNS will not resolve those different failures.

When publishing a change: record both the old and new values, retain names still used by clients, and allow for cached answers. Deleting a record because a host is temporarily unreachable can break recovery and existing configurations.

Next: check HTTPS without bypassing certificate validation.