DNS Complete Guide: Name Servers, DDNS, nslookup — From Domain Registration to Troubleshooting

User input: www.example.com
     |
DNS Resolution
     |
IP address: 93.184.216.34
     |
HTTP request to server

          .  (Root)
         / \
      com   org   net   kr   jp  ...   (TLD - Top Level Domain)
       |
    example                             (SLD - Second Level Domain)
     / \
   www  mail  api                       (Subdomain)

[User PC] -- Recursive Query --> [Recursive Resolver (ISP/8.8.8.8)]
                                        |
                                  Iterative Queries Begin
                                        |
                        +---------------+---------------+
                        v               v               v
                 [Root Server]   [TLD Server]   [Authoritative NS]
                 ".com is here"  "example.com    "IP is 93.x.x.x"
                                  is here"

[Browser Cache] -> [OS Cache] -> [Recursive Resolver Cache] -> [TTL from each NS response]

Chrome: chrome://net-internals/#dns to inspect
Windows: ipconfig /displaydns
Linux: systemd-resolve --statistics
macOS: sudo dscacheutil -flushcache

example.com.    3600    IN    A    93.184.216.34
                 ^
              TTL = 3600 seconds (1 hour)

[Primary NS] --Zone Transfer--> [Secondary NS]
  (read/write)                    (read only)

  Manages original zone file       Backup when Primary fails
  Add/modify/delete records        Load distribution role

# Test AXFR (should be blocked from external sources for security)
dig @ns1.example.com example.com AXFR

# Check synchronization via SOA record Serial
dig @ns1.example.com example.com SOA +short
# 2024032301 ns1.example.com. admin.example.com. ...

Q: What is example.com's IP?
-> example.com's name server is ns1.example.com
-> What is ns1.example.com's IP?
-> Need to ask example.com's name server, but...
-> Circular reference!

;; Delegation records in .com TLD server
example.com.    IN    NS    ns1.example.com.
example.com.    IN    NS    ns2.example.com.

;; Glue records (Additional Section)
ns1.example.com.    IN    A    203.0.113.1
ns2.example.com.    IN    A    203.0.113.2

# CoreDNS Corefile example
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
loadbalance
}

# Accessing services from a Pod
my-service                          -> my-service.default.svc.cluster.local
my-service.other-ns                 -> my-service.other-ns.svc.cluster.local
my-service.other-ns.svc.cluster.local -> Full FQDN

# Pod's /etc/resolv.conf
nameserver 10.96.0.10          # CoreDNS ClusterIP
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5                # If fewer than 5 dots, append search domains

# OK - CNAME on subdomain
www.example.com.    IN    CNAME    example.com.

# BAD - Cannot use CNAME on root domain (Apex)!
# example.com.       IN    CNAME    other.com.    (RFC violation)

# Solutions: ALIAS/ANAME (non-standard) or Cloudflare's CNAME Flattening

example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.0/24 -all"

selector1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEB..."

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"

$TTL 3600
$ORIGIN example.com.

@       IN  SOA   ns1.example.com. admin.example.com. (
                  2026032301  ; Serial (YYYYMMDDNN)
                  3600        ; Refresh (1 hour)
                  900         ; Retry (15 min)
                  1209600     ; Expire (2 weeks)
                  86400       ; Minimum TTL (1 day)
                  )

; Name servers
@       IN  NS    ns1.example.com.
@       IN  NS    ns2.example.com.

; A records
@       IN  A     203.0.113.10
www     IN  A     203.0.113.10
api     IN  A     203.0.113.20

; AAAA record
@       IN  AAAA  2001:db8::10

; CNAME
blog    IN  CNAME example.github.io.
docs    IN  CNAME readthedocs.io.

; MX records (lower number = higher priority)
@       IN  MX    10 mail.example.com.
@       IN  MX    20 mail2.example.com.
mail    IN  A     203.0.113.30

; TXT records
@       IN  TXT   "v=spf1 include:_spf.google.com -all"
_dmarc  IN  TXT   "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

; SRV record
_sip._tcp  IN  SRV  10 60 5060 sip.example.com.

; CAA records
@       IN  CAA   0 issue "letsencrypt.org"
@       IN  CAA   0 issuewild "letsencrypt.org"

[ICANN] --manages--> [Registry] --delegates--> [Registrar] --sells--> [Reseller]
                     (Verisign, etc.)         (Namecheap, etc.)       (Hosting, etc.)

Registry: Manages an entire TLD (e.g., .com is Verisign)
Registrar: ICANN-accredited to handle domain registration
Reseller: Resale partner of a registrar

1. Disable Transfer Lock at current registrar
2. Obtain Auth Code (EPP code) from current registrar
3. Initiate Transfer at new registrar + enter Auth Code
4. Confirm approval email from old registrar (5-7 day wait)
5. Verify DNS settings after transfer completes

Important notes:
- 60-day transfer lock after registration/transfer (ICANN 60-Day Lock)
- Cannot transfer domains expiring within 15 days
- Country-code TLDs (.kr, .jp, etc.) may have separate procedures

# Whois lookup
whois example.com

# RDAP (Whois successor, JSON-based)
curl -s "https://rdap.verisign.com/com/v1/domain/example.com" | jq .

Problem:
  Home server IP: 211.xxx.xxx.100 (yesterday)
  Home server IP: 211.xxx.xxx.200 (today) - IP changed!

  DNS: myserver.example.com -> 211.xxx.xxx.100 (registered yesterday)
  -> Cannot connect!

Solution (DDNS):
  Detect IP change -> Automatically update DNS record
  myserver.example.com -> 211.xxx.xxx.200 (auto-updated)

# Install
sudo apt install ddclient

# /etc/ddclient.conf configuration (Cloudflare example)
protocol=cloudflare
use=web, web=https://api.ipify.org
zone=example.com
login=your-email@example.com
password=your-cloudflare-api-token
myserver.example.com

# Start service
sudo systemctl enable ddclient
sudo systemctl start ddclient

# Check status
sudo systemctl status ddclient
sudo ddclient -query

#!/bin/bash
# cloudflare-ddns.sh

# Configuration
CF_API_TOKEN="your-api-token-here"
CF_ZONE_ID="your-zone-id-here"
CF_RECORD_NAME="myserver.example.com"
CF_RECORD_ID="your-record-id-here"

# Get current public IP
CURRENT_IP=$(curl -s https://api.ipify.org)

# Get IP registered in DNS
DNS_IP=$(dig +short "$CF_RECORD_NAME" @1.1.1.1)

# Update if IP has changed
if [ "$CURRENT_IP" != "$DNS_IP" ]; then
    echo "IP changed: $DNS_IP -> $CURRENT_IP"

    curl -s -X PUT \
        "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records/$CF_RECORD_ID" \
        -H "Authorization: Bearer $CF_API_TOKEN" \
        -H "Content-Type: application/json" \
        --data "{\"type\":\"A\",\"name\":\"$CF_RECORD_NAME\",\"content\":\"$CURRENT_IP\",\"ttl\":60,\"proxied\":false}"

    echo "DNS updated successfully"
else
    echo "IP unchanged: $CURRENT_IP"
fi

# Add to crontab (run every 5 minutes)
crontab -e
# */5 * * * * /home/user/cloudflare-ddns.sh >> /var/log/ddns.log 2>&1

# docker-compose.yml
version: '3'
services:
  cloudflare-ddns:
    image: oznu/cloudflare-ddns:latest
    restart: always
    environment:
      - API_KEY=your-cloudflare-api-token
      - ZONE=example.com
      - SUBDOMAIN=myserver
      - PROXIED=false
      - RRTYPE=A
      - DELETE_ON_STOP=false
      - DNS_SERVER=1.1.1.1

docker-compose up -d

[Internet] -> [Router Port Forwarding] -> [Nginx Proxy Manager] -> [Services]
                                                  |
                                            Let's Encrypt
                                            Auto SSL Issuance

# docker-compose.yml - Home server stack
version: '3'
services:
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '81:81' # Admin panel
    volumes:
      - ./npm-data:/data
      - ./npm-letsencrypt:/etc/letsencrypt

  cloudflare-ddns:
    image: oznu/cloudflare-ddns:latest
    restart: always
    environment:
      - API_KEY=your-cf-token
      - ZONE=example.com
      - SUBDOMAIN=home

Router settings:
  External 80 -> Internal 192.168.1.100:80
  External 443 -> Internal 192.168.1.100:443

Linux firewall (UFW):
  sudo ufw allow 80/tcp
  sudo ufw allow 443/tcp
  sudo ufw enable

# Basic lookup
nslookup example.com
# Server:  8.8.8.8
# Address: 8.8.8.8#53
#
# Non-authoritative answer:
# Name:    example.com
# Address: 93.184.216.34

# Query using a specific DNS server
nslookup example.com 1.1.1.1

# MX records (mail servers)
nslookup -type=mx gmail.com
# gmail.com  mail exchanger = 5 gmail-smtp-in.l.google.com.
# gmail.com  mail exchanger = 10 alt1.gmail-smtp-in.l.google.com.

# AAAA records (IPv6)
nslookup -type=aaaa google.com

# TXT records (SPF, DKIM, etc.)
nslookup -type=txt example.com

# NS records (name servers)
nslookup -type=ns example.com

# SOA records (zone information)
nslookup -type=soa example.com

# CAA records (certificate authority authorization)
nslookup -type=caa example.com

# SRV records (service location)
nslookup -type=srv _sip._tcp.example.com

# ANY (all records - some servers block this)
nslookup -type=any example.com

nslookup
> server 8.8.8.8          # Change DNS server
> set type=mx              # Set record type
> gmail.com                # Query
> set type=txt
> example.com
> set debug                # Debug mode ON
> example.com              # Detailed output
> set d2                   # More detailed debug
> exit

# IP -> Domain lookup
nslookup 8.8.8.8
# 8.8.8.8.in-addr.arpa  name = dns.google.

nslookup 1.1.1.1
# 1.1.1.1.in-addr.arpa  name = one.one.one.one.

# 1. Check name servers for a domain
nslookup -type=ns example.com

# 2. Check mail servers (email debugging)
nslookup -type=mx company.com

# 3. Check SPF records (email spam issues)
nslookup -type=txt example.com

# 4. Compare Google DNS vs Cloudflare DNS
nslookup example.com 8.8.8.8
nslookup example.com 1.1.1.1

# 5. Check IPv6 addresses
nslookup -type=aaaa facebook.com

# 6. Test wildcard subdomains
nslookup nonexistent-sub.example.com

# 7. Check CAA records (before SSL certificate issuance)
nslookup -type=caa example.com

# 8. Reverse DNS lookup (identify IP owner)
nslookup 203.0.113.1

# 9. Trace CNAME chains
nslookup -type=cname www.example.com

# 10. Check SOA record for DNS administrator info
nslookup -type=soa example.com

# Basic query
dig example.com

# Output structure:
# ;; QUESTION SECTION:    <- Question
# ;example.com.           IN  A
#
# ;; ANSWER SECTION:      <- Answer
# example.com.      3600  IN  A  93.184.216.34
#
# ;; AUTHORITY SECTION:   <- Authoritative name servers
# example.com.      3600  IN  NS  a.iana-servers.net.
#
# ;; ADDITIONAL SECTION:  <- Additional info
# a.iana-servers.net. 3600 IN  A  199.43.135.53
#
# ;; Query time: 23 msec
# ;; SERVER: 8.8.8.8#53(8.8.8.8)

# Short output (IP only)
dig +short example.com
# 93.184.216.34

# Specific record types
dig example.com MX
dig example.com AAAA
dig example.com TXT
dig example.com NS
dig example.com SOA
dig example.com CAA

# Specify DNS server
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com

# Check response time only
dig example.com | grep "Query time"
# ;; Query time: 23 msec

# Trace entire DNS resolution from Root
dig +trace example.com

# Output (summary):
# .                   518400  IN  NS  a.root-servers.net.  <- Root
# com.                172800  IN  NS  a.gtld-servers.net.  <- TLD
# example.com.         86400  IN  NS  a.iana-servers.net.  <- Authoritative
# example.com.          3600  IN  A   93.184.216.34        <- Final answer

# Check DNSSEC signature info
dig +dnssec example.com

# Verify DNSSEC validity
dig +sigchase +trusted-key=/etc/trusted-key.key example.com

# Query DNSSEC-related records directly
dig example.com DNSKEY
dig example.com DS
dig example.com RRSIG
dig example.com NSEC

# Query all domains from a file at once
cat domains.txt
# example.com
# google.com
# github.com

dig -f domains.txt +short

# Batch query for specific record type
dig -f domains.txt MX +short

# TCP mode (instead of UDP)
dig +tcp example.com

# Output specific sections only
dig +noall +answer example.com    # Answer only
dig +noall +authority example.com  # Authority section only
dig +noall +stats example.com     # Statistics only

# Abbreviated output with TTL
dig +nocmd +noall +answer +ttlid example.com

# Reverse lookup
dig -x 8.8.8.8
# 8.8.8.8.in-addr.arpa.  IN  PTR  dns.google.

# Check DNS server version via CHAOS class
dig @ns1.example.com version.bind CHAOS TXT

# EDNS Client Subnet test
dig +subnet=203.0.113.0/24 example.com @8.8.8.8

# 1. Check authoritative response from specific name server
dig @ns1.example.com example.com +norecurse

# 2. Check DNS propagation (compare multiple DNS servers)
for dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do
  echo "=== $dns ==="
  dig @$dns example.com +short
done

# 3. Trace full CNAME chain
dig +trace +nodnssec www.example.com CNAME

# 4. Check MX record priorities
dig example.com MX +short | sort -n

# 5. Check SPF record
dig example.com TXT +short | grep spf

# 6. Check DKIM record
dig selector1._domainkey.example.com TXT +short

# 7. Check DMARC policy
dig _dmarc.example.com TXT +short

# 8. Check CAA records (before SSL issuance)
dig example.com CAA +short

# 9. Check SOA serial number (zone transfer sync)
dig example.com SOA +short

# 10. Compare response times (DNS performance test)
for i in $(seq 1 10); do
  dig example.com @8.8.8.8 | grep "Query time"
done

# 11. Check IPv6 records
dig example.com AAAA +short

# 12. Verify wildcard DNS
dig random-subdomain.example.com +short

# 13. Check NSEC/NSEC3 for DNSSEC authenticated denial
dig nonexistent.example.com NSEC

# 14. Check DNS response size (DDoS amplification test)
dig example.com ANY +bufsize=4096

# 15. Attempt full zone export (security audit)
dig @ns1.example.com example.com AXFR

Normal: Resolver -> Authoritative NS -> Correct IP
Attack: Attacker injects fake response into resolver cache
Result: Users are redirected to phishing sites

Defense: DNSSEC, random source ports, 0x20 encoding

Attack method:
1. Attacker spoofs source IP to victim's IP
2. Sends queries that generate large responses to open resolvers (ANY type)
3. Small query -> Large response = amplification effect (50-70x)
4. All responses flood the victim

Defense: BCP38 (source address validation), RRL (Response Rate Limiting)

Method 1: DNS response tampering at router/ISP level
Method 2: Registrar account compromise -> name server change
Method 3: Malware changes system DNS settings

Defense: DNSSEC, registrar 2FA, DNS monitoring

Purpose: Abuse DNS protocol for data exfiltration/remote control
Method: Hide encoded data in DNS queries/responses

Example: Query TXT for malicious-data.encoded.evil.com
-> Firewall sees it as normal DNS traffic

Defense: Monitor DNS query length/frequency, DNS firewall

Chain of Trust:
  Root (.) -> .com -> example.com

  At each level:
  1. DNSKEY: Zone's public key
  2. RRSIG: Digital signature for each record
  3. DS: Hash of child zone's public key (stored in parent zone)
  4. NSEC/NSEC3: Proof that "this name does not exist"

# Check DNSSEC verification
dig +dnssec example.com

# 'ad' flag in response means DNSSEC validation succeeded
# flags: qr rd ra ad; QUERY: 1, ANSWER: 2

# Query DNSKEY
dig example.com DNSKEY +short

# Query DS record (from parent zone)
dig example.com DS +short

# DoH DNS query (curl)
curl -s -H "accept: application/dns-json" \
  "https://1.1.1.1/dns-query?name=example.com&type=A" | jq .

# DoH services
# Cloudflare: https://1.1.1.1/dns-query
# Google: https://dns.google/dns-query
# Quad9: https://dns.quad9.net/dns-query

# DoT test (using kdig)
kdig -d @1.1.1.1 +tls-ca +tls-host=cloudflare-dns.com example.com

[Devices] -> [DNS Filter] -> [Only allowed queries pass] -> [Internet]
                 |
           Block ads/malicious domains
           Block trackers
           Filter adult content

RPZ (Response Policy Zone):
  Technology to override responses for specific domains in a DNS firewall

Example (BIND RPZ):
; rpz.db
evil-domain.com        CNAME  .           ; NXDOMAIN response
malware-c2.com         CNAME  .           ; Block
phishing-site.com      A      10.0.0.1    ; Redirect to warning page

# Diagnosis
# 1. Check directly from authoritative name server (if this works, config is correct)
dig @ns1.your-dns-provider.com yourdomain.com A +short

# 2. Check propagation via multiple public DNS
dig @8.8.8.8 yourdomain.com +short
dig @1.1.1.1 yourdomain.com +short
dig @9.9.9.9 yourdomain.com +short

# 3. Check global propagation online
# https://www.whatsmydns.net/

# Diagnosis: Check CAA records
dig yourdomain.com CAA +short
# 0 issue "digicert.com"   <- Let's Encrypt is not in the allow list!

# Fix: Add or modify CAA record
# yourdomain.com. IN CAA 0 issue "letsencrypt.org"
# yourdomain.com. IN CAA 0 issuewild "letsencrypt.org"

# If no CAA records exist, all CAs can issue (default behavior)
dig yourdomain.com CAA +short
# (empty response = no restrictions)

# Diagnosis 1: Check SPF record
dig yourdomain.com TXT +short | grep spf
# "v=spf1 include:_spf.google.com -all"

# Diagnosis 2: Check DKIM record (selector from email headers)
dig google._domainkey.yourdomain.com TXT +short

# Diagnosis 3: Check DMARC policy
dig _dmarc.yourdomain.com TXT +short
# "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

# Resolution checklist:
# 1. Verify SPF includes all mail-sending server IPs/domains
# 2. Verify DKIM signing key is registered
# 3. Set up DMARC policy (start with p=none for monitoring)
# 4. Analyze DMARC reports, then strengthen: p=quarantine -> p=reject

# Diagnosis: Check if subdomain record exists
dig staging.example.com A +short
# (empty response = no record)

dig api.example.com A +short
# 203.0.113.20  (working)

# Check wildcard records
dig *.example.com A +short

# Diagnosis: Check cache state at different DNS servers
dig @8.8.8.8 example.com +short    # Google DNS
dig @1.1.1.1 example.com +short    # Cloudflare DNS
dig @9.9.9.9 example.com +short    # Quad9

# Check TTL
dig example.com | grep -A1 "ANSWER SECTION"
# example.com.  1800  IN  A  203.0.113.10
#                ^ remaining TTL is still high

# Diagnosis 1: Check hosts file
cat /etc/hosts          # Linux/macOS
type C:\Windows\System32\drivers\etc\hosts  # Windows

# Diagnosis 2: Check browser DNS cache
# Chrome: chrome://net-internals/#dns -> Clear host cache

# Diagnosis 3: Check HSTS issues
# Chrome: chrome://net-internals/#hsts
# Delete domain and retry

# Diagnosis 4: Check proxy/VPN settings
# Browser proxy settings can bypass DNS

# Diagnosis 5: Check DNS over HTTPS settings
# Chrome Settings -> Privacy and Security -> Use secure DNS

# Diagnosis: Check current name servers
dig example.com NS +short
# If old registrar's NS appear, update hasn't propagated yet

# Resolution steps:
# 1. Set up DNS records at new registrar FIRST
# 2. Replicate ALL records to the new location before transfer
# 3. Change name servers
# 4. Keep old name servers active for at least 48 hours

# Diagnosis 1: Test DNS resolution from within the Pod
kubectl exec -it debug-pod -- nslookup api.external.com

# Diagnosis 2: Check resolv.conf
kubectl exec -it debug-pod -- cat /etc/resolv.conf
# nameserver 10.96.0.10
# search default.svc.cluster.local svc.cluster.local cluster.local
# options ndots:5

# Diagnosis 3: Check CoreDNS logs
kubectl logs -n kube-system -l k8s-app=kube-dns

# Problem: Due to ndots:5, api.external.com (2 dots) causes
# api.external.com.default.svc.cluster.local etc. to be tried first

# Method 1: Use FQDN (add trailing dot)
# In code, call api.external.com. instead

# Method 2: Set Pod dnsConfig
apiVersion: v1
kind: Pod
spec:
  dnsConfig:
    options:
      - name: ndots
        value: '2'

# Diagnosis: Check for non-proxied records
# In Cloudflare dashboard, look for grey cloud (DNS Only)
# instead of orange cloud (Proxied) records

# Scan subdomains for exposure
dig direct.example.com +short     # Origin IP exposed?
dig mail.example.com +short       # Origin IP in MX A record?
dig ftp.example.com +short        # Origin IP in FTP subdomain?

# Diagnosis 1: Check current public IP
curl -s https://api.ipify.org

# Diagnosis 2: Check IP registered in DNS
dig myserver.example.com +short

# Diagnosis 3: Check DDNS client logs
sudo journalctl -u ddclient -n 50

# Diagnosis 4: Verify API token validity
curl -s -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer YOUR_TOKEN" | jq .

# Common causes:
# 1. API token expired or insufficient permissions
# 2. Wrong Zone ID or Record ID
# 3. Firewall blocking DDNS client outbound communication
# 4. Cron job disabled
# 5. IP check service (ipify, etc.) unreachable