DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache

Recursive resolver

Your device normally sends the question to a resolver configured by the router, ISP, operating system, VPN, or private-DNS feature. The resolver does the wider lookup work and caches answers.

Authoritative DNS

The authoritative name servers publish the records for the domain. If you change a record at your DNS provider, the authoritative data may update quickly while older cached answers continue to exist until their TTLs expire.

Common records

A/AAAA point to IPv4/IPv6 addresses, CNAME aliases one name to another, MX identifies mail exchangers, TXT carries text-based policy/verification data, NS identifies authoritative servers, and SOA contains zone authority/timing information.

DNS does not carry the webpage

DNS only helps locate services. Once the address is known, the browser still has to establish the network/TLS/HTTP connection. Use the DNS Lookup to inspect published records.

Follow one lookup

The client checks local cache, asks a recursive resolver, and the resolver follows delegations toward authoritative servers if it lacks a cached answer. TTL controls cache lifetime, not instant global propagation.

Record roles

A/AAAA point names to addresses, CNAME aliases names, MX routes email, TXT carries policy/verification data, NS delegates authority and SOA describes the zone.

DNS can work while the website fails

A correct A/AAAA record only gives an address. TLS, firewall, server application and routing still need to succeed.

How to use this concept on a real network

Map the concept to one packet path: client → local switch/Wi-Fi → default gateway → WAN/ISP → destination. Identify which device performs each function rather than memorizing definitions in isolation. Packet captures, route tables, DHCP leases and router status pages are useful when available.

Common source of confusion

Home routers combine several roles in one box, so people use “router,” “Wi-Fi,” “DNS,” “DHCP” and “internet” interchangeably. Separating the roles makes troubleshooting faster and helps you understand what changes when another router, mesh system or VPN is added.

Connect the concept to packet flow

Start with one client sending one request. The client has a link, an address and a routing table. It decides whether the destination is on-link or must go to a gateway. The local network transports the frame, the router applies routing/firewall/NAT policy as appropriate, and upstream networks carry it toward the destination. DNS can be needed before the first packet if the user supplied a hostname.

Observe instead of guessing

Useful evidence includes the client IP configuration, ARP/neighbor table, routing table, DHCP lease, DNS response, router WAN/LAN status, firewall logs and packet captures where appropriate. You rarely need every tool; choose the observation that tests the current hypothesis.

Home gateways combine roles

A single plastic box can be Ethernet switch, Wi-Fi access point, IPv4 router, IPv6 router, DHCP server, DNS forwarder, NAT device, firewall and VPN endpoint. Understanding which role is failing prevents category errors such as changing Wi-Fi channels to fix a DNS problem.

Topology changes behavior

Add a second router, mesh system, managed switch, VLAN, VPN or ISP gateway and the path changes. Double NAT, overlapping subnets and multiple DHCP servers are topology problems, not mysterious “bad internet.” Draw the path and mark which device owns each role.

Security is part of the model

Isolation and firewall rules can intentionally prevent reachability. A failed connection is not always a fault; it can be policy working correctly. Diagnose from an authorized network segment before disabling security controls.

DNS evidence to collect

Compare the configured resolver with the authoritative answer, note TTLs, and test both A/AAAA where relevant. Clear local cache only when you understand what you are trying to remove. If one resolver returns different data, check split DNS, filtering, stale cache and DNSSEC/authoritative configuration before assuming “propagation.”

DNS is not a connectivity test by itself

A correct answer can point to a server that is offline, firewalled or serving the wrong virtual host. Continue testing transport/TLS/application after name resolution succeeds.

Where the simplified explanation stops

Real networks can include policy routing, IPv6, multiple VLANs, several DNS resolvers, carrier NAT, dynamic routing, tunnels and stateful firewalls. The home-network model in this guide is deliberately practical, not a replacement for the protocol standard or vendor implementation documentation.

Terms that often get mixed together

Addressing, routing, name resolution, switching, wireless access and transport security are related but separate. When a troubleshooting step changes one layer, be explicit about which outcome should change. That discipline makes advanced topics easier later.

Use packet-level evidence when necessary

When basic status pages cannot explain a failure, a packet capture or detailed router log can show whether requests leave, replies return, DNS answers differ, or a firewall resets/drops traffic. Capture only traffic you are authorized to inspect.

Where this advice stops being universal

The principles in DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache apply broadly, but interface names and supported features do not. A mesh system managed by an app, an ISP gateway with provider firmware, a prosumer firewall, and an ordinary retail router can expose the same underlying function in very different ways. Use the concept to understand the job, then use the exact device documentation to perform it.

Do not import settings from a different topology

Values copied from another household can create overlaps, break WAN authentication, expose services, or disable access to the management interface. Copy the reasoning, not the configuration.

How to validate the explanation on your own network

For DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache verification detail 1, look for an observable before/after signal: route table, lease, DNS answer, gateway reachability, radio association, WAN status, application behavior, or latency under load. A setting is understood when you can predict which observation it should change and which observations it should leave alone.

Keep recovery access available

When a change can affect Wi-Fi, LAN addressing, routing, or admin access, keep an Ethernet path or documented recovery method available before pressing Save.

Use the smallest change that solves the problem

A reliable network is easier to maintain when every exception has a reason. With DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache verification detail 2, avoid enabling extra services, widening firewall rules, changing multiple radio parameters, or replacing automatic configuration with static values unless the problem actually requires it.

Re-check after firmware or ISP changes

Router updates and provider migrations can rename controls, alter defaults, or move a feature into an app. Re-verify device-specific instructions after a major firmware, gateway, or service change.

Use the smallest change that solves the problem

A reliable network is easier to maintain when every exception has a reason. With DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache verification detail 3, avoid enabling extra services, widening firewall rules, changing multiple radio parameters, or replacing automatic configuration with static values unless the problem actually requires it.

Re-check after firmware or ISP changes

Router updates and provider migrations can rename controls, alter defaults, or move a feature into an app. Re-verify device-specific instructions after a major firmware, gateway, or service change.

Practical verification notes for this topic

With DNS Explained: Resolver, Authoritative Server, A/AAAA, CNAME, MX, and Cache verification detail 4, the most reliable workflow is to record the starting state, identify which network layer owns the behavior, and make one reversible change at a time. If the result does not change in the way the theory predicts, stop and re-check the topology rather than stacking more fixes.

Evidence worth keeping

Useful notes include the exact router/gateway model, operating mode, client IP and gateway, whether the test used Ethernet or Wi-Fi, relevant timestamps, and the before/after setting. Those details make later troubleshooting and vendor support dramatically more effective.

Frequently asked questions