It was DNS. It is always DNS.

A hands-on DNS reference where the examples actually run (unless something really is wrong with DNS). The demo records live in a real public zone, example.isitdns.net, so you can paste nearly every command on these pages into your own terminal and get the same records back. A few examples need a newer dig or kdig, and some deliberately return an error rcode instead of a record. Naturally volatile values differ run to run: TTLs count down, DNSSEC signatures rotate.

Try it:

dig @1.1.1.1 +short txt.example.isitdns.net TXT

"It was DNS. It is always DNS."

That record is real, and so are the A, AAAA, CNAME, MX, SRV, and CAA records you meet in the walkthrough. They resolve for real, but every address is a documentation address (192.0.2.1 from RFC 5737, 2001:db8::1 from RFC 3849), so nothing routes anywhere.

Three ways in#

Something is broken: the walkthroughs, in the order you should run them:

• Is it actually DNS?: the failure modes that get blamed on DNS, each with the dig output that proves it. Read this before you go looking.
• Troubleshooting: start here: which of the four things to check, and how to tell them apart before you touch anything.
• Check a resolver: is the thing your machine asks actually answering, and answering correctly.
• Check a forwarder: when the resolver hands the query on and the answer comes back wrong.
• Check a delegation: parent and child disagree about who is authoritative.
• Check an authoritative server: the server that owns the zone, asked directly, with every cache bypassed.

Learn by doing: guided lessons, one query at a time:

• The dig-along: every common record type, live. The best place to start.
• Live examples: DNSSEC, NXDOMAIN, ECS, encrypted DNS, and ANY/RFC 8482, with annotated output.
• The dig tool: no terminal needed. The manual for the in-browser dig on the front page: every control, every output line.

Look something up: the reference wiki, a page for every part of DNS:

• The DNS wiki: read it in order to understand DNS from the ground up, or jump straight to what you need. Every section is indexed there.
• The dig phonebook: every dig and nslookup command in the wiki on one page, sorted by what you are trying to see.

What's inside the wiki#

• Foundations: how a lookup actually works (stub to recursive to root to authoritative), recursive versus authoritative, and the query types.
• Records: a page on each type (A, AAAA, CNAME, MX, NS, PTR, SOA, TXT, CAA, and more): what it holds, when to use it, a live dig, and the RFC behind it.
• Tools: the in-browser dig tool, dig and nslookup, the dig-flag reference, the guided dig-along, the verdict over DNS itself, and the Wireshark filter set.
• Troubleshooting: where to start, then how to check a resolver, a forwarder, a delegation, and an authoritative server.
• Zones: the four types you will actually meet, authoritative, forward, delegated, stub, and zone transfer.
• Security: DNSSEC and what to do when it goes BOGUS, the 2026 root KSK roll and its long reference, Extended DNS Errors, DNSViz, DoT, DoH and DoQ, CAA policy, dynamic DNS, split-horizon, and Cloudflare hardening.
• Reference: the glossary, the RFC index, the record-type cheat sheet, and reverse DNS.

Throughout the wiki, claims link out to the RFC or vendor doc behind them, so this is a starting point, not the last word.