DNS records, delegation, and resolver observations

Mechanism

DNS maps names through records and delegated zones. Recursive resolver answers can differ from authoritative answers because of caching, split views, forwarding, or policy. Record type matters: an address, alias, service record, or text record conveys different structure. DNS visibility does not imply host reachability or application trust.

Practical method

Query the relevant record types and inspect TTL, authority, and additional sections. Compare recursive and authoritative responses in the lab. Follow aliases and delegation deliberately, recording which server supplies each answer. Use controlled names to distinguish cache effects from current authoritative state.

dig lab.example A
dig lab.example TXT
dig lab.example NS

Interpreting evidence

Preserve the server queried and response flags. A changing address can reflect round-robin operation rather than a security issue, while stable cached data may hide an upstream change.

Pitfalls and limits

Negative answers can be cached. DNSSEC authenticates DNS data but does not establish application safety. Search suffixes and local hosts files can change name resolution before a DNS query occurs.