Domain Names / DNS

What is FQDN?

Fully Qualified Domain Name: sometimes also referred as an absolute domain name is a domain name that specifies its exact location in the tree hierarchy of the Domain Name System (DNS).

What is TLD?

Top Level Domains.

What is 8.8.8.8?

Google DNS is a public DNS service that is provided by Google.

8.8.8.8: the primary DNS server for Google DNS.
8.8.4.4: the secondary DNS server.

Other notable public DNS resolvers:

CloudFlare: 1.1.1.1.
Quad9: 9.9.9.9.

What is Multicast DNS?

In computer networking, the multicast DNS (mDNS) protocol resolves hostnames to IP addresses within small networks that do not include a local name server. It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as unicast Domain Name System (DNS). It was designed to work as either a stand-alone protocol or compatible with standard DNS servers.

What is SRV record?

The DNS "service" (SRV) record specifies a host and port for specific services such as voice over IP (VoIP), instant messaging, and so on. Most other DNS records only specify a server or an IP address, but SRV records include a port at that IP address as well.

What is SOA record?

A Start of Authority (SOA) record is a DNS record that stores administrative information about a domain or zone. This information includes:

The domain's primary name server
The domain's responsible party, such as an email address
A timestamp of the last domain update
The number of seconds before the zone should be refreshed
A time period for secondary name servers to retry zone transfers after a failure

SOA records are required for all DNS zones to comply with IETF standards. They are also important for zone transfers. A new SOA record is needed whenever a new zone is set up or a DNS zone is transferred.

To check SOA records, use dig:

$ dig google.com SOA

Recursive resolver vs Iterative resolver

recursive resolver: the server that sends a query to the authoritative or non-authoritative server for resolution. A recursive resolver is so-called because it performs each query for a given name and returns the final result.
iterative resolver: only returns a referral to the next DNS servers that might have the answer.

Why dig shows ::1?

In the world of IPv6, ::1 is the loopback address. It is the IPv6 equivalent of the more familiar IPv4 address 127.0.0.1. When you see this, it means dig didn't actually go out to the internet to talk to Cloudflare (1.1.1.1). Instead, it talked to a local DNS resolver running on your own computer.

Why did this happen?

If you ran the command as just dig google.com (without the @1.1.1.1), dig looked at your system's configuration file (usually /etc/resolv.conf) to see where it should send queries.

Most modern Linux distributions (like Ubuntu or Fedora) use a local "stub resolver" called systemd-resolved.

The Flow: Your application (dig) → Local Resolver (::1) → Internet DNS (1.1.1.1).
The Benefit: Your computer can cache results locally. If you ask for google.com twice, the second request is nearly instant because the local resolver already knows the answer.

How to fix it (and see Cloudflare)

To send a simple request to Cloudflare’s DNS server for a specific domain (e.g., google.com), use the @ symbol to specify the server:

dig @1.1.1.1 google.com

Are CloudFlare and Google maintaining two separate phonebooks?

There is one master directory, and Cloudflare and Google are different operator services you can call to look things up for you.

1. The Master List (The Publishers)

There isn't one company that owns the list of every website. Instead, the "phonebook" is broken into millions of tiny pieces:

The Root: The "Table of Contents" that tells you where to find the .com or .org section.
The Authoritative Servers: If you own yourwebsite.com, you (or your host) are the "publisher" for your specific page in the phonebook. You decide what IP address your name points to.

2. The Operators (Cloudflare vs. Google)

When you use 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google), you are choosing a Recursive Resolver.

Think of them as personal assistants. Instead of you traveling to the Root server, then the .com server, then the specific website's server to find an address, you just ask your "assistant" (the resolver).

Then where's the source of truth of DNS?

The "Source of Truth" for DNS is not a single server or a single company like Cloudflare. Instead, it is a distributed hierarchy that starts with a tiny file at the very top of the internet.

1. The Ultimate Source: The Root Zone File

At the very top is the Root Zone. This is a simple text file that lists the addresses of the servers responsible for every Top-Level Domain (TLD) like .com, .org, .net, and .jp.

Who manages it? A non-profit organization called ICANN (Internet Corporation for Assigned Names and Numbers) via a department called IANA.
Where is it? This file is hosted on 13 Root Servers (named A through M).
- Note: There aren't literally only 13 physical computers. Using "Anycast" (like Cloudflare does), these 13 addresses are actually broadcast by over 1,000 servers all over the world.

If you ask a Root Server for google.com, it says: "I don't know where google.com is, but I know who is in charge of .com. Here is the address for the Verisign servers."

2. The Second Level: TLD Name Servers

Every TLD has a "Registry" (a company or organization) that manages it.

.com and .net are managed by a company called Verisign.
.org is managed by the Public Interest Registry.
.uk is managed by Nominet.

If you ask the Verisign server for google.com, it says: "I don't know the IP of google.com, but I know that Google's own servers are managing that name. Here are the addresses for ns1.google.com."

3. The Final Source: Authoritative Name Servers

This is the actual "Source of Truth" for a specific domain. When you buy a domain (like example.com), you tell your registrar which "Authoritative Name Servers" you want to use.

If you use Cloudflare to manage your DNS, Cloudflare's servers become the Authoritative Source of Truth for your domain.
If you run your own DNS server in your basement, your server is the Source of Truth.

When you ask Google’s Authoritative Server for google.com, it finally says: "The IP address is 142.250.190.46."

Authoritaive Name Servers

To list the name server:

dig example.com NS
;; ANSWER SECTION:
example.com.	21600	IN	NS	karl.ns.cloudflare.com.
example.com.	21600	IN	NS	roxy.ns.cloudflare.com.

If you buy your domain from CloudFlare, the name server would be karl.ns.cloudflare.com and roxy.ns.cloudflare.com.

How did CloudFlare get 1.1.1.1?

The story of how Cloudflare obtained the 1.1.1.1 IP address is not a story of a standard purchase, but rather a unique research partnership.

1. The Original Owner: APNIC

The IP address 1.1.1.1 (and the 1.0.0.0/8 block) was originally assigned to APNIC (the Asia-Pacific Network Information Centre), which is the regional registry responsible for IP addresses in the Asia-Pacific region.

2. The Problem: "Garbage" Traffic

For years, 1.1.1.1 was a "useless" IP address because it was a magnet for massive amounts of junk traffic.

Many network engineers used 1.1.1.1 as a "dummy" or "placeholder" address in their configurations.
Many hardware manufacturers (like home routers) hardcoded 1.1.1.1 as a test IP to check for internet connectivity.
People often typed "1.1.1.1" just to see if their browser was working.

Because of this, 1.1.1.1 was being hit by a constant, massive DDoS-level flood of random traffic. APNIC didn't have the network capacity to handle this flood, so they couldn't really use the address for anything practical.

3. The Deal: Infrastructure for Research

Cloudflare approached APNIC with a proposal. Cloudflare had one of the largest global networks in the world, designed specifically to handle massive amounts of traffic and DDoS attacks.

The Partnership Agreement:

APNIC provided the IP addresses (1.1.1.1 and 1.0.0.1).
Cloudflare provided the infrastructure to host them.
The Research Goal: APNIC wanted to study the "junk traffic" hitting the IPs to understand how the internet is misconfigured. Cloudflare would handle the load, scrub the bad traffic, and share the data with APNIC researchers.

4. The Launch: April 1, 2018

Cloudflare launched its public DNS resolver on April 1st, 2018 (4/1). They chose this date specifically because it was "4 ones" (1.1.1.1).

While many thought it was an April Fool's joke, it was a real product. By using their "Anycast" network, Cloudflare could route 1.1.1.1 traffic to whichever data center was closest to the user, making it one of the fastest DNS resolvers in the world.

5. Why Cloudflare?

Cloudflare's primary pitch was Privacy. At the time, many people were concerned that ISPs (Internet Service Providers) were selling their browsing history (tracked via DNS queries). Cloudflare promised to never sell user data and to wipe all logs within 24 hours—a promise they backed up by hiring auditors like KPMG.