🚀 Deployment & Ops · Chapter 1

DNS end to end — A records, CNAME, TTL

Your DNS change is correct and the site still shows the old page. Nothing is broken — something is remembering.

Study this lesson free in the app →

The basics

DNS (the Domain Name System) turns a name you can remember, like ai-teacher.in, into the IP address a computer actually connects to, like 76.76.21.21.

The problem it solves: machines move. Servers get replaced, hosts change, a laptop's address changes every time it rejoins wifi. If links pointed at raw numbers, every move would break every link. DNS gives you a name that stays put while the number behind it changes.

The mental model: a phone book with a memory. Your device asks a resolver "what's the number for this name?" The resolver asks the domain's authoritative nameservers, hands back the answer — and remembers it for as many seconds as the record's TTL allows. That memory is why a correct change can look wrong for a while: nothing is being pushed anywhere; caches are simply expiring at different times.

Explained

This app was reachable at 192.168.0.180. Then 192.168.0.134. Then 192.168.0.183.

Every time the laptop reconnected to wifi, the address moved and every saved link died. That is the problem DNS solves: a name that does not move, pointing at a number that does.

DNS is a phone book.

You type ai-teacher.in. Your computer has no idea what that means — it can only talk to numbers. So it asks a resolver, "what is the number for this name?" The resolver asks the domain's nameservers, gets an answer, hands it back, and remembers it for a while.

That last part — remembering — is where almost all the confusion lives.

The record types you will actually use

A — a name → an IPv4 address. ai-teacher.in → 76.76.21.21. The bottom of the chain; it points at a machine.

AAAA — the same thing for IPv6.

CNAME — a name → another name. www.ai-teacher.in → cname.vercel-dns.com. The resolver then has to look that up too. Useful when the target's IP might change and you want to let someone else manage it.

NS — who is authoritative for this domain. Change these and you hand the whole domain to a different provider.

MX — where email goes. Untouched by anything you do to your website — which is why moving nameservers can silently break email if you forget to bring the MX records with you.

TXT — arbitrary text, used for domain verification and email auth (SPF, DKIM).

ai-teacher.in is registered at GoDaddy and still uses GoDaddy nameservers, so the records live there:

| Type | Name | Value | | --- | --- | --- | | A | @ | 76.76.21.21 | | CNAME | www | cname.vercel-dns.com |

@ means the domain itself — the apex or root. Note that the apex gets an A record and www gets a CNAME: that split is not arbitrary, and the next lens explains why.

Why the apex cannot be a CNAME

The DNS spec says a CNAME cannot coexist with any other record on the same name.

Your apex almost always has other records — NS, SOA, usually MX for email. So a CNAME at the apex is illegal, and that is why hosts hand you a raw IP address like 76.76.21.21 for the root and a CNAME for www.

Some providers offer ALIAS or ANAME records, which fake a CNAME at the apex by resolving it server-side. They work, they are not standard, and they only exist at providers who built them.

13 August, 06:10. The A record for ai-teacher.in was changed to 76.76.21.21.

A minute later, curl https://ai-teacher.in returned a GoDaddy parking page.

The instinct is to assume the change failed and go change it again. That instinct is wrong, and re-editing records that were already correct is how people turn a five-minute wait into a two-hour outage.

The check that settles it is asking a resolver that has no reason to have cached anything:

dig +short ai-teacher.in A            # 76.223.105.230  ← my laptop, stale
dig +short ai-teacher.in A @8.8.8.8   # 76.76.21.21     ← Google, correct
dig +short ai-teacher.in A @1.1.1.1   # 76.76.21.21     ← Cloudflare, correct

Two independent resolvers agreed on the new value. The change was live; only the local cache was behind. Nothing needed fixing.

Reading a TTL

The number before IN A is the TTL — how many seconds a resolver is allowed to keep this answer before asking again.

;; ANSWER SECTION:
ai-teacher.in.    600    IN    A    13.248.243.5
                   ^
                   TTL: 600 seconds = 10 minutes

So the worst case for that record was ten minutes, and the honest answer to "why is it still wrong?" was "wait six more minutes."

Lower the TTL before you migrate, not after. Drop it to 300 a day ahead, make the change, then put it back. Once the old value is cached at a 24-hour TTL, nothing you do can un-cache it.

Editing records at the registrar when the nameservers point elsewhere. If NS says Cloudflare, the records in your GoDaddy panel are decorative. Check dig NS yourdomain first.

Forgetting the parking records. Adding the right A record while leaving the host's placeholder A records in place means DNS round-robins between your site and a parking page. Symptom: it works every other refresh.

Testing only on your own machine. Your laptop, your phone and your office router all cache independently. One of them being wrong tells you nothing.

Moving nameservers without copying MX. The website comes up and email silently stops. This is the expensive one.

Words to know

In two minutes

• DNS maps a stable name to an IP address that can change underneath it.
• Your device asks a resolver; the resolver asks the domain's authoritative nameservers and caches the answer for the TTL.
• A points a name at an IP; CNAME points a name at another name; MX routes email; NS says who is authoritative.
• The apex can't be a CNAME, because a CNAME can't share a name with NS, SOA or MX records.
• 'Propagation' is just caches expiring at different times — lower the TTL a day before a migration, not after.
• When a change looks wrong, ask a public resolver (dig @8.8.8.8) before you touch anything again.
• Once DNS is verified, any remaining staleness is a cache further up: browser, service worker, CDN.

Test yourself

There are 8 questions, 3 puzzles and 5 recall cards for this lesson in the app — the recall cards come back on later days, just before you would forget.