Type a name into a browser and several things happen before a page appears. Name resolution is one of them. It helps the client find an address to try; it does not establish the connection or verify the website's certificate.

First, identify the kind of answer

An A record contains an IPv4 address. An AAAA record contains an IPv6 address. A CNAME points to another name, which may require more lookups before an address is available.

These are not interchangeable. A machine can have a working IPv4 path and a broken IPv6 path. Seeing the expected A record does not tell you what will happen if the application chooses an address from AAAA.

On a machine using systemd-resolved, a useful place to begin is:

resolvectl query example.com
resolvectl status

The first command asks for a result. The second helps explain the resolver configuration behind it. Read the resolvectl manual for the options supported by your version.

A cache has a memory

DNS answers usually come with a time to live, or TTL. Resolvers may reuse a cached answer during its lifetime instead of immediately asking the authoritative server again. Applications can also maintain their own caches.

That is why changing a record does not make every client see the change at once. TTL is not a universal countdown shared by every device. Different caches can have learned the old answer at different times, and negative answers can be cached too.

Ask the next question separately

Once the address looks right, move on to connection and application checks. A name can resolve correctly while a service is stopped, a port is blocked, a route is unavailable or a certificate is wrong.

The reverse is also worth remembering: a failed lookup does not by itself prove that the destination server is down. It may be a problem with the resolver, delegation or the record you asked for.

  • Which name and record type did I query? Be precise about IPv4 and IPv6.
  • Which resolver supplied the answer? A local cache and an authoritative server are different observations.
  • Does the next layer work? Test the connection and HTTPS separately.
Next: read the response before the page. Or return to all field notes.