DNS guides and resources
Practical guides for DNS records, security, anycast, automation, and troubleshooting. Build your own integrations with our TypeScript, Python, and Go SDKs.
Featured resources
Start with the guides that cover the most common DNS operations and migration decisions.
Featured resourceHow to Fix Slow DNS LookupDiagnose and fix slow DNS lookups by checking browser cache, OS DNS cache, router settings, recursive resolvers, VPN adapters, and authoritative DNS.Read guide
Featured resourceDNS Record Types ExplainedCompare DNS record types with examples. Learn when to use A, AAAA, CNAME, MX, TXT, NS, CAA, SRV, SOA, PTR, HTTPS, SVCB, ALIAS, and more.Read guideFeatured resourceWhat is Anycast DNS? A Plain-Language GuideAnycast DNS explained from the ground up — what it is, why it matters, and how BGP routing makes one IP reachable from many places.Read guideFeatured resourceDNS Security Best Practices — Protecting Your DomainLearn 10 actionable DNS security best practices including DNSSEC deployment, CAA records, email authentication, registrar locks, rate limiting, and DNS monitoring.Read guideFeatured resourceManaging DNS with TerraformManage DNS zones, records, and DNSSEC as code with the DNScale Terraform provider. Install the provider, create records, use CI/CD, and avoid DNS downtime.Read guide
DNS Fundamentals
Start with the core concepts behind zones, TTLs, delegation, and resolution.
8 guides
FundamentalsFQDN Explained - Fully Qualified Domain Names in DNSWhat an FQDN is, how it differs from a hostname or relative DNS name, why the trailing dot matters, and how FQDNs behave in zone files, terminals, and Kubernetes.Read guideFundamentalsDNS Cache ExplainedLearn what a DNS cache is, where DNS answers are cached, how TTL controls cache expiry, and how to troubleshoot stale DNS results.Read guideFundamentalsDomain Registrar vs DNS HostingUnderstand the key differences between a domain registrar and DNS hosting. DNScale explains how each service works and why both are vital for managing your domain.Read guideFundamentalsTypes of DNS Servers ExplainedLearn about the different types of DNS servers, how they work, and why they are essential for the internet. DNScale explains recursive, root, TLD, and authoritative DNS servers.Read guide
Browse 4 more dns fundamentals guides
DNS Record Guides
Reference guides for the DNS record types you configure most often.
18 guides
RecordsDNS A Record Explained — What It Is and How to Use ItLearn what a DNS A record is, how it maps domain names to IPv4 addresses, and how to create, query, and troubleshoot A records with practical dig command examples.Read guideRecordsDNS AAAA Record Explained — IPv6 Address MappingLearn what a DNS AAAA record is, how it maps domain names to IPv6 addresses, and how to set up dual-stack DNS with practical dig command examples.Read guideRecordsDNS CNAME Record Explained — Aliases and Canonical NamesLearn how DNS CNAME records create domain aliases, when to use them over A records, and how to avoid common pitfalls like apex restrictions and CNAME chains.Read guideRecordsDNS MX Record Explained — Mail Exchange ConfigurationLearn how DNS MX records route email to mail servers, configure priority-based failover, and set up MX records for Google Workspace, Microsoft 365, and self-hosted mail.Read guide
Browse 14 more dns record guides guides
- DNS SRV Record Explained — Service Discovery via DNS
- DNS TXT Record Explained — Verification, SPF, and More
- DNS CAA Record Explained — Certificate Authority Authorization
- DNS NS Record Explained — Nameserver Delegation
- DNS PTR Record Explained — Reverse DNS Lookups
- DNS TLSA Record Explained — DANE Certificate Pinning
- CNAME vs A Record
- DNS Record Types Explained
- DNS Redirects and URL Forwarding
- What Is an ALIAS Record
- What Is an HTTPS Record
- What Is an SOA Record
- What Is an SSHFP Record
- What Is an SVCB Record
Troubleshooting
Diagnose cache, propagation, resolver, and connectivity problems.
11 guides
TroubleshootingDNSSEC Failure TroubleshootingDiagnose DNSSEC SERVFAIL outages caused by DS mismatches, expired signatures, unsigned answers, missing DNSKEY records, and unsafe DNSSEC disable steps.Read guideTroubleshootingCAA Debugging GuideFix certificate issuance failures caused by CAA records, wildcard policy, inherited CAA, wrong CA identifiers, CAA SERVFAIL, and DNSSEC validation errors.Read guideTroubleshootingNXDOMAIN Errors — What They Mean and How to Fix ThemLearn what NXDOMAIN means, why your DNS query returned 'name does not exist', and how to diagnose and fix common causes including typos, missing records, propagation lag, and DNSSEC validation failures.Read guideTroubleshootingSERVFAIL Errors — Causes and FixesLearn what SERVFAIL means, why DNS resolvers return it, and how to diagnose and fix the most common causes including DNSSEC validation failures, broken delegation, and authoritative server problems.Read guide
Browse 7 more troubleshooting guides
DNS Operations
Run DNS changes, migrations, monitoring, troubleshooting, and rollback with less risk.
9 guides
OperationsDNS OperationsA practical operating model for DNS changes, migrations, monitoring, troubleshooting, incident response, and rollback.Read guideOperationsDNS Change Review Checklist: Ship DNS Changes Without OutagesA practical DNS change review checklist for production records, TTL preparation, authoritative and recursive verification, rollback, monitoring, and PR reviews.Read guideOperationsVanity Nameservers and Glue Records ExplainedHow vanity nameservers work, when glue records are required, and the operational risks of branded NS hostnames like ns1.example.com.Read guideOperationsManaged DNS vs Self-Hosted DNS — Pros, Cons, and When to Choose EachCompare managed DNS services with self-hosted DNS servers. Understand the trade-offs in cost, complexity, security, and reliability to decide which approach fits your infrastructure.Read guide
Performance
Understand anycast, latency, routing, and global DNS delivery.
9 guides
PerformanceWhat is an Anycast DNS Network?Learn how anycast networking works, why it matters for DNS, and how it delivers low-latency, resilient name resolution worldwide.Read guidePerformanceAnycast DNS vs Unicast DNS — Which Is Better for Your Domain?Compare anycast and unicast DNS routing to understand which approach delivers better performance, resilience, and DDoS protection for your domain.Read guidePerformanceWhat is Anycast DNS? A Plain-Language GuideAnycast DNS explained from the ground up — what it is, why it matters, and how BGP routing makes one IP reachable from many places.Read guidePerformanceRound-Robin DNS ExplainedHow round-robin DNS works, when multiple A or AAAA records are useful, and why round-robin is not the same as health-checked DNS failover.Read guide
Browse 5 more performance guides
Security & Resilience
Protect domains from DNS attacks, spoofing, outages, and misconfiguration.
16 guides
SecurityWhat Is a DDoS Attack? Types, Impact, and DNS ProtectionLearn what DDoS attacks are, how volumetric, protocol, and application-layer attacks work, and how anycast DNS networks protect your infrastructure.Read guideSecurityWhat is DNSSEC? A Plain-Language Guide to DNS SecurityDNSSEC explained from first principles — what it is, why it exists, how it works at a high level, and when you should turn it on for your domain.Read guideSecurityDNS Amplification Attacks Explained — How They Work and How to Prevent ThemUnderstand how DNS amplification attacks exploit open resolvers and spoofed IPs to generate massive traffic floods, and learn the prevention techniques that stop them.Read guideSecurityHow DNSSEC Works — KSK, ZSK, DS, DNSKEY, RRSIG, NSEC ExplainedA walkthrough of the DNSSEC chain of trust: how KSK and ZSK signing keys, DS records, DNSKEY records, RRSIG signatures, and NSEC/NSEC3 work together to authenticate DNS answers.Read guide
Browse 12 more security & resilience guides
- DNS Security Best Practices — Protecting Your Domain
- DNSSEC Setup Guide for DNScale — Step-by-Step Walkthrough
- DNS Cache Poisoning Explained — How It Works and How to Prevent It
- DNS Tunneling Explained — How Attackers Abuse DNS and How to Detect It
- DNSSEC Key Management
- DNSSEC vs DNS over HTTPS (DoH)
- DNS over HTTPS (DoH) Explained — Encrypted DNS for Resolver-Client Privacy
- DNS over TLS (DoT) Explained — Encrypted DNS on Port 853
- DNS Hijacking - How Domains Get Taken Over and How to Prevent It
- DNS Firewall and RPZ Explained - Policy Control at the Resolver
- NIS2 and DNS — What Regulated EU Operators Need to Know
- DNS Attacks and Threats
Email & Certificates
Configure mail authentication, TLS certificates, CAA, DANE, and DNS-01 flows.
15 guides
Email & TLSSet up email DNS in DNScale: review and approve the Postscale recordsReview Postscale email DNS in DNScale: compatible SPF merges, preserved DMARC, unchanged application MX and explicit consent for personal receiving.Read guideEmail & TLSWhat Is an SSL Handshake? TLS Handshake ExplainedLearn what an SSL/TLS handshake is, how ClientHello, ServerHello, certificates, cipher suites, and session keys work, and how to debug handshake failures.Read guideEmail & TLSLet's Encrypt DNS-01 Challenges with DNScaleAutomate Let's Encrypt certificate issuance and renewal with DNS-01 challenges using DNScale. Works for wildcard certificates, edge-proxied origins, and servers with no public port 80.Read guideEmail & TLSlego DNS-01 with the DNScale DNS ProviderUse lego v5+ with DNScale to automate Let's Encrypt DNS-01 certificates, including wildcard certificates, Docker runs, systemd renewals, and external certificate use with Caddy or Traefik.Read guide
Browse 11 more email & certificates guides
- cert-manager DNS-01 with DNScale
- BIMI Record Guide — Brand Logos in Email Inboxes
- MTA-STS and TLS-RPT Guide - Enforce Encrypted Email Delivery
- Google Workspace DNS Setup
- Microsoft 365 DNS Setup
- SPF Record Explained - Syntax, Examples, and Common Mistakes
- DKIM Explained - DNS Keys, Selectors, and Email Signatures
- DMARC Explained - Policy, Alignment, and Reports
- Email Security with SPF, DKIM, and DMARC
- SSL and TLS Certificates Explained
- What Is an SSL Certificate Chain
DNS Automation
Automate DNS workflows with APIs, CI/CD, scoped keys, previews, and drift checks.
8 guides
AutomationDNS AutomationA practical guide to automating DNS changes with APIs, CI/CD, DNS as code, scoped keys, previews, drift detection, and rollback workflows.Read guideAutomationDNScale CLI quickstartInstall the DNScale CLI, configure a profile, and practice a two-value TXT record workflow in a disposable sandbox.Read guideAutomationDNS Drift Detection for Terraform, DNSControl, and Manual EditsDetect DNS drift across Terraform, DNSControl, manual dashboard edits, and API scripts with safe review, import, rollback, and CI patterns.Read guideAutomationGitLab CI DNS WorkflowsPractical GitLab CI patterns for DNSControl and Terraform DNS changes, including merge-request previews, protected deploys, scoped variables, and drift checks.Read guide
Browse 4 more dns automation guides
Infrastructure as Code
Automate DNS changes, migrations, and multi-provider operations.
4 guides
AutomationManaging DNS with TerraformManage DNS zones, records, and DNSSEC as code with the DNScale Terraform provider. Install the provider, create records, use CI/CD, and avoid DNS downtime.Read guideAutomationManaging DNS with DNSControlLearn how to manage your DNS zones and records as code using DNSControl with the DNScale provider. Define your entire DNS configuration in JavaScript.Read guideAutomationDNS for Cloud Infrastructure — Best Practices and ArchitectureLearn cloud DNS best practices including service discovery, multi-cloud strategies, automation with Terraform, and TTL optimization for dynamic infrastructure.Read guideAutomationMulti-Provider DNS with Terraform & DNSControlDeploy DNS zones across DNScale and Hetzner DNS for redundancy using Terraform or DNSControl.Read guide
SDKs
Build with the official TypeScript, Python, and Go clients: authentication, zones, records, pagination, and error handling.
3 guides
SDKsManage DNS with the Python SDKInstall the DNScale Python SDK, authenticate securely, and manage DNS zones and records with pagination, async examples, and structured error handling.Read guideSDKsManage DNS with the Go SDKInstall the DNScale Go SDK and manage DNS zones and records with typed requests, pagination iterators, context deadlines, and structured error handling.Read guideSDKsManage DNS with the TypeScript SDKUse the DNScale TypeScript SDK on Node.js to manage DNS zones and records, paginate results, set deadlines, and handle API errors with runnable examples.Read guide
Basics
Foundational internet, web, security, and computing concepts that support DNS operations.
8 guides
Basics127.0.0.1 and Localhost ExplainedWhat 127.0.0.1 and localhost mean, how loopback networking works, why localhost is not public DNS, and how to debug local resolver issues.Read guideBasicsARP Explained - How IP Addresses Reach Local DevicesWhat ARP does, how IPv4 devices map IP addresses to MAC addresses on a local network, and how ARP differs from DNS.Read guideBasicsWhat Is Cache? Browser, DNS, CDN, and Application Caching ExplainedLearn what cache means, why computers and networks cache data, how browser, DNS, CDN, application, database, and CPU caches work, and when to clear a cache.Read guideBasicsWhat is WHOIS? Domain Registration Data ExplainedLearn what WHOIS is, how it works, the impact of GDPR on domain privacy, and how RDAP is replacing WHOIS as the modern standard for registration data lookup.Read guide
DNScale Platform
Learn the product workflows behind zones, accounts, billing, and protected records.
12 guides
PlatformDNScale Infrastructure and EU OperationsDNScale's network footprint, AS numbers, peering posture, security posture, and EU operating model — the operational facts behind the platform.Read guidePlatformDNScale Vulnerability Disclosure PolicyHow to responsibly report security vulnerabilities to DNScale — scope, expected response times, safe-harbour provisions, and what gets published afterwards.Read guidePlatformDNS Delegation for DNScale RegionsHow to update nameserver delegation at your registrar for DNScale zones, including the nameserver sets for each region (EU, GLOBAL, EU_GLOBAL).Read guidePlatformHow to Add Business Billing Details and a Tax IDLearn how businesses and individuals can add or update their legal billing name, address, VAT or tax ID, and download DNScale invoices through Stripe.Read guide