DNS troubleshooting and security boundaries

Diagnose the boundary, not the symptom

“The website does not open” is not a DNS diagnosis. Record the queried name, type, resolver, result, cache state and the later connection attempt.

Observation	What it narrows	What to test next
Address works; name does not	Name resolution is a strong suspect	Query the configured resolver and inspect the exact response
One resolver answers; another does not	Resolver path, cache or policy differs	Compare status, authority and timing; do not assume one is correct
DNS answers; application fails	DNS may be complete	Test route, port, TLS and application separately
Old value remains	Some cache may still be valid	Identify local versus recursive cache and remaining TTL
Timeout	No usable response arrived in time	Check interface, route, resolver reachability, firewall and capture evidence

Clearing a cache is a controlled experiment only when you name which cache and what result would confirm the hypothesis. Repeated flushing without observation destroys useful state.

Security concepts, with precise limits

Spoofing means presenting forged information as if it came from another source. Cache poisoning aims to place incorrect DNS data in a cache so later clients reuse it.

DNSSEC adds origin authentication and integrity protection for signed DNS data through a chain of trust. It does not encrypt the queried name and does not make the destination application safe.

DNS over HTTPS (DoH) carries DNS queries and responses over HTTPS. It protects that transport path from straightforward observation or modification by intermediaries, but the chosen resolver still processes the query and endpoint policy still matters.

DNS tunneling is a technique that encodes non-DNS data into DNS queries or responses to create a communication channel. The concept is relevant to defense and authorized testing; this beginner lesson does not provide operational evasion instructions.

A safe mini-challenge

In DNS Command Lab:

1. Resolve example.test as type A.
2. Identify the resolver, returned address, record type and TTL.
3. Query type AAAA and explain what changed.
4. Inspect the virtual client cache.
5. Clear it and prove the cache changed without claiming the authoritative data changed.

Next stepReturn to the DNS hub

Connect the concepts, commands, lab, visuals, practice and sources.