nlnetlabs.nl No paid content found

DNS (Domain Name System) is the internet's naming layer: it translates human-readable domain names like google.com into the IP addresses machines use to route traffic, such as 188.114.96.3 (IPv4) or 2a06:98c1:3120::3 (IPv6). You rely on it every time you open a site, send email, or connect an app to a server. Understanding it also matters if you do troubleshooting or online investigation, because DNS records and lookup tools expose who hosts a domain, where its mail goes, and how it relates to other infrastructure.

The core problem DNS solves

Computers route packets by numeric address, not by name. Humans remember names. DNS is the distributed database that maps one to the other, and it does so at internet scale without a single central server holding every record.

How a DNS lookup works

When you type a domain into a browser, resolution typically follows this path:

1. Local cache / hosts file — The browser and operating system first check whether they already know the answer from a recent lookup.
2. Recursive resolver — If not cached, your device asks a resolver (often run by your ISP or a public provider). The resolver does the legwork on your behalf.
3. Root servers — The resolver asks a root server, which points it toward the correct top-level domain (TLD), such as .com.
4. TLD servers — The TLD server points to the authoritative name servers for that specific domain.
5. Authoritative name servers — These hold the domain's actual records and return the answer.
6. Response and caching — The resolver returns the IP to your browser and caches it for a period set by the record's TTL (time to live), so future lookups are faster.

Each step is a query-and-referral chain. The resolver does the recursion; the authoritative servers give final answers.

Common DNS record types

These records are the raw material for both troubleshooting and investigation.

Why DNS matters for troubleshooting and investigation

Because DNS records are public and queryable, they reveal relationships between domains, IPs, and providers. Tools built for this purpose let you:

• Run DNS lookups to confirm what a domain currently resolves to.
• Reverse IP to see which other domains share an IP address — useful for spotting shared hosting or linked infrastructure.
• Reverse NS / Reverse MX to find domains using the same name servers or mail servers.
• WHOIS lookups to check registration details.
• Review historical data to see how records changed over time.

This is the approach behind platforms like DNSlytics, which describes itself as an online investigation tool for finding information about domains, IP addresses, and providers, and for discovering relations and historical data between them. It reports coverage of 330+ million active domains, 60+ million mail servers, 7+ million name servers, and 1+ billion PTR records, with IP/DNS data refreshed every 14 days and 10+ years of historical data. Those figures indicate the scale at which DNS data supports fraud prevention, brand protection, and digital investigation.

Practical implications: caching, propagation, and security

• Caching and TTL — Resolvers and devices cache answers. A record change won't be seen everywhere until caches expire, which is why updates appear to "propagate" gradually rather than instantly.
• Propagation delays — The TTL value controls how long stale answers persist. Short TTLs mean faster updates but more queries.
• DNS security basics — Because DNS is central to connectivity, it is also a target. Be aware that DNS responses can be spoofed or intercepted, and that TXT records often carry email authentication policy (such as SPF) that affects whether mail is trusted.

When to use a DNS investigation tool

Reach for DNS lookups and related tools when you need to:

• Verify where a domain actually points before trusting it.
• Trace shared infrastructure between suspicious domains.
• Check mail routing and email policy records.
• Compare current records against historical ones to spot changes.

For routine browsing, DNS works invisibly. For troubleshooting and investigation, its records are the evidence — and tools that aggregate lookups, reverse queries, and history turn that evidence into something you can act on.

A domain name is the human-readable label that identifies a website or online service, such as google.com. It maps to a numeric IP address through DNS, and you can look up its registration and hosting details using WHOIS, DNS, and reverse lookups. This works for any registered domain, though privacy protection or missing records can limit what you see.

Domain, Hostname, and URL: What's the Difference?

These three terms are often used interchangeably, but they describe different layers of the same system.

The domain is the root you register. Hostnames are subdomains you or your provider create under it. A URL is what you type into a browser, combining all of the above with a protocol like https.

How a Domain Maps to an IP Address

DNS (the Domain Name System) translates a domain into an IP address so computers can find each other. The process works in layers:

1. A record — maps a hostname to an IPv4 address (for example, example.com → 93.184.216.34).
2. AAAA record — maps a hostname to an IPv6 address.
3. NS record — lists the name servers authoritative for the domain.
4. MX record — lists the mail servers that handle email for the domain.

When you run a DNS lookup, you query these records. The result tells you where the domain points and which infrastructure serves it.

Running a WHOIS Lookup

WHOIS returns registration data for a domain: the registrar, creation and expiry dates, name servers, and sometimes the registrant's contact details.

Steps:

1. Open a WHOIS lookup tool (DNSlytics offers one under its Domain Tools).
2. Enter the domain name, such as verizon.com.
3. Submit the query and read the result.

What you'll typically see:

• Registrar name and IANA ID
• Registration, update, and expiration dates
• Name servers
• Registrant organization (if not privacy-protected)

Common failure: Many domains use WHOIS privacy protection, which replaces the registrant's personal details with the registrar's or a proxy service. You'll still see dates and name servers, but not the owner's identity.

Using Reverse Lookups to Find Related Domains

Reverse lookups work backward from an IP, name server, or other attribute to find connected domains. This is useful for investigations, fraud prevention, and brand protection.

• Reverse IP — enter an IP address to see which domains are hosted on it. Shared hosting means one IP can serve hundreds of sites.
• Reverse NS — enter a name server to find all domains using it. This can reveal a common operator across many sites.
• Reverse MX — enter a mail server to find domains sharing the same email infrastructure.
• Reverse PTR — map an IP back to its associated hostname.

DNSlytics reports over 330 million active domains, 7 million name servers, and 1 billion PTR records, with IP and DNS data refreshed every 14 days. That scale is what makes reverse lookups useful: a single IP or name server can connect you to a cluster of related domains.

What You Can and Can't Determine

DNSlytics keeps over 10 years of historical data and 20+ billion historical events, so you can sometimes see how a domain's hosting or name servers changed over time. That history is often more revealing than a single snapshot.

Common Lookup Failures and How to Handle Them

• Privacy-protected WHOIS — you'll see the registrar's proxy details instead of the owner. Cross-reference with reverse IP or reverse NS to find patterns.
• Missing records — a domain may have no MX record if it doesn't handle email, or no A record if it's parked. Absence of a record is itself information.
• Stale data — DNS changes propagate at different speeds. If a result looks wrong, check the record's TTL and re-query later.
• Shared infrastructure — a reverse IP result showing hundreds of domains doesn't mean they share an owner. Shared hosting is common.

Putting It Together

To investigate a domain, start with WHOIS for registration facts, then run DNS lookups for A, NS, and MX records to see where it points. Use reverse IP and reverse NS lookups to find related domains and hosting patterns. Treat privacy protection and shared hosting as limits on certainty, not dead ends — the relationships between domains often tell you more than any single record.

Open source means the software's source code is publicly available, so anyone can inspect, modify, and redistribute it. Zen Cart, the platform running this reptile supply store, is open-source e-commerce software: the store owner can read and change the code, and no license fee is paid to a vendor. That matters to a small shop because it removes per-sale or monthly software fees and allows deep customization — but it also means the owner (or a developer they hire) handles hosting, updates, and security. Note that "open source" here describes the store software, not the reptile foods and supplements sold on it.

Open source in plain terms

Proprietary store platforms typically charge a subscription or a percentage of sales and keep their code closed. Open-source platforms publish the code under a license that permits use and modification. In practice, for a store like this one:

• No license fee. You pay for hosting and your own time, not for permission to run the software.
• Full access to the code. Layouts, checkout flow, and product pages can be changed beyond what a theme editor allows.
• Community development. Fixes and add-ons come from contributors and other store owners, not only from one company.

What it looks like on this store

The page evidence shows a typical Zen Cart storefront: category navigation (Bee Pollen, Cat Grass, Chia Seeds, Dandelion, Sprouting Seeds, Supplements), an "All Products" listing, reviews, and an information block with About Us, Shipping & Returns, Privacy Notice, Conditions of Use, Order Status, Site Map, Gift Certificate FAQ, and Discount Coupons. That structure — categories, reviews, coupons, gift certificates, order status — is what the platform provides out of the box. The store also publishes care guides (Russian Tortoise Care, Box Turtle Care, Redfoot Tortoise Care) and growing instructions, which are content pages the owner added rather than built-in store features.

Benefits for a small pet supply shop

• Cost control. No platform subscription means a low fixed cost that doesn't scale with order volume.
• Custom catalog logic. A shop selling seeds, dried weeds, and supplements by weight can adjust product options, units, and shipping rules directly in the code.
• Content and commerce in one place. Care guides and growing instructions sit alongside the catalog, which supports the store's stated role of helping customers find foods for herbivore reptiles.
• No vendor lock-in on data. You can export and migrate your catalog if you decide to move.

Trade-offs to plan for

Deciding whether it fits your store

Choose an open-source cart like Zen Cart if you want no license fees, need code-level customization, and have either technical skills or a developer you can call. Choose a hosted subscription platform instead if you'd rather not manage hosting, patches, and upgrades, and you're comfortable paying monthly for that convenience. A middle path works for many small shops: run the open-source cart on managed hosting that handles server updates, and keep a developer on retainer for store-level changes.

If you're evaluating this specific store as a model, the useful signal is that a niche reptile supply shop can run a full catalog, reviews, coupons, and care content on open-source software without a platform fee — the cost shifts from subscriptions to maintenance.

DNSSEC (Domain Name System Security Extensions) is a set of DNS protocol extensions that cryptographically sign DNS data so a resolver can verify that an answer is authentic and unmodified. It protects integrity and authenticity, not confidentiality: queries and answers still travel in cleartext unless a separate protocol such as DoT or DoH encrypts the transport. You need DNSSEC if you want to prevent forged or tampered DNS answers from being accepted; you do not need it to hide which names are being queried.

What DNSSEC actually guarantees

A validating resolver checks two things about a signed answer:

• Authenticity — the answer came from the zone that is authoritative for the name.
• Integrity — the answer was not altered in transit or in a cache.

It does not provide:

• Encryption of queries or responses.
• Hiding of domain names (the query name is still visible on the wire).
• Protection against a compromised authoritative server that signs bad data with its own valid key.

The chain of trust

DNSSEC works as a hierarchy of signatures anchored at the DNS root.

1. The root zone is signed, and its public key (the trust anchor) is distributed with validating software.
2. Each signed child zone publishes a DS record in its parent, which commits to the child's key.
3. The child zone publishes its public key as a DNSKEY and signs its records with the matching private key.
4. A validator walks from the root down, verifying each DS/DNSKEY link, until it can validate the answer for the name it was asked about.

If any link is missing or invalid, the validator treats the data as bogus and returns a failure (typically SERVFAIL) rather than accepting it.

Signing vs. validation: two separate jobs

DNSSEC requires action on both sides, and they are independent.

A zone can be signed without your resolver validating, and a resolver can validate without the zones you query being signed. For end-to-end protection, both must be in place.

Common failure modes

• Expired signatures — RRSIG records have validity windows; if re-signing fails, validating resolvers reject the zone.
• Broken delegation — a DS record at the parent that does not match the child's DNSKEY makes the whole subtree bogus.
• Missing DS — a signed child with no DS at the parent is treated as unsigned, so validation silently does not apply.
• Clock skew — validators with wrong time may reject valid signatures.
• Algorithm mismatch — parent DS and child DNSKEY must use compatible algorithms.

Diagnosis usually starts by querying with a validating resolver and checking whether the response is secure, insecure, or bogus, then inspecting DS, DNSKEY, and RRSIG records along the delegation path.

Tooling and implementations

DNSSEC is implemented across many open-source and commercial systems. NLnet Labs, a nonprofit foundation focused on DNS and routing, maintains several relevant components:

• Cascade — described as a purpose-built DNSSEC signing solution.
• NSD — a fast, robust authoritative DNS nameserver.
• Unbound — a lean, versatile recursive DNS resolver (validation happens on the resolver side).
• Krill — RPKI Certificate Authority software (routing security, not DNSSEC).
• Routinator — RPKI Relying Party software.

For a zone owner, the practical path is: choose a signer (such as Cascade or another DNSSEC-capable authoritative server), publish the DS record at your registrar or parent zone, and confirm that a public validating resolver returns validated answers. For a resolver operator, enable validation in software such as Unbound and verify the root trust anchor is current.

Deciding whether to enable it

Enable DNSSEC if you want to reduce the risk of cache poisoning and forged answers reaching your users, and you can commit to key management and timely re-signing. Skip it only if you have a specific reason — for example, an internal-only zone where validation is not enforced end to end — and understand that unsigned zones gain no integrity protection.

A name server is a server that answers DNS queries — it translates domain names into the records (IP addresses, mail targets, and so on) that other systems need. There are two roles to keep separate: authoritative name servers hold the definitive records for a zone and answer queries about it, while recursive resolvers do the legwork of looking those records up on a client's behalf. You point a domain at authoritative name servers via NS records at your registrar; you (or your ISP) point clients at recursive resolvers. If you only remember one thing: the NS records in your registrar's panel decide who is authoritative for your domain, and nothing else will resolve correctly until those are right.

The two kinds of name server

NLnet Labs, a nonprofit foundation focused on DNS and routing, maintains examples of both: NSD, described as a "fast and robust authoritative DNS nameserver," and Unbound, a "lean and versatile recursive DNS resolver." Both are open source, so you can run either yourself or rely on a hosting provider that does.

How a lookup actually flows

1. A client asks its configured recursive resolver for www.example.com.
2. If the resolver has no cached answer, it asks the root servers.
3. The root refers it to the TLD servers for .com.
4. The TLD servers return the NS records for example.com — the delegation.
5. The resolver queries one of those authoritative name servers directly.
6. The authoritative server returns the record (for example, an A record), and the resolver caches it and hands it back to the client.

The NS records are the handoff points. They don't contain the website's IP address; they name the servers that do.

Pointing a domain at name servers

At your registrar (or DNS provider), you set the name servers for the domain, usually as a pair or set for redundancy:

• ns1.yourprovider.net
• ns2.yourprovider.net

Two conditions must both hold:

• The registrar's NS records must list the servers you intend to use.
• Those servers must actually be configured to serve your zone.

If only one is true, resolution breaks. A common mistake is changing the registrar's NS records to a new provider before the zone exists on the new provider's servers — the result is a domain that stops resolving entirely.

Checking name servers and verifying they respond

Look up the delegation:

dig NS example.com +short

Expected output is a list of hostnames, e.g. ns1.example.com. and ns2.example.com.. To confirm a specific server is authoritative and answering:

dig @ns1.example.com example.com SOA +short

A returned SOA record means that server is serving the zone. A timeout or REFUSED means it is not — check the server's configuration or whether you queried the right hostname.

To see the full path a resolver takes, including delegation:

dig +trace example.com

Common failure symptoms

• NXDOMAIN — the name does not exist. Often a typo, or a record missing from the zone on the authoritative server.
• SERVFAIL — the resolver could not get a usable answer. Frequently caused by broken delegation, an unreachable authoritative server, or DNSSEC validation failing.
• Timeout / no response — the authoritative server is down, firewalled, or not listening on port 53.
• Stale answers after a change — the old record is still cached. This is the "propagation delay" people refer to; it is really cache expiry, bounded by the record's TTL.
• Works for some people, not others — usually inconsistent NS records across the parent zone, or one of several authoritative servers misconfigured.

Choosing between running your own and using a host

• Run your own authoritative server (for example, NSD) if you need full control over zone data, want to avoid a third party in the resolution path, or are operating infrastructure where you already manage DNS.
• Use a DNS hosting provider if you want managed redundancy and don't want to operate servers — you still set NS records at your registrar, but the provider runs the authoritative side.
• Run your own recursive resolver (for example, Unbound) if you want to control caching, filtering, or privacy for a network you manage. Most end users should simply use the resolver their OS or network provides.

The deciding factor is operational responsibility: authoritative servers are part of your domain's availability, so whoever runs them owns a piece of your uptime.