DNS is the address book that turns your domain name into the actual servers behind it — website, email, all of it. It’s also where a well-meaning Tuesday-afternoon edit can take a site offline for a day, because DNS changes don’t land instantly and there’s no undo button that beats the clock. This lesson is for anyone who’s about to change hosts, set up email, or just wants to stop treating that DNS panel like a fuse box in the dark. You’ll need a login for wherever your domain is managed and a terminal.

Find where your DNS actually lives

The company you bought the domain from and the company answering DNS queries for it are often two different companies. Find both:

whois yourdomain.com | grep -i "registrar:"
dig NS yourdomain.com +short

The first line is your registrar. The second lists your nameservers — that’s where your records live and where you’ll make edits. If the nameservers say Cloudflare or your host, editing records at the registrar does nothing. This one mismatch explains half the “I changed it and nothing happened” calls we get.

Look up your current records

Before touching anything, see what’s there today:

dig yourdomain.com A +short
dig www.yourdomain.com +short
dig yourdomain.com MX +short
dig yourdomain.com TXT +short

That’s your website’s address, the www variant, where your email goes, and the miscellaneous proof-of-ownership records, in that order.

Learn the five record types you’ll actually touch

A — points a name at an IPv4 address. Your website, usually. (AAAA is the same thing for IPv6.)
CNAME — points a name at another name, like www at your root domain. Follows wherever the target goes.
MX — where your email gets delivered. Break this and mail bounces, so treat it gently.
TXT — free-form text for proving things: domain verification, SPF, DKIM. Adding one is the safest change in DNS.
NS — which servers answer for the whole domain. The big lever; don’t pull it casually.

Every record carries a TTL — how many seconds the rest of the internet may cache the answer before asking again. That number is why changes take time to land.

Lower the TTL before any change

If your record’s TTL is 86400 (a day), some visitors will see the old value for up to a day after you change it. So the day before a real change, lower the TTL on the records you’ll touch to 300 seconds, then wait for the old TTL to run out. After that, your actual change lands in about five minutes everywhere. When you’re done, put the TTL back up — it’s a portage: carry the low TTL just long enough to cross, then get back on the water.

Make a harmless change and watch it propagate

Practice on something that can’t hurt you. Add a TXT record — name _practice, value "hello from me" — then watch it arrive at two big public resolvers:

dig _practice.yourdomain.com TXT +short @8.8.8.8
dig _practice.yourdomain.com TXT +short @1.1.1.1

A site like whatsmydns.net shows the same thing from servers around the world. When both resolvers return your text, you’ve seen the whole lifecycle: edit, wait a TTL, confirmed everywhere. Delete the practice record after.

Keep a copy of the zone before and after

Most DNS panels have an export button; use it before and after every change, and keep the files somewhere safe (a note in your repo is fine — same instinct as a backup that actually restores). No export button? Screenshot the record list. You’ve verified this lesson when your practice record showed up from both public resolvers and you’re holding a dated copy of your zone — that copy is your undo button, and knowing what you own starts here.