Practical DNS articles

Articles on running DNS in production, written for admins, DevOps teams and MSPs. Each one starts from a real problem and ends with commands you can run.

  1. Security & compliance

    DNS access control for an MSP: technicians, AI agents and customers

    Give technicians, customers and AI agents the least DNS access they need: roles, per-zone scope, API keys limited by zone and IP, and an audit trail.

    Intermediate 8 min read

  2. Security & compliance

    Who changed this DNS record? How to find out

    DNS keeps no history of changes. How to find who changed a DNS record, where Cloudflare and Route 53 log it, and what a DNS audit log should record.

    Intermediate 13 min read

  3. DNS operations

    Split-horizon DNS without running your own BIND

    Split-horizon DNS: one name, internal and external answers. BIND views, internal servers and cloud private zones compared, plus a managed option.

    Intermediate 8 min read

  4. DNS operations

    Do DNS resolvers respect your TTL? A week of real traffic

    We measured real resolver traffic: 92.8% of repeat queries waited for the TTL, long TTLs were cut short most. What it means for DNS changes.

    Intermediate 9 min read

  5. Migrations

    How to change DNS provider with DNSSEC enabled

    Changing nameservers with DNSSEC on can take your domain offline. The safe order: remove DS, wait, move, sign again. Commands for every step.

    Advanced 8 min read

  6. Security & compliance

    Subdomain takeover: find dangling DNS records before someone else does

    Subdomain takeover starts with a forgotten CNAME or delegation. How to find dangling DNS records, check them with a script and prevent takeovers.

    Intermediate 6 min read

  7. Migrations

    Migrating DNS from Cloudflare: export, fix, cut over

    Move DNS away from Cloudflare safely: export the zone, fix proxied records and apex CNAMEs, compare answers, then cut over. Includes DNSSEC and Registrar.

    Intermediate 7 min read

  8. Migrations

    Moving off Route 53: export your zone and switch nameservers

    Export a Route 53 hosted zone to BIND with the AWS CLI, translate alias records and routing policies, then switch nameservers safely.

    Intermediate 6 min read

  9. Security & compliance

    Is your DMARC actually being checked? What DNS lookups reveal

    Receivers can only check SPF, DKIM and DMARC by querying your DNS. How to verify your records and what DNS lookups reveal that reports do not.

    Intermediate 6 min read

  10. Security & compliance

    DNS hijacking starts with a login: how to protect your DNS account

    DNS hijacking usually starts with a login to your DNS or registrar account. What attackers do with one record, and a checklist to stop and spot it.

    Intermediate 6 min read