DNS
Computer Networks · 10 interview questions
DNS translates names into addresses through a hierarchy: root servers, top-level domain servers, and the authoritative servers for a domain. Your machine asks a resolver, which walks that hierarchy on your behalf.
The distinction worth knowing is recursive versus iterative. Your query to the resolver is recursive — you want the final answer, not directions. The resolver's queries outward are iterative: each server returns either the answer or a referral to the next level down.
Caching is what makes this work at internet scale, and TTL is what controls it. A long TTL reduces load and latency; a short one lets you change records quickly. Lowering TTL well before a planned migration is standard practice, precisely because the old value is cached everywhere until it expires.
DNS interview questions
- What's the difference between a recursive and an iterative DNS query?
- Recursive means 'get me the final answer' — the resolver does the work. Iterative means each server replies with either the answer or a referral to the next server, and the asker follows the chain itself.
- Walk through resolving www.example.com from an empty cache.
- The resolver asks a root server, which refers it to the .com TLD servers; those refer it to example.com's authoritative servers; those return the A record. The resolver caches each step and returns the address.
- What do A, AAAA, CNAME, MX, TXT and NS records do?
- A maps a name to an IPv4 address, AAAA to IPv6, CNAME aliases one name to another, MX names mail servers, TXT holds arbitrary text used for verification and SPF, NS delegates a zone to nameservers.
- What does TTL control, and why lower it before a migration?
- How long resolvers may cache a record. Since a change isn't visible until cached copies expire, lowering TTL a day or two ahead means the switch propagates in minutes rather than hours.
- Why they ask: A practical question — anyone who has actually moved a domain knows this.
- Why can't you normally put a CNAME at the domain apex?
- Because a CNAME must be the only record for a name, and the apex must also carry NS and usually MX records. Providers work around it with ALIAS or ANAME records that resolve server-side.
- Why does DNS mostly use UDP?
- A query and reply usually fit in one small exchange, so a TCP handshake would triple the latency for no benefit. TCP is used when a response is too large or for zone transfers.
- Where is DNS cached?
- In the browser, the operating system's stub resolver, the recursive resolver at your ISP or provider, and sometimes an intermediate forwarder. A stale answer can be held at any of them.
- What is DNS round robin, and why is it weak load balancing?
- Returning several A records and rotating their order. It's crude because caching means clients don't rotate as expected, and it has no health checking — a dead server keeps receiving traffic until the record changes.
- What does DNSSEC protect against?
- Forged responses. It signs records so a resolver can verify authenticity via a chain of trust from the root. It provides authentication and integrity, not confidentiality — queries remain visible unless DoH or DoT is used.
- Is 'DNS propagation' an accurate term?
- Not really. Nothing is pushed anywhere — authoritative records change instantly, and the delay is purely cached copies elsewhere expiring according to their TTL. The phrase describes waiting for caches, not propagation.
You'll forget most of this by next week
That's not a discipline problem, it's how memory works. In the app these come back on an expanding schedule — right before you'd lose them.
Start free for 7 days