CNAME Lookup shows which hostname a name is an alias for. A CNAME does not point at an address; it points at another name, and the resolver then has to look that name up in turn. This is how most hosted services are wired: your www subdomain becomes a CNAME to a provider hostname, and the provider can change the underlying IP addresses freely without you touching your DNS. The rule that catches people out is that a name with a CNAME cannot hold any other record. If www.example.com is a CNAME, it cannot also have an MX or TXT record, because the CNAME replaces the entire name rather than sitting beside other records. This is also why the root of a domain usually cannot be a CNAME: the apex must carry SOA and NS records, so a CNAME there would conflict. Providers solve it with ALIAS or ANAME records that behave the same way but resolve server-side and answer as an A Record Lookup record.
DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.