SOA Record Lookup returns the Start of Authority record, the single record that defines the administrative parameters of a DNS zone. Every zone has exactly one. It names the primary nameserver, gives an admin email address written with a dot instead of an at sign, and carries a serial number plus a set of timers. The serial number is the practical part: secondary nameservers compare it against their own copy and only transfer the zone when it has increased, so a serial that fails to advance after an edit is a reliable sign that changes are not propagating to secondaries. The timers control that replication, setting how often secondaries check for updates, how long they retry after a failure, and when they stop answering entirely if the primary stays unreachable. The last value, minimum TTL, no longer means what its name suggests; it now controls negative caching, meaning how long resolvers remember that a name does not exist. A high value there is why a newly created subdomain can keep returning NXDOMAIN for a while after you add it.
DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.