What is DNS, and why does it break things?
DNS is the address book of the internet. Most "my website is down" emergencies are actually DNS.
DNS — the Domain Name System — turns a name people can remember into an address computers can route to. When someone types your domain, their computer asks a chain of servers "where does this live?" and gets back an IP address.
It is conceptually simple and causes an outsized share of website emergencies, because it is the one part of your setup with a built-in delay between making a change and seeing the result.
The records that matter
| Record | What it does | Typical use |
|---|---|---|
| A | Points a name at an IPv4 address | example.com → 93.184.216.34 |
| AAAA | Points a name at an IPv6 address | The same job, modern addressing |
| CNAME | Points a name at another name | www → example.com |
| MX | Where email for the domain goes | Google Workspace, Microsoft 365 |
| TXT | Arbitrary text | SPF, DKIM, domain verification |
| NS | Which nameservers are authoritative | Your DNS host |
Two rules that prevent most self-inflicted outages:
- A CNAME cannot coexist with other records on the same name. This is why you generally cannot CNAME your root domain.
- MX records are completely independent of A records. Moving your website does not move your email, and this catches people out constantly. If you change hosts and copy the A record but not the MX record, mail keeps flowing to the old provider — or stops.
Why changes take time
Every DNS record has a TTL (time to live), in seconds. That is how long resolvers are allowed to cache the answer before asking again.
If your A record has a TTL of 86400 (24 hours), a resolver that looked it up an hour ago will keep serving the old answer for another 23 hours. Nothing is broken; you are just waiting for caches to expire.
This is why the standard migration advice is to lower your TTL to 300 seconds a day before you make a change. Then the switch propagates in five minutes instead of a day. Put it back afterwards.
"Propagation" is a slightly misleading word — nothing spreads outward. Caches simply expire at different times in different places, which is why a site can look updated to you and stale to a colleague.
The failures you will actually hit
Website moved, email died. You updated A records and left MX pointing at the old host, which has now closed the account. Always record your MX and TXT records before a migration.
SPF broken after a change. You added a new sending service and created a second SPF TXT record. A domain may only have one SPF record; two means neither is trusted. Merge them into one.
www works but the root does not, or vice versa. You have an A record for one and nothing for the other. You need both, or a redirect.
Changed nameservers and everything vanished. Nameservers are authoritative for all records. Point your domain at a new DNS provider and every record has to exist there first, or they simply cease to exist.
That last one is the big one. Changing nameservers is not like changing one record — it is changing the entire address book at once. Recreate every record at the new provider before you switch. See what are nameservers for the detail.
How to check what is actually live
Your control panel shows what you configured. That is not always what the world sees — especially mid-change, or if the domain's nameservers point somewhere you forgot about.
Use the DNS lookup tool to query records as they currently resolve, and Who Hosts This Site? to see the nameservers, mail provider and hosting a domain is actually using right now.
If those disagree with your control panel, your domain's nameservers are pointing at a different DNS provider than the one you are editing. That is the answer to a surprising number of "I changed it and nothing happened" problems.
A safe way to make DNS changes
- Record every current record first — screenshot or export
- Lower TTLs to 300 a day ahead
- Make one change at a time
- Verify with an external lookup, not just your panel
- Leave the old service running until you have confirmed the new one works
- Restore TTLs when you are done
DNS rewards patience and punishes assumption. Almost every DNS disaster is someone changing several things at once and then being unable to work out which one broke it.