DNSFly

Free DNS toolkit for developers & sysadmins 🌍
Instant propagation check from 21 global servers
SSL, WHOIS, Domain Age & more. No ads.
👉

[DNSFly @dnsflynet]

Starting #100DaysOfDNS 🚀

One DNS tip every single day for the next 100 days.

Just real-world knowledge
that developers and sysadmins actually use.

Day 1 drops tomorrow.

If you work with domains, DNS, hosting, or email,
this series is for you.

Follow @dnsflynet

[DNSFly @dnsflynet]

Day 66/100 — #100DaysOfDNS 📍
EDNS Client Subnet: how CDNs know your location.

When you query DNS, your resolver sends a portion of your IP to the authoritative server.

This lets CDNs return the IP of the nearest edge server.

#DNS

[DNSFly @dnsflynet]

Day 65/100 — #100DaysOfDNS 😈
Subdomain takeover: the hidden DNS vulnerability.

You set up https://t.co/udu5NIeMfL pointing to a Heroku app. You delete the Heroku app but forget to delete the DNS record.

Now anyone can claim that Heroku hostname and control.

#DNS

[DNSFly @dnsflynet]

Day 64/100 — #100DaysOfDNS 🧹
DNS record cleanup:
Old DNS records accumulate like junk in a garage.

Risks of stale records:
→ Old A records pointing to decommissioned servers
→ Unused MX records causing email confusion
→ Old TXT records from services you cancelled

#DNS

[DNSFly @dnsflynet]

Day 63/100 — #100DaysOfDNS 🗺️
Anycast: how one IP address exists in 300 cities.

Cloudflare's 1.1.1.1 isn't one server. It's hundreds.

Anycast routing: the same IP address is announced from multiple locations. Your request goes to the nearest one.

#DNS

[DNSFly @dnsflynet]

Day 62/100 — #100DaysOfDNS ☠️
DNS cache poisoning:

An attacker feeds fake DNS records to a resolver's cache.

User types https://t.co/5sBJUTqhIW → poisoned resolver returns attacker's IP → user lands on a fake bank site.

Protection:
→ DNSSEC
→ DNS over HTTPS

#DNS

[DNSFly @dnsflynet]

Day 61/100 — #100DaysOfDNS 💥
What happens when DNS goes down globally.

October 2021: Facebook DNS went down for 6 hours. FB, Instagram, WhatsApp — all gone.

Result: DNS resolvers couldn't find Facebook's nameservers. No nameservers = no DNS = no website.

#DNS

[DNSFly @dnsflynet]

Day 60/100 — #100DaysOfDNS ⚖️
AWS Route 53 vs Cloudflare DNS

Use Cloudflare when: simple website, blog, SaaS app, startup.

Use Route 53 when: complex routing, AWS infrastructure, latency-based routing, health checks, failover.

#DNS

[DNSFly @dnsflynet]

Day 59/100 — #100DaysOfDNS 🛡️
Quad9 (9.9.9.9): DNS with built-in threat blocking.

Quad9 blocks known malicious domains at the DNS level.

You type https://t.co/N2A0TU3IMz → Quad9 says 'nope' → connection blocked.

No configuration needed. Just set DNS to 9.9.9.9.

#DNS

[DNSFly @dnsflynet]

Day 58/100 — #100DaysOfDNS 🔵
Google DNS : the reliable choice.

8.8.8.8 is the most widely used public DNS resolver in the world.

Pros:
→ High uptime and reliability
→ DNSSEC support
→ Predictable behavior

Cons:
→ Google collects data
→ Not always the fastest

#DNS

[DNSFly @dnsflynet]

Day 57/100 — #100DaysOfDNS ⚡
Cloudflare DNS : the fastest public resolver.

Independent tests consistently show 1.1.1.1 as the fastest public DNS resolver.

Why it's fast:
→ Anycast network in 300+ cities
→ No logging of IP addresses
→ DNSSEC validation built-in

#DNS

[DNSFly @dnsflynet]

Day 56/100 — #100DaysOfDNS 🔀
Split-horizon DNS: internal vs external resolution.

Same domain, different answers depending on who asks.

External users: https://t.co/07fUSB4Cj2 → 203.0.113.1 (public IP)
Internal users: https://t.co/07fUSB4Cj2 → 10.0.1.50 (private IP)

#DNS

[DNSFly @dnsflynet]

@lightsilver323 https://t.co/SoY9CJ5OyG

[DNSFly @dnsflynet]

Day 55/100 — #100DaysOfDNS 🌐
Multi-CDN setup: how big sites handle DNS.

They use DNS-based load balancing:
→ GeoDNS routes users to nearest CDN
→ Health checks remove failed endpoints
→ Weighted routing controls traffic distribution

Providers: Cloudflare, AWS Route 53, NS1

[DNSFly @dnsflynet]

@zmirumar https://t.co/SoY9CJ5OyG

[DNSFly @dnsflynet]

Day 54/100 — #100DaysOfDNS 🧪
Test DNS changes in staging before production.

Create a staging subdomain (https://t.co/jp4SEEMjsP) with its own DNS records.

Test the new IP/server/config there first. Verify everything works. THEN update production DNS.

#DNS

[DNSFly @dnsflynet]

Day 53/100 — #100DaysOfDNS 🔁
Always have two nameservers minimum.

If your only nameserver goes down, your entire domain disappears from the internet.

Every DNS setup should have at least 2 nameservers:
→ https://t.co/6vIdA0KFnN (primary)
→ https://t.co/XeEpqza9jE (secondary)

[DNSFly @dnsflynet]

@solopribuilds https://t.co/SoY9CJ5OyG

[DNSFly @dnsflynet]

Day 52/100 — #100DaysOfDNS ⏱️
The TTL strategy nobody talks about.

A records: TTL 86400 (24 hours)
MX records : TTL 3600 (1 hour)
TXT records : TTL 300 (5 min)

High TTL = fewer DNS lookups = faster for users.
Low TTL = faster changes = more flexibility.

#DNS

[DNSFly @dnsflynet]

Day 51/100 — #100DaysOfDNS 📓
Keep a DNS record changelog.

Date | Record | Old Value | New Value | Reason

Why?
→ Debug when something breaks weeks later
→ Know who changed what
→ Rollback quickly
→ Audit trail for compliance

#DNS

[DNSFly @dnsflynet]

Day 50/100 — #100DaysOfDNS 🏁
Halfway through 100 Days of DNS. Here's what matters most.

→ Version control your DNS records
→ Lower TTL before changes
→ Always have a rollback plan
→ Monitor propagation after every change
→ Test email after DNS changes

#DNS