DNS Management

DNS is the layer everyone forgets is a distributed system until it breaks one. A record change doesn't take effect atomically everywhere — it propagates through a chain of caching resolvers, each honoring a TTL you set, and a large share of "the whole platform is down" incidents turn out to be a single wrong record or an expired zone, not the application at all.

Treat every DNS change like a deploy: plan the rollout, control the blast radius with TTL, and have a way to verify it landed before you call it done. DNS is infrastructure with its own deploy pipeline — changes have propagation lag and no instant rollback.

1. Pick the record type for what's actually being pointed at

A/AAAA records point a name directly at an IP; CNAME points a name at another name and cannot coexist with other records on the same label; ALIAS/ANAME (provider-specific) give CNAME-like flexibility at a zone apex where CNAME is disallowed. Getting this wrong is the most common reason a root domain can't point at a load balancer with a rotating IP.