~/tutorials/008-the-zone.md

008: The zone

Every hostname is a question. dig asks it. This shell answers for exactly one zone, its own, from a snapshot taken on 2026-09-21, and says where the answer came from on every reply.

A record that exists

dig l1ackers.com

The apex answers with an A record and an address. Here is that address in prose, so you can compare: 172.104.5.114. If your dig says something else, the snapshot aged, and the line at the top of the output is the timestamp to blame.

dig www.l1ackers.com

One record for one name. Ask for the subdomain and the subdomain answers.

A record that does not

dig mail.l1ackers.com

mail is not in the zone, and the reply does not pretend otherwise. Look at the difference between the two answers: an existing name gets records. A name that is not in the zone gets told which zone this shell will answer for. Those are different replies, and reading them apart is the whole skill. A resolver that answered both the same way would be lying to you one way or the other.

The parts worth reading

The MX records say where mail for this domain goes. The TXT records say who is allowed to send as it. dig l1ackers.com | grep MX | wc -l counted four at the time of writing, which is a strange number of mail servers for a site this size, and each of them belongs to somebody else's infrastructure. That is what a DNS zone is: the public list of who this domain trusts.

Why it refuses to be a resolver

A shell anybody can type into, that resolves any name on demand, is an open oracle. It gets abused, and it gets used to probe other people's infrastructure, so this one answers for l1ackers.com and nothing else. The refusal is the shape of a boundary, not a broken tool.

The real thing runs on your machine. dig +short l1ackers.com from home is live, this one is a snapshot, and now you know how to tell them apart.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

1. Ask for l1ackers.com, then ask for www.l1ackers.com. Same address, different name. What did the zone have to say about each?
2. Ask for a record that exists and one that does not, and read the difference.
3. Which mail servers answer for this domain, and can you count them with a pipe?
4. Try dig example.com. Read the reply, because the reply is the lesson.

Numbers here can go stale. The snapshot date rides along with every answer, which is the honest way to age.