SOA lookup

The SOA describes the zone (RFC 1035 §3.3.13): MNAME is the primary server, RNAME the responsible address (its first dot stands for @), SERIAL the zone's version, and REFRESH, RETRY and EXPIRE concern the secondary servers. MINIMUM now says how long negative answers are cached (RFC 2308 §4): after you create a record, it may take that long to show.

• NXDOMAIN, NODATA or an error

  NXDOMAIN: the name does not exist. NODATA: the name exists but lacks the type asked (RFC 2308 §2.1, §2.2). Both are definite answers. A timeout or SERVFAIL says nothing about the record, so we show them as "unavailable".

• TTL

  How long the answer may be cached, in seconds; the number shown is what is left in our resolver's cache. Negative answers are cached too, at most for the SOA MINIMUM field (RFC 2308 §4, §5): a newly created record may only appear after it.

• DNSSEC

  "DNSSEC validated" means our resolver checked the signatures and considers the answer authentic (the AD bit, RFC 4035 §3.2.3). "No DNSSEC": the zone is not signed, or the chain of trust does not reach it.

• Aliases (CNAME)

  A CNAME points a name at another, and the resolver follows the chain and answers for its target (RFC 1034 §3.6.2). A name with a CNAME can have no other records, and MX and NS must not point at an alias (RFC 2181 §10.3).

Sources: RFC 1034 · RFC 1035 · RFC 2181 · RFC 2308 · RFC 4035