[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6X2PMJ4J2YYA3TM9KTASWHV":3,"skill-same:01M6X2PMJ4J2YYA3TM9KTASWHV":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":14,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6X2PMJ4J2YYA3TM9KTASWHV","dns-networking",null,"DNS records, IP addressing, subnetting, common protocols, and diagnostic tools. Use when configuring DNS records, debugging resolution or connectivity, planning subnets, analyzing HTTPS\u002FTLS errors, or diagnosing latency and routing issues.","projectious-work\u002Fprocesskit","projectious-work","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F263889726?v=4","01M6N97TJJ118WQ35CHRV8RD0E","projectious.work","01M6N97TPWJPF0BMKYQ4PBY5W8",0,"MIT","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.23.1\u002Fcontext\u002Fskills\u002Fdevops\u002Fdns-networking\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"networking","dns","dns networking","when","debugging","errors","dns records","records","subnetting","ip","latency","use","work","common","Tools","tls","analyzing","protocols","issues","planning","2026-11-10 10:12:30",false,"---\nname: dns-networking\ndescription: |\n  DNS records, IP addressing, subnetting, common protocols, and diagnostic tools. Use when configuring DNS records, debugging resolution or connectivity, planning subnets, analyzing HTTPS\u002FTLS errors, or diagnosing latency and routing issues.\nmetadata:\n  processkit:\n    apiVersion: processkit.projectious.work\u002Fv1\n    id: SKILL-dns-networking\n    version: \"1.1.0\"\n    created: 2026-04-06T00:00:00Z\n    category: devops\n---\n\n# DNS & Networking\n\n## Intro\n\nNetworking problems resolve bottom-up: name, reachability, route, port,\napplication. Know which record type, which protocol, and which tool\nanswers each question, and most incidents collapse to a handful of\n`dig`\u002F`ss`\u002F`curl` commands.\n\n## Overview\n\n### DNS fundamentals\n\nDNS maps names to addresses through a hierarchical chain: stub\nresolver, recursive resolver, root, TLD, authoritative server. The\nrecord types you need day-to-day:\n\n- **A \u002F AAAA** — IPv4 \u002F IPv6 address mapping\n- **CNAME** — alias to another name (cannot coexist with other records\n  at the same name; cannot be used at the zone apex)\n- **MX** — mail server with priority (lower = higher priority)\n- **TXT** — arbitrary text; used for SPF, DKIM, domain verification\n- **SRV** — service discovery (priority, weight, port, target)\n- **NS** — delegates a zone to nameservers\n- **SOA** — zone metadata (primary NS, serial, refresh\u002Fretry\u002Fexpire)\n- **PTR** — reverse DNS (IP back to hostname)\n\n**TTL:** time-to-live in seconds. Lower the TTL before a migration\n(300s), raise it after (3600–86400s). Always check the current TTL\nbefore making changes: `dig +noall +answer example.com A`.\n\n### IP addressing and subnetting\n\nCIDR notation: `192.168.1.0\u002F24` means a 24-bit network prefix, leaving\n8 bits for hosts (254 usable after subtracting network and broadcast).\n\nPrivate ranges (RFC 1918):\n\n- `10.0.0.0\u002F8` — 16M addresses; large networks and cloud VPCs\n- `172.16.0.0\u002F12` — 1M addresses; Docker default bridge range\n- `192.168.0.0\u002F16` — 65K addresses; home and office networks\n\nQuick subnet math: \u002F24 = 256, \u002F25 = 128, \u002F26 = 64, \u002F27 = 32, \u002F28 = 16\n(subtract 2 for usable hosts).\n\n### Common protocols\n\nTCP gives reliable ordered delivery with a 3-way handshake. UDP is\nconnectionless and cheap — good when speed matters more than\nguaranteed delivery.\n\n- **HTTP \u002F HTTPS** — TCP 80 \u002F 443; HTTPS adds TLS\n- **DNS** — UDP 53 for queries, TCP 53 for zone transfers and large\n  responses\n- **SSH** — TCP 22 (key-based auth preferred)\n- **SMTP \u002F IMAP** — TCP 25\u002F587, 143\u002F993\n\n### TLS and HTTPS\n\nHandshake order: ClientHello (supported ciphers, SNI), ServerHello\n(chosen cipher, certificate), key exchange, encrypted session. Common\nfailure modes are expired certs, hostname mismatch, missing\nintermediate CA, and protocol version mismatch. Debug with\n`curl -vI https:\u002F\u002Fexample.com` or\n`openssl s_client -connect example.com:443`.\n\n### Port management\n\n```bash\nss -tlnp                       # TCP listeners with process names\nss -ulnp                       # UDP listeners with process names\nss -tlnp sport = :443          # what is listening on 443?\n```\n\nWell-known ports: 0–1023 (root). Registered: 1024–49151. Ephemeral:\n49152–65535.\n\n### Firewall basics\n\n```bash\n# ufw (Ubuntu\u002FDebian)\nufw allow 80\u002Ftcp\nufw allow from 10.0.0.0\u002F8 to any port 5432\nufw status numbered\n\n# iptables (direct)\niptables -A INPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -s 192.168.1.0\u002F24 -j ACCEPT\niptables -L -n --line-numbers\n```\n\nAlways allow SSH (port 22) before enabling a firewall. Test rules\nbefore persisting.\n\n### Load balancing concepts\n\n- **Round-robin DNS** — multiple A records, no health checking\n- **Reverse proxy** (nginx\u002FHAProxy) — L7, routes by path\u002Fheader,\n  health-checks backends\n- **Layer 4 LB** — TCP-level forwarding, lowest overhead, no content\n  inspection\n\nHealth checks should verify application readiness, not just TCP\nconnectivity.\n\n### Diagnostic workflow\n\nWhen something does not work, go bottom-up:\n\n1. **Name** — `dig example.com` — does it resolve?\n2. **Reachability** — `ping -c 3 \u003Cip>` — is the host up?\n3. **Route** — `traceroute \u003Cip>` — where does the path break?\n4. **Port** — `curl -v telnet:\u002F\u002F\u003Cip>:\u003Cport>` — is the port open?\n5. **Application** — `curl -vI https:\u002F\u002Fexample.com` — does the service\n   respond correctly?\n\n## Gotchas\n\nAgent-specific failure modes — provider-neutral pause-and-self-check items:\n\n- **Not lowering TTL before a DNS migration.** Changing an A record with a 24-hour TTL means clients that cached the old value before the change will continue using the old IP for up to 24 hours. Lower the TTL to 300 seconds at least an hour before the change, complete the migration, verify, then raise it back. Skipping this step makes rollback window unpredictably long.\n- **Using a CNAME at the zone apex.** A CNAME at the zone root (`example.com`, not `www.example.com`) conflicts with SOA and MX records and violates the DNS specification — many resolvers will silently drop one or the other. Use an ALIAS or ANAME record if your DNS provider supports it, or an A record pointing at a load balancer IP for the apex.\n- **Diagnosing DNS issues from a cached resolver instead of the authoritative server.** `dig example.com` queries your default recursive resolver which may return a cached (and outdated) answer. Always compare `dig @8.8.8.8 example.com` (public cache) against `dig @ns1.provider.com example.com` (authoritative) to know what the actual current record is versus what is cached.\n- **Enabling a firewall without first allowing SSH.** Adding a firewall rule that blocks all inbound traffic before ensuring port 22 (or the configured SSH port) is explicitly allowed will lock you out of the server. Always verify SSH access persists after adding firewall rules before saving them permanently.\n- **Assuming `* * *` in a traceroute means the host is down.** A hop that shows `* * *` means that router rate-limits or drops ICMP TTL-exceeded messages — it is not forwarding the probe, but it may still be forwarding actual application traffic. Only conclude the path is broken if `* * *` continues from that hop onward with no subsequent hops responding.\n- **Testing TCP port reachability from outside the server without checking whether the service is listening inside.** A port scan from an external client failing does not distinguish between \"service not listening\", \"firewall blocking\", or \"routing problem\". Add a check from inside the server itself (`ss -tlnp sport = :\u003Cport>`) to confirm the service is bound before concluding the issue is network-related.\n- **Diagnosing TLS errors without checking the full certificate chain.** A TLS error may be caused by an expired leaf certificate, a missing intermediate CA certificate, or a hostname mismatch — all of which look similar in a browser error. Use `openssl s_client -connect host:443 -showcerts` to see the full chain, not just the end-entity certificate, so you know which certificate in the chain is the problem.\n\n## Full reference\n\n### DNS record syntax\n\n```\n; A and AAAA\nexample.com.    3600  IN  A     93.184.216.34\nexample.com.    3600  IN  AAAA  2606:2800:220:1:248:1893:25c8:1946\n\n; CNAME\nwww.example.com.  3600  IN  CNAME  example.com.\n\n; MX (lower priority tried first)\nexample.com.  3600  IN  MX  10  mail1.example.com.\nexample.com.  3600  IN  MX  20  mail2.example.com.\n\n; TXT (SPF, DKIM, verification)\nexample.com.  3600  IN  TXT  \"v=spf1 include:_spf.google.com ~all\"\nselector._domainkey.example.com.  3600  IN  TXT  \"v=DKIM1; k=rsa; p=MIGf...\"\n\n; SRV: _service._proto.name TTL IN SRV priority weight port target\n_sip._tcp.example.com.  3600  IN  SRV  10 60 5060 sip1.example.com.\n\n; SOA\nexample.com.  86400  IN  SOA  ns1.provider.com. admin.example.com. (\n    2024010101  ; serial\n    3600        ; refresh\n    900         ; retry\n    604800      ; expire\n    300         ; negative cache TTL\n)\n\n; PTR (reverse DNS, lives in in-addr.arpa)\n34.216.184.93.in-addr.arpa.  3600  IN  PTR  example.com.\n```\n\nPTR records must be set at your IP provider (hosting\u002Fcloud), not your\ndomain registrar. CNAMEs cannot live at the zone apex — use ALIAS\u002FANAME\nif your provider supports it, or a plain A record.\n\n### TCP vs UDP at a glance\n\n| Property     | TCP                         | UDP                      |\n|--------------|-----------------------------|--------------------------|\n| Connection   | 3-way handshake (SYN\u002FACK)   | Connectionless           |\n| Reliability  | Guaranteed, ordered         | Best-effort, unordered   |\n| Flow control | Yes (window-based)          | None                     |\n| Overhead     | Higher (20-byte header min) | Lower (8-byte header)    |\n| Use cases    | HTTP, SSH, SMTP, databases  | DNS, video, VoIP, gaming |\n\n### HTTP status codes worth remembering\n\n| Code | Meaning |\n|---|---|\n| 200 | OK |\n| 201 | Created (POST\u002FPUT) |\n| 204 | No Content (DELETE) |\n| 301 | Moved Permanently (cacheable) |\n| 302 | Found (temporary redirect) |\n| 304 | Not Modified (client cache valid) |\n| 400 | Bad Request (malformed syntax) |\n| 401 | Unauthorized (authentication required) |\n| 403 | Forbidden (authenticated but not authorized) |\n| 404 | Not Found |\n| 429 | Too Many Requests (check `Retry-After`) |\n| 500 | Internal Server Error |\n| 502 | Bad Gateway (upstream invalid response) |\n| 503 | Service Unavailable |\n| 504 | Gateway Timeout (upstream did not respond) |\n\n### TLS handshake (1.3 vs 1.2)\n\n- **TLS 1.3** — single round-trip: ClientHello → ServerHello (cipher,\n  key share, cert) → Finished. Encrypted communication begins.\n- **TLS 1.2** — two round-trips: ClientHello → ServerHello, then cert\n  + key exchange, client verification, Finished.\n\nCommon TLS problems and checks:\n\n```bash\n# Expiration and dates\nopenssl s_client -connect host:443 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull \\\n  | openssl x509 -noout -dates\n# Full chain (verify intermediates are sent)\nopenssl s_client -connect host:443 -showcerts \u003C \u002Fdev\u002Fnull\n# Force a specific version\nopenssl s_client -connect host:443 -tls1_3\n# SNI virtual-host workaround\ncurl --resolve host:443:IP https:\u002F\u002Fhost\u002F\n```\n\nEnforce TLS 1.2+ minimum — 1.0\u002F1.1 are obsolete.\n\n### `dig` recipes\n\n```bash\ndig example.com                      # default A lookup\ndig example.com AAAA                 # IPv6\ndig example.com MX                   # mail servers\ndig example.com TXT                  # SPF\u002FDKIM\u002Fverification\ndig @8.8.8.8 example.com             # query a specific resolver\ndig @ns1.provider.com example.com    # query authoritative directly\ndig +trace example.com               # full resolution chain from root\ndig +short example.com               # terse answer\ndig +noall +answer example.com       # clean output with TTL\ndig -x 93.184.216.34                 # reverse DNS lookup\ndig @ns1.example.com example.com AXFR  # zone transfer (if permitted)\n```\n\n### Path and reachability tools\n\n```bash\n# traceroute \u002F tracepath\ntraceroute example.com\ntraceroute -T -p 443 example.com     # TCP trace (bypasses ICMP blocks)\ntraceroute -n example.com            # skip DNS lookups\ntracepath example.com                # no root needed, discovers MTU\n\n# mtr — live traceroute + packet loss stats\nmtr example.com\nmtr -rw -c 100 example.com           # report mode: 100 pkts, wide output\nmtr -T -P 443 example.com            # TCP mode on port 443\n\n# ping\nping -c 5 example.com\nping -c 5 -s 1472 example.com        # test large packets (MTU issues)\n```\n\nReading traceroute: `* * *` at a single hop often means that router\nrate-limits ICMP and is not a real problem. `* * *` from a hop onward\nwith no recovery means traffic is being dropped there. Increasing\nlatency with distance is normal; sudden jumps indicate congestion.\n\n### `curl` debugging recipes\n\n```bash\n# Connection debugging\ncurl -v https:\u002F\u002Fexample.com                  # DNS, TCP, TLS, headers\ncurl -vI https:\u002F\u002Fexample.com                 # verbose + HEAD only\ncurl -v --trace-time https:\u002F\u002Fexample.com     # add timestamps\n\n# DNS\u002Frouting control\ncurl --resolve example.com:443:93.184.216.34 https:\u002F\u002Fexample.com\ncurl -H \"Host: example.com\" http:\u002F\u002F10.0.0.5:80\u002F\ncurl -4 https:\u002F\u002Fexample.com                  # force IPv4\ncurl -6 https:\u002F\u002Fexample.com                  # force IPv6\n\n# TLS debugging\ncurl -vI https:\u002F\u002Fexample.com 2>&1 | grep -E 'SSL|TLS|subject|issuer|expire'\ncurl -k https:\u002F\u002Fself-signed.example.com      # skip verification\ncurl --cacert \u002Fpath\u002Fca.pem https:\u002F\u002Finternal  # custom CA\n\n# Timing breakdown\ncurl -o \u002Fdev\u002Fnull -s -w \"\\\n  DNS:        %{time_namelookup}s\\n\\\n  Connect:    %{time_connect}s\\n\\\n  TLS:        %{time_appconnect}s\\n\\\n  First byte: %{time_starttransfer}s\\n\\\n  Total:      %{time_total}s\\n\" https:\u002F\u002Fexample.com\n```\n\n### Socket statistics and packet capture\n\n```bash\n# ss (modern netstat replacement)\nss -tlnp                             # TCP listeners with processes\nss -ulnp                             # UDP listeners\nss -tlnp sport = :443                # who owns port 443?\nss -tn state established             # established TCP connections\nss -tn dst 10.0.0.5                  # connections to a host\nss -s                                # summary statistics\n\n# tcpdump (requires root)\nsudo tcpdump -i any port 53 -n                       # DNS traffic\nsudo tcpdump -i any host 10.0.0.5 -n                 # host traffic\nsudo tcpdump -i any port 80 -A -n                    # HTTP, ASCII dump\nsudo tcpdump -i any -w capture.pcap port 443         # save for Wireshark\nsudo tcpdump -i any 'tcp[tcpflags] & (tcp-syn) != 0' # SYN packets\nsudo tcpdump -i any 'tcp[tcpflags] & (tcp-rst) != 0' # RST packets\n```\n\n### Diagnostic workflow summary\n\n| Step | Question                   | Tool                             |\n|------|----------------------------|----------------------------------|\n| 1    | Does the name resolve?     | `dig +short example.com`         |\n| 2    | Is the host reachable?     | `ping -c 3 \u003Cip>`                 |\n| 3    | What path do packets take? | `mtr -rw -c 20 \u003Cip>`             |\n| 4    | Is the port open?          | `ss -tlnp sport = :PORT`         |\n| 5    | Does the service respond?  | `curl -vI https:\u002F\u002Fexample.com`   |\n| 6    | What is on the wire?       | `sudo tcpdump -i any port PORT`  |\n\n### Common scenarios\n\n**DNS record not propagating after change.** Compare authoritative\nanswer vs cached answer; verify the change actually reached the\nauthoritative server; then wait for the old TTL to expire:\n\n```bash\ndig @8.8.8.8 example.com A              # public resolver (may be cached)\ndig @ns1.provider.com example.com A     # authoritative (should be new)\ndig +trace example.com A                # full resolution chain\n```\n\n**Service unreachable on a specific port.** Isolate DNS vs network vs\napplication:\n\n```bash\ndig api.example.com                      # verify resolution\ncurl -v telnet:\u002F\u002Fapi.example.com:443     # TCP connectivity\ncurl -vI https:\u002F\u002Fapi.example.com         # full HTTP\u002FTLS stack\nss -tlnp sport = :443                    # on the server: is it listening?\n```\n\n**DNS + TLS for a new subdomain.** Add the record, verify, then\nissue the certificate:\n\n```bash\ndig +short staging.example.com           # verify resolution\ncurl -I http:\u002F\u002Fstaging.example.com       # HTTP works before TLS\ncertbot certonly --nginx -d staging.example.com\ncurl -vI https:\u002F\u002Fstaging.example.com     # verify HTTPS\n```\n","# DNS & Networking\n\n## Intro\n\nNetworking problems resolve bottom-up: name, reachability, route, port,\napplication. Know which record type, which protocol, and which tool\nanswers each question, and most incidents collapse to a handful of\n`dig`\u002F`ss`\u002F`curl` commands.\n\n## Overview\n\n### DNS fundamentals\n\nDNS maps names to addresses through a hierarchical chain: stub\nresolver, recursive resolver, root, TLD, authoritative server. The\nrecord types you need day-to-day:\n\n- **A \u002F AAAA** — IPv4 \u002F IPv6 address mapping\n- **CNAME** — alias to another name (cannot coexist with other records\n  at the same name; cannot be used at the zone apex)\n- **MX** — mail server with priority (lower = higher priority)\n- **TXT** — arbitrary text; used for SPF, DKIM, domain verification\n- **SRV** — service discovery (priority, weight, port, target)\n- **NS** — delegates a zone to nameservers\n- **SOA** — zone metadata (primary NS, serial, refresh\u002Fretry\u002Fexpire)\n- **PTR** — reverse DNS (IP back to hostname)\n\n**TTL:** time-to-live in seconds. Lower the TTL before a migration\n(300s), raise it after (3600–86400s). Always check the current TTL\nbefore making changes: `dig +noall +answer example.com A`.\n\n### IP addressing and subnetting\n\nCIDR notation: `192.168.1.0\u002F24` means a 24-bit network prefix, leaving\n8 bits for hosts (254 usable after subtracting network and broadcast).\n\nPrivate ranges (RFC 1918):\n\n- `10.0.0.0\u002F8` — 16M addresses; large networks and cloud VPCs\n- `172.16.0.0\u002F12` — 1M addresses; Docker default bridge range\n- `192.168.0.0\u002F16` — 65K addresses; home and office networks\n\nQuick subnet math: \u002F24 = 256, \u002F25 = 128, \u002F26 = 64, \u002F27 = 32, \u002F28 = 16\n(subtract 2 for usable hosts).\n\n### Common protocols\n\nTCP gives reliable ordered delivery with a 3-way handshake. UDP is\nconnectionless and cheap — good when speed matters more than\nguaranteed delivery.\n\n- **HTTP \u002F HTTPS** — TCP 80 \u002F 443; HTTPS adds TLS\n- **DNS** — UDP 53 for queries, TCP 53 for zone transfers and large\n  responses\n- **SSH** — TCP 22 (key-based auth preferred)\n- **SMTP \u002F IMAP** — TCP 25\u002F587, 143\u002F993\n\n### TLS and HTTPS\n\nHandshake order: ClientHello (supported ciphers, SNI), ServerHello\n(chosen cipher, certificate), key exchange, encrypted session. Common\nfailure modes are expired certs, hostname mismatch, missing\nintermediate CA, and protocol version mismatch. Debug with\n`curl -vI https:\u002F\u002Fexample.com` or\n`openssl s_client -connect example.com:443`.\n\n### Port management\n\n```bash\nss -tlnp                       # TCP listeners with process names\nss -ulnp                       # UDP listeners with process names\nss -tlnp sport = :443          # what is listening on 443?\n```\n\nWell-known ports: 0–1023 (root). Registered: 1024–49151. Ephemeral:\n49152–65535.\n\n### Firewall basics\n\n```bash\n# ufw (Ubuntu\u002FDebian)\nufw allow 80\u002Ftcp\nufw allow from 10.0.0.0\u002F8 to any port 5432\nufw status numbered\n\n# iptables (direct)\niptables -A INPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -s 192.168.1.0\u002F24 -j ACCEPT\niptables -L -n --line-numbers\n```\n\nAlways allow SSH (port 22) before enabling a firewall. Test rules\nbefore persisting.\n\n### Load balancing concepts\n\n- **Round-robin DNS** — multiple A records, no health checking\n- **Reverse proxy** (nginx\u002FHAProxy) — L7, routes by path\u002Fheader,\n  health-checks backends\n- **Layer 4 LB** — TCP-level forwarding, lowest overhead, no content\n  inspection\n\nHealth checks should verify application readiness, not just TCP\nconnectivity.\n\n### Diagnostic workflow\n\nWhen something does not work, go bottom-up:\n\n1. **Name** — `dig example.com` — does it resolve?\n2. **Reachability** — `ping -c 3 \u003Cip>` — is the host up?\n3. **Route** — `traceroute \u003Cip>` — where does the path break?\n4. **Port** — `curl -v telnet:\u002F\u002F\u003Cip>:\u003Cport>` — is the port open?\n5. **Application** — `curl -vI https:\u002F\u002Fexample.com` — does the service\n   respond correctly?\n\n## Gotchas\n\nAgent-specific failure modes — provider-neutral pause-and-self-check items:\n\n- **Not lowering TTL before a DNS migration.** Changing an A record with a 24-hour TTL means clients that cached the old value before the change will continue using the old IP for up to 24 hours. Lower the TTL to 300 seconds at least an hour before the change, complete the migration, verify, then raise it back. Skipping this step makes rollback window unpredictably long.\n- **Using a CNAME at the zone apex.** A CNAME at the zone root (`example.com`, not `www.example.com`) conflicts with SOA and MX records and violates the DNS specification — many resolvers will silently drop one or the other. Use an ALIAS or ANAME record if your DNS provider supports it, or an A record pointing at a load balancer IP for the apex.\n- **Diagnosing DNS issues from a cached resolver instead of the authoritative server.** `dig example.com` queries your default recursive resolver which may return a cached (and outdated) answer. Always compare `dig @8.8.8.8 example.com` (public cache) against `dig @ns1.provider.com example.com` (authoritative) to know what the actual current record is versus what is cached.\n- **Enabling a firewall without first allowing SSH.** Adding a firewall rule that blocks all inbound traffic before ensuring port 22 (or the configured SSH port) is explicitly allowed will lock you out of the server. Always verify SSH access persists after adding firewall rules before saving them permanently.\n- **Assuming `* * *` in a traceroute means the host is down.** A hop that shows `* * *` means that router rate-limits or drops ICMP TTL-exceeded messages — it is not forwarding the probe, but it may still be forwarding actual application traffic. Only conclude the path is broken if `* * *` continues from that hop onward with no subsequent hops responding.\n- **Testing TCP port reachability from outside the server without checking whether the service is listening inside.** A port scan from an external client failing does not distinguish between \"service not listening\", \"firewall blocking\", or \"routing problem\". Add a check from inside the server itself (`ss -tlnp sport = :\u003Cport>`) to confirm the service is bound before concluding the issue is network-related.\n- **Diagnosing TLS errors without checking the full certificate chain.** A TLS error may be caused by an expired leaf certificate, a missing intermediate CA certificate, or a hostname mismatch — all of which look similar in a browser error. Use `openssl s_client -connect host:443 -showcerts` to see the full chain, not just the end-entity certificate, so you know which certificate in the chain is the problem.\n\n## Full reference\n\n### DNS record syntax\n\n```\n; A and AAAA\nexample.com.    3600  IN  A     93.184.216.34\nexample.com.    3600  IN  AAAA  2606:2800:220:1:248:1893:25c8:1946\n\n; CNAME\nwww.example.com.  3600  IN  CNAME  example.com.\n\n; MX (lower priority tried first)\nexample.com.  3600  IN  MX  10  mail1.example.com.\nexample.com.  3600  IN  MX  20  mail2.example.com.\n\n; TXT (SPF, DKIM, verification)\nexample.com.  3600  IN  TXT  \"v=spf1 include:_spf.google.com ~all\"\nselector._domainkey.example.com.  3600  IN  TXT  \"v=DKIM1; k=rsa; p=MIGf...\"\n\n; SRV: _service._proto.name TTL IN SRV priority weight port target\n_sip._tcp.example.com.  3600  IN  SRV  10 60 5060 sip1.example.com.\n\n; SOA\nexample.com.  86400  IN  SOA  ns1.provider.com. admin.example.com. (\n    2024010101  ; serial\n    3600        ; refresh\n    900         ; retry\n    604800      ; expire\n    300         ; negative cache TTL\n)\n\n; PTR (reverse DNS, lives in in-addr.arpa)\n34.216.184.93.in-addr.arpa.  3600  IN  PTR  example.com.\n```\n\nPTR records must be set at your IP provider (hosting\u002Fcloud), not your\ndomain registrar. CNAMEs cannot live at the zone apex — use ALIAS\u002FANAME\nif your provider supports it, or a plain A record.\n\n### TCP vs UDP at a glance\n\n| Property     | TCP                         | UDP                      |\n|--------------|-----------------------------|--------------------------|\n| Connection   | 3-way handshake (SYN\u002FACK)   | Connectionless           |\n| Reliability  | Guaranteed, ordered         | Best-effort, unordered   |\n| Flow control | Yes (window-based)          | None                     |\n| Overhead     | Higher (20-byte header min) | Lower (8-byte header)    |\n| Use cases    | HTTP, SSH, SMTP, databases  | DNS, video, VoIP, gaming |\n\n### HTTP status codes worth remembering\n\n| Code | Meaning |\n|---|---|\n| 200 | OK |\n| 201 | Created (POST\u002FPUT) |\n| 204 | No Content (DELETE) |\n| 301 | Moved Permanently (cacheable) |\n| 302 | Found (temporary redirect) |\n| 304 | Not Modified (client cache valid) |\n| 400 | Bad Request (malformed syntax) |\n| 401 | Unauthorized (authentication required) |\n| 403 | Forbidden (authenticated but not authorized) |\n| 404 | Not Found |\n| 429 | Too Many Requests (check `Retry-After`) |\n| 500 | Internal Server Error |\n| 502 | Bad Gateway (upstream invalid response) |\n| 503 | Service Unavailable |\n| 504 | Gateway Timeout (upstream did not respond) |\n\n### TLS handshake (1.3 vs 1.2)\n\n- **TLS 1.3** — single round-trip: ClientHello → ServerHello (cipher,\n  key share, cert) → Finished. Encrypted communication begins.\n- **TLS 1.2** — two round-trips: ClientHello → ServerHello, then cert\n  + key exchange, client verification, Finished.\n\nCommon TLS problems and checks:\n\n```bash\n# Expiration and dates\nopenssl s_client -connect host:443 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull \\\n  | openssl x509 -noout -dates\n# Full chain (verify intermediates are sent)\nopenssl s_client -connect host:443 -showcerts \u003C \u002Fdev\u002Fnull\n# Force a specific version\nopenssl s_client -connect host:443 -tls1_3\n# SNI virtual-host workaround\ncurl --resolve host:443:IP https:\u002F\u002Fhost\u002F\n```\n\nEnforce TLS 1.2+ minimum — 1.0\u002F1.1 are obsolete.\n\n### `dig` recipes\n\n```bash\ndig example.com                      # default A lookup\ndig example.com AAAA                 # IPv6\ndig example.com MX                   # mail servers\ndig example.com TXT                  # SPF\u002FDKIM\u002Fverification\ndig @8.8.8.8 example.com             # query a specific resolver\ndig @ns1.provider.com example.com    # query authoritative directly\ndig +trace example.com               # full resolution chain from root\ndig +short example.com               # terse answer\ndig +noall +answer example.com       # clean output with TTL\ndig -x 93.184.216.34                 # reverse DNS lookup\ndig @ns1.example.com example.com AXFR  # zone transfer (if permitted)\n```\n\n### Path and reachability tools\n\n```bash\n# traceroute \u002F tracepath\ntraceroute example.com\ntraceroute -T -p 443 example.com     # TCP trace (bypasses ICMP blocks)\ntraceroute -n example.com            # skip DNS lookups\ntracepath example.com                # no root needed, discovers MTU\n\n# mtr — live traceroute + packet loss stats\nmtr example.com\nmtr -rw -c 100 example.com           # report mode: 100 pkts, wide output\nmtr -T -P 443 example.com            # TCP mode on port 443\n\n# ping\nping -c 5 example.com\nping -c 5 -s 1472 example.com        # test large packets (MTU issues)\n```\n\nReading traceroute: `* * *` at a single hop often means that router\nrate-limits ICMP and is not a real problem. `* * *` from a hop onward\nwith no recovery means traffic is being dropped there. Increasing\nlatency with distance is normal; sudden jumps indicate congestion.\n\n### `curl` debugging recipes\n\n```bash\n# Connection debugging\ncurl -v https:\u002F\u002Fexample.com                  # DNS, TCP, TLS, headers\ncurl -vI https:\u002F\u002Fexample.com                 # verbose + HEAD only\ncurl -v --trace-time https:\u002F\u002Fexample.com     # add timestamps\n\n# DNS\u002Frouting control\ncurl --resolve example.com:443:93.184.216.34 https:\u002F\u002Fexample.com\ncurl -H \"Host: example.com\" http:\u002F\u002F10.0.0.5:80\u002F\ncurl -4 https:\u002F\u002Fexample.com                  # force IPv4\ncurl -6 https:\u002F\u002Fexample.com                  # force IPv6\n\n# TLS debugging\ncurl -vI https:\u002F\u002Fexample.com 2>&1 | grep -E 'SSL|TLS|subject|issuer|expire'\ncurl -k https:\u002F\u002Fself-signed.example.com      # skip verification\ncurl --cacert \u002Fpath\u002Fca.pem https:\u002F\u002Finternal  # custom CA\n\n# Timing breakdown\ncurl -o \u002Fdev\u002Fnull -s -w \"\\\n  DNS:        %{time_namelookup}s\\n\\\n  Connect:    %{time_connect}s\\n\\\n  TLS:        %{time_appconnect}s\\n\\\n  First byte: %{time_starttransfer}s\\n\\\n  Total:      %{time_total}s\\n\" https:\u002F\u002Fexample.com\n```\n\n### Socket statistics and packet capture\n\n```bash\n# ss (modern netstat replacement)\nss -tlnp                             # TCP listeners with processes\nss -ulnp                             # UDP listeners\nss -tlnp sport = :443                # who owns port 443?\nss -tn state established             # established TCP connections\nss -tn dst 10.0.0.5                  # connections to a host\nss -s                                # summary statistics\n\n# tcpdump (requires root)\nsudo tcpdump -i any port 53 -n                       # DNS traffic\nsudo tcpdump -i any host 10.0.0.5 -n                 # host traffic\nsudo tcpdump -i any port 80 -A -n                    # HTTP, ASCII dump\nsudo tcpdump -i any -w capture.pcap port 443         # save for Wireshark\nsudo tcpdump -i any 'tcp[tcpflags] & (tcp-syn) != 0' # SYN packets\nsudo tcpdump -i any 'tcp[tcpflags] & (tcp-rst) != 0' # RST packets\n```\n\n### Diagnostic workflow summary\n\n| Step | Question                   | Tool                             |\n|------|----------------------------|----------------------------------|\n| 1    | Does the name resolve?     | `dig +short example.com`         |\n| 2    | Is the host reachable?     | `ping -c 3 \u003Cip>`                 |\n| 3    | What path do packets take? | `mtr -rw -c 20 \u003Cip>`             |\n| 4    | Is the port open?          | `ss -tlnp sport = :PORT`         |\n| 5    | Does the service respond?  | `curl -vI https:\u002F\u002Fexample.com`   |\n| 6    | What is on the wire?       | `sudo tcpdump -i any port PORT`  |\n\n### Common scenarios\n\n**DNS record not propagating after change.** Compare authoritative\nanswer vs cached answer; verify the change actually reached the\nauthoritative server; then wait for the old TTL to expire:\n\n```bash\ndig @8.8.8.8 example.com A              # public resolver (may be cached)\ndig @ns1.provider.com example.com A     # authoritative (should be new)\ndig +trace example.com A                # full resolution chain\n```\n\n**Service unreachable on a specific port.** Isolate DNS vs network vs\napplication:\n\n```bash\ndig api.example.com                      # verify resolution\ncurl -v telnet:\u002F\u002Fapi.example.com:443     # TCP connectivity\ncurl -vI https:\u002F\u002Fapi.example.com         # full HTTP\u002FTLS stack\nss -tlnp sport = :443                    # on the server: is it listening?\n```\n\n**DNS + TLS for a new subdomain.** Add the record, verify, then\nissue the certificate:\n\n```bash\ndig +short staging.example.com           # verify resolution\ncurl -I http:\u002F\u002Fstaging.example.com       # HTTP works before TLS\ncertbot certonly --nginx -d staging.example.com\ncurl -vI https:\u002F\u002Fstaging.example.com     # verify HTTPS\n```\n",{"name":5,"metadata":44,"description":51},{"processkit":45},{"id":46,"created":47,"version":48,"category":49,"apiVersion":50},"SKILL-dns-networking",1775433600000,"1.1.0","devops","processkit.projectious.work\u002Fv1","DNS records, IP addressing, subnetting, common protocols, and diagnostic tools. Use when configuring DNS records, debugging resolution or connectivity, planning subnets, analyzing HTTPS\u002FTLS errors, or diagnosing latency and routing issues.\n","main","4876a92620ee792aac2ac9a1a806322d8a572367","archive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.23.1\u002Fcontext\u002Fskills\u002Fdevops\u002Fdns-networking","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit","https:\u002F\u002Fprojectious-work.github.io\u002Fprocesskit\u002F","https:\u002F\u002Fgithub.com\u002Fprojectious-work","2026-11-11 23:24:18",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add projectious-work\u002Fprocesskit --skill dns-networking",{"tool":65,"command":66},"bunx","bunx skills add projectious-work\u002Fprocesskit --skill dns-networking",{"tool":68,"command":69},"pnpm","pnpm dlx skills add projectious-work\u002Fprocesskit --skill dns-networking","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.23.1\u002Fcontext\u002Fskills\u002Fdevops\u002Fdns-networking\u002FSKILL.md",true,[73,79],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fprotocol-reference.md","REFERENCE","参考文档",6319,"https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.23.1\u002Fcontext\u002Fskills\u002Fdevops\u002Fdns-networking\u002Freferences\u002Fprotocol-reference.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Ftroubleshooting-tools.md",6841,"https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.23.1\u002Fcontext\u002Fskills\u002Fdevops\u002Fdns-networking\u002Freferences\u002Ftroubleshooting-tools.md",[84,111,131,152,169,187],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":95,"publishedAt":39},"01M6X5MTC89B4ZGXW3JVSQCPF8","skill-management","Manage Skill package manifests as v1 ontology entities.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fskill-management\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":93,"taxonomyTypeDesc":94},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[96,97,98,99,100,101,31,102,103,104,86,105,106,107,108,109,110],"management","skill management","create","update","package","alpha","list","manage","ontology","get","as","manifests","v1","skill package","transition",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":39},"01M6X5MCV74NHW5MEDNHZRF2C8","schema-management","Manage generated processkit schema contracts through deterministic MCP rebuild and inspection workflows.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fschema-management\u002FSKILL.md",[117],{"categoryNo":91,"categoryName":92,"taxonomyType":93,"taxonomyTypeDesc":94},[96,119,120,121,122,123,101,31,124,125,103,126,127,128,105,129,130],"schema","schema management","MCP","workflows","validation","generated","rebuild","contracts","wed","deterministic","contract","mode",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":39},"01M6X5M5G6YJ96AMZGSCZJ1D13","proposition-management","Record claims, risks, beliefs, world facts, WSJF estimates, and assumptions through the Proposition interface.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fproposition-management\u002FSKILL.md",[],[96,138,139,98,99,140,101,31,141,142,143,144,105,145,146,147,148,149,150,151],"proposition","proposition management","index","log","world","record","query","creation","event","interface","updates","facts","claims","WSJF",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":39},"01M6X5KMQ83QN9M6MPWZM7344F","ontology-management","Manage generated v1 ontology entities that do not require a dedicated domain server.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fontology-management\u002FSKILL.md",[],[96,104,159,98,101,160,161,124,162,141,103,163,164,105,165,166,146,167,108,168],"ontology management","lifecycle","archive","roadmap","do","domain","iteration","keep","measurement","generic",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":39},"01M6X5KCY2DN3SM21RERSFNEBT","okf-compatibility","Import, export, and validate conformant Open Knowledge Format bundles.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fokf-compatibility\u002FSKILL.md",[],[176,177,178,179,101,180,181,182,31,183,184,185,186],"okf","compatibility","okf compatibility","validate","open","knowledge","format","export","bundles","bundle","import",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":39},"01M6X5JA8S5PNGJVFW4EQY8T83","capability-management","Manage versioned Capability entities and their governed lifecycle.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fcapability-management\u002FSKILL.md",[],[96,194,195,98,99,140,101,160,31,102,141,196,103,143,105,166,146,147,197,110],"capability","capability management","queries","changes"]