Skip to content
BalserosWorld Homelab

DNS, TTL and the five routing layers

Extracted from the master document on 2026-09-04. §N numbering preserved so cross-references don’t break.

14. DNS: what it does and what it doesn’t

Section titled “14. DNS: what it does and what it doesn’t”

DNS translates names into addresses. Nothing more.

vault.balserosworld.net
        │  DNS
        ▼
   192.168.2.8

A record pointing at an RFC1918 address like 192.168.2.8 does not make that address reachable from the Internet. Connectivity is provided by the LAN, Tailscale or the Tunnel; DNS only gives you the number.

14.1 Cache and TTL

Section titled “14.1 Cache and TTL”

DNS changes seem to “propagate” slowly because every resolver, operating system and application keeps the answer for the length of its TTL:

Authoritative DNS (Cloudflare)
      │
      ├── resolver A ── OLD cache  → sees the old IP
      ├── resolver B ── new cache  → sees the new IP
      └── resolver C ── OLD cache  → sees the old IP
                             ▲
                             └── this is not a failure: it's the TTL running out

On a freshly delegated domain, the authoritative nameservers and the whole DNS hierarchy are involved as well.

15. Docker’s internal DNS

Section titled “15. Docker’s internal DNS”

User-created Docker networks have an embedded resolver, visible from inside the containers as 127.0.0.11.

Verified inside the Caddy container:

nameserver 127.0.0.11
ExtServers:
  100.100.100.100        ← host DNS, via Tailscale (MagicDNS)
  fd7a:115c:a1e0::53
Caddy asks for "vaultwarden"
          │
          ▼
Docker DNS 127.0.0.11
          │  is it a container on my network? → yes
          ▼
172.22.0.x  (the container's CURRENT IP, it can change)
          │
          ▼
     vaultwarden:80

Why the name is used and not the IP: the container’s IP changes when it is recreated; the name does not.

25. The five “routing” layers

Section titled “25. The five “routing” layers”

Not everything we call routing happens in the same place. This is the complete map of a request:

https://vault.balserosworld.net/api/accounts/profile
       │
  ┌────┴─────────────────────────────────────────────────────┐
  │ 1. DNS            name → IP             → 192.168.2.8    │
  │ 2. IP routing     IP → path             → LAN / Tailscale│
  │ 3. Caddy routing  hostname → backend    → vaultwarden:80 │
  │ 4. Docker DNS     name → container IP   → 172.22.0.x     │
  │ 5. app routing    method+path → handler → /api/accounts  │
  └──────────────────────────────────────────────────────────┘

Why it’s worth knowing this: when something fails, the HTTP code the browser returns tells you which layer broke. That is what turns the next section into a diagnostic tool rather than a curiosity.