An AI generated user guide for those with moderate level of experience, who are interested in learning more about how applications, assets, and traffic flow through the Internet to serve the World Wide Web.

DNS Understanding for Rocket.net Support Engineer

Overview

This document outlines the DNS-specific knowledge required for a Support Engineer at Rocket.net, focusing on the “advanced understanding of DNS” requirement from the job description.

Table of Contents

  1. Core DNS Concepts
  2. DNS Record Types
  3. Rocket.net DNS Configuration
  4. Cloudflare DNS Integration
  5. SSL/TLS and DNS
  6. DNS Propagation
  7. Troubleshooting Common DNS Issues
  8. Tools and Verification

Core DNS Concepts

What is DNS?

DNS (Domain Name System) is “an online directory that allows an easy-to-remember domain name to be converted to a hard-to-remember IP address.” It functions as the Internet’s phonebook, translating human-readable domain names into machine-readable IP addresses.

DNS Architecture – Hierarchical System

The DNS system uses a multi-layered hierarchical approach:

  1. Root Servers
  2. Starting point for all DNS lookups
  3. Direct queries to appropriate domain extension handlers

  4. Foundation of the global DNS infrastructure

  5. TLD (Top-Level Domain) Servers

  6. Specialized servers managing specific domain extensions (.com, .net, .org, etc.)

  7. Handle zone delegation for second-level domains

  8. Authoritative Nameservers

  9. Final destination containing actual DNS records for specific domains
  10. Provide definitive answers to DNS queries
  11. Example: Cloudflare nameservers follow the pattern <proper_name>.ns.cloudflare.com

IP Addresses

Every internet-connected device has a unique numerical identifier consisting of “four numbers between 0 and 255 that are separated by a dot” (e.g., 216.58.205.46 or 104.19.154.92).

DNS Record Types

A Records (Address Records)

  • Purpose: “Straightforward mapping of a domain name (rocket.net) or subdomain to an IP address”
  • Use Case: Points the apex domain (example.com) to a server IP address
  • Rocket.net Example: Point @ (root domain) to the IP address provided (e.g., 104.19.154.92)
  • Configuration:
  • Host field: @ (for root domain)
  • Value: IP address from Rocket.net
  • Proxiable: Yes – can be proxied through Cloudflare (orange cloud)

CNAME Records (Canonical Name)

  • Purpose: Creates shortcuts/aliases that copy all records from another domain
  • Use Case: Point www subdomain to the main domain or temporary domain
  • Rocket.net Example: Point www to temporary domain like vs85taq4e9.onrocket.site
  • Configuration:
  • Host field: www or subdomain name
  • Value: Target domain (temporary Rocket.net domain)
  • Proxiable: Yes – can be proxied through Cloudflare
  • Important: CNAME records used for third-party service verification should NOT be proxied

TXT Records (Text Records)

  • Purpose: Store unstructured text data associated with a domain
  • Primary Uses:
  • SSL certificate validation (domain ownership verification)
  • SPF records (email authentication)
  • DKIM records (email signing)
  • DMARC records (email policy)
  • Domain ownership verification for third-party services
  • Rocket.net SSL Setup: Requires TWO TXT records for SSL configuration
  • Configuration: Copy exact record name and value from Rocket.net
  • Proxiable: No

MX Records (Mail Exchange)

  • Purpose: Mail exchange routing; directs email servers for domain-based addresses
  • Use Case: Specifies which mail servers handle email for your domain
  • Priority: Uses priority values to determine mail server order
  • Proxiable: No

Rocket.net DNS Configuration

Key Facts About Rocket.net DNS

  • No Built-in DNS Management: Rocket.net does NOT offer a DNS management feature
  • External DNS Required: Customers must manage DNS through their domain registrar (Namecheap, GoDaddy, Hover, etc.)
  • Enterprise CDN Integration: All traffic routes through Cloudflare Enterprise Edge Network
  • Zero Configuration CDN: Once DNS points to Rocket.net, CDN benefits are automatic

Step-by-Step DNS Setup for Rocket.net

Phase 1: Initial Domain Connection

  1. Access Rocket.net dashboard
  2. Click “Manage” on your website
  3. Select “Get Started” under “Ready to go live?”
  4. Enter your domain name
  5. Note: example.com and www.example.com are treated differently

Phase 2: SSL Configuration (CRITICAL FIRST STEP)

  1. Rocket.net provides TWO TXT records for SSL validation
  2. Add both TXT records to your domain registrar’s DNS manager:
  3. Record Type: TXT
  4. Copy exact record name from Rocket.net
  5. Copy exact record value from Rocket.net
  6. Wait “minutes for Rocket.net to configure the SSL”
  7. If you see “pending validation” status, retry in 5-10 minutes

Phase 3: Domain Pointing

Add two DNS records to your registrar:

A Record: – Type: A – Host: @ (for root domain) – Value: IP address provided by Rocket.net (e.g., 104.19.154.92) – Troubleshooting: If errors occur, “try to leave the domain field empty”

CNAME Record: – Type: CNAME
– Host: www (or as specified) – Value: Temporary domain provided (e.g., vs85taq4e9.onrocket.site)

Phase 4: Finalization

  1. Click “I’ve Updated My DNS” in Rocket.net dashboard
  2. Wait for DNS propagation (typically 15 minutes to 24 hours)
  3. Site will “immediately benefit from our Enterprise Edge Network”

Rocket.net + Cloudflare Enterprise Partnership

Key Integration Points: – Rocket.net partners with Cloudflare to deliver all traffic through Cloudflare’s Enterprise CDN – Zero configuration required for CDN routing – All requests are “cached and/or delivered from our Enterprise Edge” – Content positioned “within 50ms of the world” through automatic smart routing

For Existing Cloudflare Users: – CRITICAL: Must use DNS ONLY mode (gray cloud) when pointing to Rocket.net Enterprise Edge – This prevents conflicts between customer’s Cloudflare account and Rocket.net’s Cloudflare Enterprise – Proxying through both services causes routing conflicts

Cloudflare DNS Integration

Cloudflare Nameservers

Standard Nameserver Assignment: – When you add a domain to Cloudflare, it automatically assigns two nameservers – Format: <proper_name>.ns.cloudflare.com – Nameservers must be updated at your domain registrar – Propagation typically takes up to 24 hours

Zone Setup Process: 1. Add domain to Cloudflare 2. Cloudflare scans existing DNS records 3. Verify scanned records are correct 4. Replace nameservers at registrar with Cloudflare’s nameservers 5. Wait for propagation 6. Click “Re-check now” after ~1 hour to verify

Proxy Status: Orange Cloud vs. Gray Cloud

Orange Cloud (Proxied) ☁️🟧

What it means: – DNS record is proxied through Cloudflare – Cloudflare returns its own edge IP addresses (not your origin IP) – All traffic flows through Cloudflare’s global network – Provides: DDoS protection, CDN caching, WAF, SSL termination

When to use: – HTTP/HTTPS web traffic (A, AAAA, CNAME records) – Production websites needing security and performance – Any traffic that should be cached and protected

What happens: – Visitor → Cloudflare Edge → Origin Server – Real origin IP is hidden from public – Cloudflare can cache, filter, and optimize traffic

Gray Cloud (DNS Only) ☁️⚪

What it means: – DNS record is NOT proxied – Returns actual origin server IP address – Traffic goes directly to origin server – No Cloudflare services applied (no caching, no security)

When to use: – Rocket.net hosting (REQUIRED for compatibility) – Email servers (MX, mail subdomains) – FTP servers – SSH connections – API endpoints requiring direct access – Third-party service verification CNAMEs – Any non-HTTP protocols

Important Rule:

“HTTP traffic gets the orange cloud, everything else gets grey”

Proxiable Record Types

  • Can be proxied: A, AAAA, CNAME records only
  • Cannot be proxied: MX, TXT, SRV, NS, and other record types
  • If multiple A/AAAA records exist on the same name and one is proxied, ALL are treated as proxied

Common Cloudflare DNS Issues

Issue 1: Cloudflare Error 1016 (Origin DNS Error)

Cause: – Previous hosting company created a partial zone for your domain – Conflicts with Rocket.net’s Cloudflare Enterprise setup – Incorrect DNS configuration

Solution: – Remove conflicting partial zones in Cloudflare – Ensure DNS records point to correct Rocket.net values – Use DNS-only mode (gray cloud) for Rocket.net

Issue 2: Orange Cloud Preventing Connection

Cause: – Hosting provider (like Rocket.net) requires DNS-only settings – Orange cloud proxy interferes with their own Cloudflare Enterprise

Solution: – Set all Rocket.net-pointing records to gray cloud (DNS only) – Do not proxy traffic through personal Cloudflare account

Issue 3: Broken Email Delivery

Cause: – Email ports (SMTP, POP, IMAP) proxied via orange cloud – Email protocols don’t work through HTTP/HTTPS proxy

Solution: – Always use gray cloud for MX records – Set mail subdomains (mail.example.com) to gray cloud – Never proxy port 25, 587, 143, 993, 110, 995

SSL/TLS and DNS

SSL/TLS Encryption Modes in Cloudflare

Your zone’s SSL/TLS Encryption Mode controls TWO connections: 1. Visitor ↔ Cloudflare 2. Cloudflare ↔ Origin Server

Encryption Mode Options:

Off – No encryption at all – ⚠️ NOT RECOMMENDED – insecure

Flexible – Encrypts: Browser → Cloudflare (HTTPS) – No encryption: Cloudflare → Origin (HTTP) – ⚠️ Security Risk: Man-in-the-middle attacks possible – Use case: Origin server cannot support SSL

Full – Encrypts both connections – Accepts self-signed certificates on origin – Good for: Testing environments, self-signed certificates

Full (Strict) ✅ RECOMMENDED – Encrypts both connections – Requires valid SSL certificate on origin server – Best security posture – Use for: Production sites with valid SSL certificates

DNS and SSL Certificate Validation

TXT Record Validation: – Most common method for SSL certificate validation – Certificate authorities require adding specific TXT records – Must verify propagation before certificate issuance – Validation records must be publicly visible

CNAME Validation: – Alternative validation method – Requires adding CNAME record provided by CA – Must propagate before validation completes

Validation Timeline: – TXT/CNAME records can take 24-48 hours to propagate globally – Certificate authority systems must be able to query and verify records – Use DNS lookup tools to verify propagation before requesting certificate

Rocket.net SSL Setup: 1. Add TWO TXT records provided by Rocket.net 2. Wait minutes for SSL configuration 3. If “pending validation” appears, wait 5-10 minutes and retry 4. Once validated, HTTPS is automatically configured

Common SSL/TLS Issues

SSL Handshake Failures: – Cause: Origin lacks valid SSL certificate or incorrect SSL mode – Solution: Verify certificate validity, match SSL mode to origin configuration

Mixed Content Warnings: – Cause: Using Flexible mode without proper HTTPS on origin – Solution: Upgrade to Full (Strict) with valid origin certificate

Certificate Renewal Failures: – Cause: Forced HTTPS redirects prevent validation – Solution: Temporarily disable forced HTTPS in Cloudflare during renewal

DNS Propagation

What is DNS Propagation?

DNS propagation is the time it takes for DNS changes to spread across the global DNS system. When you update DNS records, the changes don’t happen instantly worldwide.

Propagation Timeline

Standard Timeframes: – Minimum: 15 minutes – Typical: 2-6 hours
– Maximum: 24-48 hours – Rocket.net specific: “Usually takes up to 24 hours to fully propagate”

Factors Affecting Speed: – TTL (Time To Live) values on existing records – DNS provider’s infrastructure – ISP caching policies – Geographic location of DNS servers – Recursive resolver caching

TTL (Time To Live)

What is TTL? – Specifies how long DNS records should be cached – Measured in seconds – Lower TTL = faster propagation but more DNS queries – Higher TTL = slower propagation but better performance

Common TTL Values: – 300 seconds (5 minutes) – for frequent changes – 3600 seconds (1 hour) – balanced approach – 86400 seconds (24 hours) – for stable records

Best Practice: 1. Before major DNS changes: Lower TTL to 300 seconds 2. Wait for old TTL period to expire 3. Make DNS changes 4. After propagation: Raise TTL back to higher value

Checking Propagation Status

Manual Methods: – Use online DNS checker tools (dnschecker.org, whatsmydns.net) – Check from multiple geographic locations – Verify both IPv4 and IPv6 resolution

Command Line Tools:

# Check A record
dig example.com A

# Check CNAME record
dig www.example.com CNAME

# Check TXT records (for SSL validation)
dig example.com TXT

# Check specific nameserver
dig @8.8.8.8 example.com

Cloudflare Specific: – Cloudflare dashboard shows propagation status – Use “Re-check now” button to force verification – Check “DNS” tab for record status

Troubleshooting Common DNS Issues

Issue 1: “Domain Not Found” After Adding DNS Records

Symptoms: – DNS records exist in dashboard – Queries return “domain not found” or NXDOMAIN – Website not accessible

Potential Causes: – Zone not fully synchronized across DNS network – Nameservers not properly updated at registrar – Propagation still in progress

Troubleshooting Steps: 1. Verify nameservers at registrar match Cloudflare/DNS provider 2. Check propagation status using DNS checker tools 3. Verify records are saved and not in draft state 4. Try removing and re-adding the record to force refresh 5. Wait full 24-48 hours for propagation 6. Check for typos in record values

Issue 2: SSL Certificate “Pending Validation”

Symptoms: – SSL shows as “pending validation” in Rocket.net – Website shows SSL error – Certificate not issued

Potential Causes: – TXT records not added or incorrect – TXT records not propagated yet – Typos in TXT record values

Troubleshooting Steps: 1. Verify BOTH TXT records were added correctly 2. Check TXT records with: dig example.com TXT 3. Wait 5-10 minutes and retry 4. Verify no extra spaces or characters in TXT values 5. Check DNS propagation globally 6. Ensure TXT records are not proxied (if in Cloudflare)

Issue 3: Website Shows Old Content After DNS Change

Symptoms: – DNS points to new server – Still seeing old website – Some users see new site, others see old

Potential Causes: – Browser cache – CDN cache (Cloudflare) – DNS cache at ISP level – Low TTL not set before change

Troubleshooting Steps: 1. Clear browser cache 2. Purge Cloudflare cache (if applicable) 3. Test in incognito/private browsing mode 4. Check DNS resolution: dig example.com 5. Verify A record points to new IP 6. Check from different networks/locations 7. Wait for full propagation cycle

Issue 4: Email Stopped Working After DNS Changes

Symptoms: – Cannot send or receive email – Email bounces – SMTP connection failures

Potential Causes: – MX records not migrated – MX records set to orange cloud (proxied) – Mail subdomain proxied through Cloudflare – Incorrect MX priority values

Troubleshooting Steps: 1. Verify MX records exist and are correct 2. Check MX records: dig example.com MX 3. Ensure MX records are gray cloud (DNS only) 4. Verify mail subdomains (mail.example.com) are gray cloud 5. Check MX priority values are correct 6. Verify SPF, DKIM, DMARC TXT records 7. Test email delivery with mail tester tools

Issue 5: Subdomain Not Resolving

Symptoms: – Main domain works – Subdomain shows error or doesn’t load – www version doesn’t work

Potential Causes: – Missing CNAME or A record for subdomain – Wildcard record not configured – Incorrect CNAME target

Troubleshooting Steps: 1. Check if subdomain record exists 2. Verify CNAME or A record value is correct 3. Check DNS propagation for subdomain specifically 4. Test: dig subdomain.example.com 5. Verify wildcard records if using: *.example.com 6. Check for typos in subdomain name

Issue 6: Cloudflare Orange Cloud Flipping to Gray

Symptoms: – Set record to orange cloud (proxied) – Automatically changes back to gray cloud – Cannot enable proxy mode

Potential Causes: – Cloudflare detecting incompatible service – Account limitations or settings – Record type cannot be proxied

Troubleshooting Steps: 1. Check if record type supports proxying (only A, AAAA, CNAME) 2. Verify account has proxy capability enabled 3. Check for error messages in Cloudflare dashboard 4. Review zone settings and restrictions 5. Contact Cloudflare support if issue persists

Tools and Verification

DNS Lookup Tools

Online Tools: – DNSChecker.org – Global propagation checking – WhatIsMyDNS.net – Multi-location DNS verification – MXToolbox.com – Comprehensive DNS and email testing – DNS Checker by NetYogi – Real-time DNS checking – IntoDNS – DNS health check and reporting

Command Line Tools:

dig (Linux/Mac):

# Basic A record lookup
dig example.com

# Specific record type
dig example.com MX
dig example.com TXT
dig example.com CNAME

# Query specific nameserver
dig @8.8.8.8 example.com

# Trace DNS resolution path
dig +trace example.com

# Short answer only
dig example.com +short

nslookup (Windows/Cross-platform):

# Basic lookup
nslookup example.com

# Specific record type
nslookup -type=MX example.com
nslookup -type=TXT example.com

# Query specific DNS server
nslookup example.com 8.8.8.8

host (Linux/Mac):

# Basic lookup
host example.com

# All record types
host -a example.com

# Specific nameserver
host example.com 8.8.8.8

SSL/TLS Testing Tools

  • SSL Labs (Qualys) – Comprehensive SSL/TLS testing
  • SSL Checker by SSL Shopper – Quick SSL validation
  • Why No Padlock – Mixed content detection
  • Certificate Decoder – View certificate details

Cloudflare-Specific Tools

Cloudflare Dashboard: – DNS management interface – Analytics and traffic insights – Cache purging – SSL/TLS settings – Page Rules configuration

Cloudflare API: – Programmatic DNS management – Bulk operations – Automation capabilities

Cache Management Tools

Cloudflare Cache Purge: – Purge Everything – Clears entire cache (last resort) – Purge by URL – Clears specific URLs – Purge by Tag – Clears tagged resources – Purge by Hostname – Clears by domain

Browser Cache: – Hard refresh: Ctrl+F5 (Windows) or Cmd+Shift+R (Mac) – Developer tools cache disable – Incognito/private browsing

WordPress + Cloudflare Integration

Cloudflare WordPress Plugin: – Automatic cache management – Purges cache on post/page updates – Listens to publish/update hooks – Synchronizes cache invalidation

Best Practices: – Never cache: wp-admin, login, cart, checkout – Use page rules for custom caching behavior – Purge cache after settings changes – Test in incognito mode after purges

Key Takeaways for Support Engineers

Critical DNS Concepts to Master:

  1. DNS Record Types
  2. A records map domains to IP addresses
  3. CNAME records create aliases
  4. TXT records validate ownership and configure services

  5. MX records route email

  6. Rocket.net DNS Requirements

  7. NO built-in DNS management – use registrar
  8. Requires TWO TXT records for SSL setup
  9. One A record for apex domain
  10. One CNAME for www subdomain

  11. Must use DNS-only mode (gray cloud) if customer uses Cloudflare

  12. Cloudflare Proxy Status

  13. Orange cloud = Proxied (for HTTP/HTTPS traffic)
  14. Gray cloud = DNS-only (for Rocket.net, email, FTP, SSH, APIs)
  15. Only A, AAAA, and CNAME can be proxied

  16. Wrong proxy status breaks services

  17. SSL/TLS Configuration

  18. Full (Strict) mode is best for production
  19. TXT records required for certificate validation
  20. Propagation required before validation

  21. SSL handshake failures indicate origin certificate issues

  22. DNS Propagation

  23. Can take 15 minutes to 48 hours
  24. Lower TTL before major changes
  25. Use multiple tools to verify

  26. Check globally, not just locally

  27. Common Troubleshooting

  28. Verify nameservers first
  29. Check proxy status (orange vs gray)
  30. Confirm record values are exact
  31. Wait for propagation
  32. Test from multiple locations
  33. Clear caches (browser, CDN, DNS)

Essential Support Skills:

  • Communication: Explain DNS concepts in simple terms to non-technical customers
  • Troubleshooting: Systematically diagnose DNS issues using tools and logic
  • Documentation: Create clear KBs and guides for common DNS scenarios
  • Escalation: Know when to escalate to senior engineers or Cloudflare support
  • Ownership: Take ownership of customer DNS issues and see them through to resolution
  • Empathy: Understand customer frustration with propagation delays and technical complexity

Additional Resources

Rocket.net Official Documentation

  • Rocket.net Blog: DNS Basics
  • Rocket.net Support Center
  • Rocket.net Getting Started Guides

Cloudflare Documentation

Learning Resources

  • DNS RFC 1035 (core DNS specification)
  • Cloudflare Learning Center
  • DNS propagation checker tools
  • SSL/TLS testing platforms

Conclusion

An “advanced understanding of DNS” for a Rocket.net Support Engineer means:

✅ Deep knowledge of DNS fundamentals and architecture
✅ Mastery of DNS record types and their use cases
✅ Expertise in Rocket.net’s specific DNS configuration requirements
✅ Fluency with Cloudflare DNS management and proxy settings
✅ Strong SSL/TLS and certificate validation knowledge
✅ Proficiency with DNS troubleshooting tools and techniques
✅ Ability to explain complex DNS concepts to customers clearly
✅ Understanding of DNS propagation and caching mechanics
✅ Knowledge of WordPress-specific DNS and CDN considerations

This comprehensive DNS knowledge enables Support Engineers to: – Assist customers with domain pointing to Rocket.net – Troubleshoot DNS and SSL issues efficiently – Configure Cloudflare integration correctly – Prevent common DNS misconfigurations – Provide “WOW!” customer experiences through expert technical guidance

Document created for Rocket.net Support Engineer application – August 2026