Gnu Group Learning AcademyGnu Group ↗
Cloud Infrastructure Fundamentals · Module 07 of 12

DNS and application delivery

Follow application traffic from DNS name resolution through TLS endpoints and CDN caching to an origin or load balancer.

Learning objectives

By the end of this module, you should be able to:

  • Explain common DNS record types and the purpose of a hosted zone.
  • Describe how TLS certificates bind an HTTPS endpoint to names clients request.
  • Explain how a CDN caches content closer to users and how cache policy affects freshness.
  • Trace an application-delivery flow from DNS to CDN/load balancer/origin.

DNS maps names to delivery endpoints

DNS resolves human-readable names to addresses or other names. A hosted zone contains authoritative records for a domain or delegated subdomain.

Common records include A/AAAA for addresses, CNAME for aliases to another name and provider-specific alias records for supported managed endpoints. DNS does not itself guarantee that the application behind a record is healthy.

TLS protects the client-to-endpoint connection

For HTTPS, the endpoint presents a certificate whose names must cover the hostname the client requested. Certificate validation, endpoint policy and renewal are operational responsibilities even when a managed certificate service automates parts of the lifecycle.

A CDN changes the delivery path through caching

A content delivery network can cache eligible content at edge locations and fetch misses from an origin. Cache keys, TTLs, invalidation behavior and origin headers determine correctness and freshness.

Dynamic and private content require deliberate cache policies; “put a CDN in front” is not a universal performance fix.

Trace delivery as a sequence, not isolated services

A typical request may flow: client → DNS → CDN or load balancer → healthy compute target → data/storage services. Each boundary has its own timeout, TLS, routing and observability concerns.

Worked examples

See the idea in practice.

Application delivery flow

Browser
  ↓ DNS lookup
app.example.org
  ↓ HTTPS/TLS
CDN or Load Balancer
  ↓ healthy origin
Application service
  • DNS chooses a name-to-endpoint mapping.
  • TLS authenticates/protects the connection to the endpoint.
  • A CDN may serve a cached object or forward to the origin.
Core lab · Modes 1–2 · Concept + local simulation

Lab — Simulate DNS TTL and CDN cache behavior

Goal: Use local files and a short Python simulation to see how DNS TTL and edge-cache TTL affect freshness without using a cloud account.

Before you start

  • No cloud account or AWS credentials required.
  • Python 3 is sufficient.
STEP 1

Create the simulation

cat > /tmp/delivery_sim.py <<'PY'
now=0
dns={'value':'lb-v1.example','expires':60}
cache={'value':'index-v1','expires':30}
def read(t):
    return {'time':t,'dns':dns['value'] if t<dns['expires'] else 'REFRESH_DNS','content':cache['value'] if t<cache['expires'] else 'FETCH_ORIGIN'}
for t in (0,20,35,65): print(read(t))
PY
STEP 2

Run it

python3 /tmp/delivery_sim.py
STEP 3

Reason about the output

At 35 seconds the content cache is stale while DNS can still be cached; at 65 seconds both require refresh.

Verify

  • At t=20 both DNS and content are cached.
  • At t=35 content requires an origin fetch while DNS is still cached.
  • At t=65 DNS also requires refresh.

Expected outcome

  • You can explain why DNS TTL and CDN cache TTL are separate freshness controls.

Diagnose / troubleshoot

  • If DNS changes appear ignored, compare authoritative record value with resolver TTL/cache age before changing the record again.
  • If DNS is correct but content is stale, inspect CDN/cache TTL and invalidation/origin headers.
Real-world connection

Application delivery incidents often span DNS, certificate, CDN/load-balancer and origin layers; troubleshooting should follow the request path.

Mode 3 · Optional AWS lab

Optional AWS — inspect Route 53 and CloudFront

Inspect existing DNS hosted zones and CDN distributions without creating records or distributions.

Resources created

  • None — this is a read-only inspection lab.

Estimated cost / risk

  • Expected incremental resource cost: none because the supplied commands are read-only.
  • Existing resources in the account can still incur their normal charges; confirm current AWS pricing for the selected Region/account.

Prerequisites

  • Optional sandbox AWS account and AWS CLI.
  • Use a least-privilege or federated identity; do not paste long-lived access keys into course files.
AWS 1
aws route53 list-hosted-zones --query 'HostedZones[].{Name:Name,Id:Id,Private:Config.PrivateZone}' --output table
AWS 2
aws cloudfront list-distributions --query 'DistributionList.Items[].{Id:Id,Domain:DomainName,Enabled:Enabled}' --output table

Verify

  • Existing hosted zones or CloudFront distributions are visible if present.
  • No AWS resources are created by the supplied commands.

Cleanup

  • No AWS cleanup is required because this lab creates no AWS resources.

Warnings

  • Optional only: not required for course completion or the main validator.
  • Do not create or edit public DNS records in a production domain for this lab.
  • Do not create a CloudFront distribution solely for this course.
Avoid these traps

Common mistakes

  • Treating DNS as a health-check system by itself.
  • Issuing a TLS certificate that does not cover the hostname clients use.
  • Caching personalized or rapidly changing content without an explicit cache policy.
Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1What does a hosted zone contain?

Authoritative DNS records for a domain or delegated subdomain.

2What must an HTTPS certificate match?

The hostname the client connects to must be covered by the certificate identity/SANs.

3What happens on a CDN cache miss?

The CDN normally requests the object from its configured origin, subject to its delivery and cache policy.

4Scenario: users still receive old content after an origin deployment while DNS is correct. Which delivery layer should you investigate first?

The CDN/cache layer and its TTL/invalidation behavior, because DNS resolution can be correct while cached application content remains stale.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.