Jekyll2026-08-17T18:09:32-07:00https://utiliy.com/feed.xmlUtiliyPractical guides on home networking, privacy, and earning from tech — written without the hype.Mike Chenhello@utiliy.comDNS Explained Without the Computer Science Degree2026-08-17T00:00:00-07:002026-08-17T00:00:00-07:00https://utiliy.com/blog/dns-explained-simplyEvery networking article assumes you already know DNS. You don’t — and that’s fine. I didn’t really get it until my third year on the job, when a misconfigured CNAME took down email for a dental office.

Here’s the version I wish someone sent me before I touched Pi-hole.

Four boxes showing a browser asking a resolver, which walks root and TLD servers to the authoritative answer
Your laptop almost never talks to the authoritative server itself. The resolver does the walking — and caches the answer.

The phone book analogy (accurate enough)

Your browser doesn’t know where gmail.com lives. It asks DNS: “What’s the IP address?”

DNS responds: 142.250.80.46 (simplified — Google uses many IPs).

Browser connects to that number. You see Gmail.

The cast of characters

Piece Role Example in my house
Stub resolver App asking the question Chrome on laptop
Recursive resolver Does the legwork Pi-hole → Unbound
Authoritative server Source of truth for a domain Google’s nameservers
Cache Remembers recent answers Pi-hole FTL database

When I type amazon.com, my laptop asks Pi-hole. Pi-hole asks Unbound. Unbound walks the DNS tree from root servers down. Answer cached for the TTL (time-to-live).

Record types you’ll actually see

  • A / AAAA — name → IPv4 / IPv6
  • CNAME — alias pointing to another name
  • MX — mail server for a domain
  • TXT — verification strings (SPF, DKIM, Google Search Console)
  • PTR — reverse lookup (IP → name), mostly diagnostics

Home users break things with CNAME chasing when blocklists block the wrong target.

Why “change DNS to 1.1.1.1” fixes stuff

Your ISP’s resolver might be:

  • Slow
  • Logging queries for ads (historically true in some markets)
  • Broken during outages

Switching to Cloudflare or Quad9 changes who answers — not magic, just a different resolver with different policies and uptime.

Pi-hole adds: “And I’ll block answers I don’t like.”

TTL: why changes take time

TTL tells resolvers how long to cache. Set 300 (5 minutes) before migrating services; lower TTL days ahead of cutover.

I’ve seen people panic when email moved but TTL was 86400 (24 hours). Patience or flush local cache — not both help instantly.

Debugging commands (copy these)

# What does my system think?
dig example.com +short

# Trace full resolution path
dig example.com +trace

# Which DNS server answered?
dig example.com @192.168.1.53

# Reverse lookup
dig -x 8.8.8.8 +short

On Windows: nslookup example.com.

Common “DNS broke my life” symptoms

Symptom Often actually
“Wi-Fi works but internet doesn’t” on phone Captive portal / blocked connectivity check domain
Site loads on LTE, not home Wi-Fi Pi-hole blocklist or parental control
Email works, website doesn’t Unrelated — stop blaming MX records
Everything slow Usually not DNS — check Wi-Fi or ISP

When to stop tweaking DNS

If pages load, streaming works, and Pi-hole query log isn’t red with your own devices failing — leave it alone. DNS rabbit holes are deep.

Update log

  • Aug 17, 2026: Published as the networking starting point
]]>Mike ChenFive Router Settings I Change on Every Home Network — Including My Own2026-08-17T00:00:00-07:002026-08-17T00:00:00-07:00https://utiliy.com/blog/router-settings-securityI’ve logged into maybe 200 consumer routers for friends and family. Five settings account for the majority of avoidable problems — and none require buying new hardware.

1. Admin password and remote management

Default credentials for ISP routers live in PDFs online. Change the admin password to 20+ random characters in a password manager.

Then find Remote Management / WAN Admin / Web Access from Internet and disable it. If you need remote access later, use Tailscale on a internal device — not an exposed router login.

On a Arris NV4551, this hides under Firewall → Remote Admin.

2. Firmware (check monthly, not yearly)

Router exploits don’t wait for you. Log in, open System → Firmware, click check.

Schedule a calendar reminder. Many breaches in consumer routers are patched months before people update.

3. Wi-Fi encryption: WPA3 or WPA2-AES only

Setting Use
WPA3-Personal Best if all devices support it
WPA2-AES Safe fallback for mixed households
WPA/WPA2 mixed Avoid — keeps legacy modes alive
WEP / Open Never

Disable WPS. The physical button is convenient; the protocol isn’t.

4. Guest network with client isolation

Create YourName-Guest. Enable AP isolation so guests can’t see Chromecasts, NAS boxes, or your work laptop.

Move smart devices here when they’re chatty or cheap — see my parents’ Wi-Fi case study.

5. DNS that isn’t your ISP’s default

Set router DNS to 1.1.1.1 and 1.0.0.1 (Cloudflare) or 9.9.9.9 (Quad9). Faster lookups, slightly better privacy posture.

For filtering, point DNS to a Pi-hole IP instead — but only after Pi-hole is stable.

Bonus: things I don’t bother with on stock routers

  • MAC filtering: Spoofing is trivial; maintenance burden high
  • Hidden SSID: Makes client setup annoying, not security
  • Manual port forwards for games: UPnP on, but logged — whole separate post

The honest ceiling

These changes remove low-hanging fruit. They won’t stop a targeted attack from a skilled adversary. They stop drive-by scans and nosy neighbors — which is the actual threat model for most homes.

Update log

  • Aug 17, 2026: Published from field notes I still use on family routers
]]>Mike Chen