These things you're talking about are a small fraction of DNS though. For instance, you lookup "thing.behind.cdn.it" and get one answer, someone else looks up

These things you're talking about are a small fraction of DNS though. For instance, you lookup "thing.behind.cdn.it" and get one answer, someone else looks up the same thing and gets a different answer. Pretty obvious, but when someone asks the reasonable question "can you open a firewall hole for thing.behind.cdn.it" Some servers forward requests, some delegate, some will look stuff up for you others won't. And there's the magic with search domains on clients, and if clients or internal resolver libraries will honor TTLs or not. There's also the myriad different types of records, and sometimes the server will tell you to reconnect in TCP instead of UDP, etc. So -- DNS is pretty complex; it has the illusion of being simple because it works so well and most of the fiddly bits are abstracted away by stuff that mostly just works.