Quick Summary
- DNS translates human-readable domain names (like google.com) into machine-readable IP addresses (like 142.250.80.46)
- Your device queries a chain of DNS servers -- resolver, root, TLD, and authoritative -- to find the answer
- DNS responses are cached at every level so repeated lookups are nearly instant
The Phone Book Analogy
Imagine you want to call a friend. You know their name, but you do not have their phone number memorized.
So you open a phone book, look up their name, and find the number. That is exactly what DNS does for the
internet -- except instead of people's names and phone numbers, DNS maps domain names
(like google.com) to IP addresses (like 142.250.80.46).
Computers communicate using IP addresses -- strings of numbers that identify every device on the internet.
But humans are terrible at remembering numbers. Nobody wants to type 142.250.80.46 into their
browser every time they want to search the web. DNS lets you type google.com instead, and it
quietly translates that name into the correct IP address behind the scenes.
DNS stands for Domain Name System. It is one of the oldest and most critical pieces of internet infrastructure, running continuously since the 1980s. Without it, the web as we know it would not exist -- you would need to know the numeric address of every website you wanted to visit.
How a DNS Query Flows
When you type a URL into your browser, here is the journey your request takes through the DNS system:
Try It Yourself
Type a hostname or pick one from the dropdown, then click Resolve to see the step-by-step DNS lookup.
The whole process typically takes less than 100 milliseconds. Most of the time it is even faster because your device, your operating system, or the resolver already has the answer cached from a previous lookup.
DNS Step by Step
What DNS Does
At its core, DNS is a distributed database that maps domain names to IP addresses. When you type
google.com into your browser, your computer has no idea where that server lives. It sends a
DNS query asking "what is the IP address for google.com?" and a chain of specialized servers cooperates to
return the answer. Think of it as the internet's directory assistance -- you give it a name, it gives you a number.
A Records: The Most Common DNS Record
An A record (Address record) is the simplest type of DNS record. It says "this domain name
maps to this IPv4 address." For example, google.com A 142.250.80.46 tells the world that
Google's server can be found at that IP address. There is also an AAAA record for IPv6
addresses, which work the same way but use the longer 128-bit IPv6 format. Most websites have both an A and
an AAAA record so they are reachable from any type of connection.
How a Query Works
A DNS query follows a precise chain. First, your browser checks its own cache. If no answer is found, it asks
your operating system's stub resolver. The stub resolver checks the local cache and then
forwards the query to a recursive resolver (usually run by your ISP or a public service like
Google's 8.8.8.8 or Cloudflare's 1.1.1.1). The recursive resolver does the heavy lifting: it contacts a
root server to learn which servers handle the .com top-level domain, then asks
the .com TLD server which server is authoritative for google.com, and finally
queries that authoritative name server for the actual IP address. Each step narrows the search,
like looking up a country, then a city, then a street address.
TTL and Caching
Every DNS answer comes with a TTL (Time To Live) value, measured in seconds. The TTL tells resolvers and clients how long they can cache the answer before they must ask again. A TTL of 3600 means the record can be cached for one hour. Short TTLs (like 60 seconds) are used when IP addresses change frequently -- for example, during a server migration. Long TTLs (like 86400 seconds, or 24 hours) reduce DNS traffic and speed up lookups for stable records. Caching happens at every level: your browser, your operating system, your router, and the recursive resolver all maintain their own cache.
DNS in the Real World
DNS is involved in almost everything you do online. Here are three everyday examples:
Typing a URL
When you type github.com in your browser, a DNS A-record query finds GitHub's IP address.
Your browser then opens an HTTPS connection to that IP. This happens on every new website you visit -- dozens
of DNS lookups per hour of normal browsing.
Email and MX Records
When you send an email to [email protected], your mail server queries the MX record
(Mail Exchange) for company.com to discover which mail server handles their email. Without MX
records, email delivery across the internet would be impossible.
CDN Load Balancing
Content delivery networks such as Akamai and Amazon CloudFront use DNS to route you to a nearby server. When you look up
cdn.example.com, the authoritative DNS server checks your location and returns the IP of a
server close to you. This is called GeoDNS and it makes websites load faster worldwide.
Common DNS Mistakes
DNS is reliable, but misunderstandings can cause frustrating issues. Watch out for these:
Stale Cache
You changed your domain's IP address, but your site still points to the old server. This happens because DNS resolvers and browsers cache the previous answer until the TTL expires. Lowering the TTL before a migration (24-48 hours in advance) ensures caches clear out in time for the switch.
Wrong DNS Server
Your computer is configured to use a DNS resolver that is slow, down, or filtering results. If websites
are not loading but your internet connection works, try switching to a public resolver like
1.1.1.1 (Cloudflare) or 8.8.8.8 (Google). This is one of the most common fixes
for mysterious connectivity issues.
DNS Propagation Delays
After updating DNS records, changes do not appear instantly everywhere. Different resolvers around the world cached the old record at different times, so they expire at different times. Full propagation can take up to 48 hours in the worst case. This is normal behavior, not an error -- but it catches people off guard when they expect immediate changes.
Beyond the Basics: Other DNS Record Types
While A records are the most common, DNS supports many other record types that power different services
across the internet. CNAME records (Canonical Name) create aliases -- for example,
www.example.com might be a CNAME pointing to example.com, so both addresses
reach the same server without duplicating A records. NS records delegate authority for a
domain to specific name servers. TXT records store arbitrary text and are widely used for
email authentication (SPF, DKIM, DMARC) and domain ownership verification.
SOA records (Start of Authority) define the primary name server for a zone and control settings like how often secondary servers should check for updates. SRV records specify the host and port for specific services, used heavily by protocols like SIP and XMPP. Understanding these record types is essential for anyone managing domains, hosting websites, or troubleshooting network issues.
DNS Security: Why It Matters
Because DNS was designed in the 1980s without encryption, traditional DNS queries are sent in plain text. This means anyone on your network -- including your ISP -- can see which domains you are visiting. DNS over HTTPS (DoH) and DNS over TLS (DoT) solve this by encrypting your DNS queries, preventing eavesdropping and tampering. Most modern browsers now support DoH.
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that answers have not been forged. Without DNSSEC, an attacker could perform a DNS spoofing attack, returning a fake IP address and redirecting you to a malicious site. DNSSEC does not encrypt queries, but it does guarantee their authenticity -- complementing DoH and DoT for comprehensive DNS security.
Frequently asked questions about DNS
What does DNS stand for?
DNS stands for Domain Name System. It is the distributed directory that turns human-friendly names like example.com into the numeric IP addresses computers actually use to talk to each other.
How does a DNS query work?
Your device asks a recursive resolver for a name. The resolver walks the hierarchy: it asks a root server, then the .com (or other TLD) server, then the authoritative server for the domain. Each step narrows the search until the final answer is returned and cached for next time.
What is a DNS record?
A DNS record is an entry in a zone file that maps a name to a value. Common types include A (name → IPv4), AAAA (name → IPv6), CNAME (name → another name), MX (mail server), and TXT (free-form text used for SPF, DKIM, and verification).
What is DNS TTL?
TTL (Time To Live) is the number of seconds a resolver is allowed to cache a DNS record before re-querying the authoritative server. Long TTLs reduce load and latency; short TTLs make changes propagate faster, which matters during migrations or failover.
Why is DNS slow sometimes?
First-time lookups must traverse the hierarchy and may take 50–200ms. Subsequent lookups are usually cache hits in milliseconds. Slow DNS is most often caused by an overloaded recursive resolver, a far-away authoritative server, or a misconfigured firewall blocking UDP 53.
Try DNS resolution yourself
You just learned how DNS walks the hierarchy from root to leaf. Now open a resolver and an authoritative server, trace a lookup as the resolver forwards it, and compare the dig answers from each. Press Go Live and the same questions go to real dnsmasq servers. The lab does not model caching or TTL expiry, so those stay in the explanation above.