The Phonebook of the Internet

Computers route traffic using numbers (IP Addresses like 104.21.5.12), but humans use names (example.com). The Domain Name System (DNS) bridges this gap, translating human-readable hostnames into machine-readable IP addresses.

DNS is a massively distributed, hierarchical database. When you type https://github.com into your browser, a complex resolution process occurs in milliseconds.

The DNS Resolution Journey

  1. Browser & OS Cache: The browser checks its internal cache. If not found, it asks the Operating System. The OS checks its cache (and the hosts file).
  2. The Recursive Resolver: If the OS doesn't know, it asks your configured DNS Resolver (usually provided by your ISP, or a public one like Google 8.8.8.8 or Cloudflare 1.1.1.1).
  3. The Root Nameserver: The resolver asks a Root Server (there are 13 logical root servers globally). The Root server says, "I don't know the IP, but I know who handles .com domains. Ask them."
  4. The TLD Nameserver: The resolver asks the Top-Level Domain (TLD) server for .com. The TLD server says, "I know who handles github.com. Ask their specific nameserver."
  5. The Authoritative Nameserver: The resolver asks GitHub's authoritative nameserver (often hosted by AWS Route53 or Cloudflare). This server holds the actual DNS Records. It responds with the IP address.
  6. Return & Cache: The resolver hands the IP to your OS, which hands it to your browser, and the HTTP request finally begins. The resolver caches this answer based on the TTL (Time to Live) to speed up future requests.

Recursive vs. Iterative Queries

The resolver does the heavy lifting. Your computer asks the resolver a recursive question ("what is the IP, and don't come back until you know"). The resolver then performs iterative queries, walking from root to TLD to authoritative server step by step. Recursion is a service; iteration is the mechanics.

Common DNS Record Types

  • A Record: Maps a domain directly to an IPv4 address.
  • AAAA Record: Maps a domain directly to an IPv6 address.
  • CNAME (Canonical Name): Maps a domain to another domain name (an alias). E.g., www.example.com -> example.com.
  • MX (Mail Exchange): Specifies the mail servers responsible for accepting email on behalf of the domain.
  • TXT Record: Arbitrary text. Used heavily for domain ownership verification and email spam prevention (SPF, DKIM, DMARC).
  • NS (Nameserver): Delegates a zone to a specific nameserver.
  • SRV (Service): Points to a host and port for a specific service.

TTL and Propagation

Every record carries a Time to Live in seconds. A TTL of 300 means resolvers may cache the answer for five minutes. When you change a record, cached old answers linger until their TTL expires—this is what people mean by "propagation". Smart operators lower the TTL to 60 seconds hours before a planned migration, then raise it again once the change is verified.

DNSSEC

Because DNS was designed in the 1980s without security, it is vulnerable to DNS Spoofing/Poisoning (an attacker injecting a fake IP into a resolver's cache). DNSSEC adds cryptographic signatures to DNS records, guaranteeing that the IP address you receive hasn't been tampered with.

Encrypted DNS

Traditional DNS queries travel in plaintext over UDP port 53, visible to your ISP. Two modern transports encrypt them: DNS over HTTPS (DoH) wraps queries in HTTPS, and DNS over TLS (DoT) runs them over a dedicated TLS connection on port 853. Both prevent on-path observers from seeing or tampering with your lookups, and both are now built into major browsers and operating systems.