DNS (Domain Name System) is the hierarchical naming system that translates human-readable domain names like example.com into IP addresses like 93.184.216.34 that computers use to route network traffic. Often called “the phonebook of the internet,” DNS is fundamental infrastructure that makes the web usable.
How DNS resolution works
When you type example.com in a browser, here’s what happens:
- Browser cache: Checks if it already knows the IP.
- OS resolver: Checks the system DNS cache.
- Recursive resolver: Your ISP’s (or Cloudflare’s
1.1.1.1, Google’s8.8.8.8) DNS server takes over. - Root nameserver: Directs the resolver to the
.comTLD nameserver. - TLD nameserver: Directs to
example.com’s authoritative nameserver. - Authoritative nameserver: Returns the actual IP address.
The resolver caches the result based on the record’s TTL (Time to Live), so subsequent lookups skip most of these steps. A typical DNS lookup takes 20-120ms.
Record types
DNS stores more than just IP addresses. Common record types:
- A: Maps a domain to an IPv4 address
- AAAA: Maps a domain to an IPv6 address
- CNAME: Alias from one domain to another
- MX: Mail server for the domain
- TXT: Arbitrary text — used for SPF, DKIM, domain verification
- NS: Delegates a subdomain to a nameserver
- SOA: Start of Authority — metadata about the zone
- SRV: Service discovery (used by SIP, XMPP, etc.)
- CAA: Specifies which CAs can issue certificates for the domain
DNS and propagation
When you update DNS records, changes don’t take effect instantly. Old records remain cached by resolvers worldwide until their TTL expires. “DNS propagation” typically takes minutes to 48 hours depending on the TTL of the old record. Lower the TTL before making changes, wait for the old TTL to expire, then make the change.
Security concerns
Standard DNS is unencrypted — anyone between you and the resolver can see (and potentially modify) your queries. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries to the resolver. DNSSEC adds cryptographic signatures to DNS responses, preventing spoofing, but adoption is still incomplete.
DNS hijacking, cache poisoning, and DNS-based DDoS amplification are real threats. Running your own resolver or using a trusted provider (Cloudflare, Quad9) mitigates some risks.
Look up DNS records with the DNS Lookup tool, browse record types with the DNS Record Types Reference, or check domain ownership with the WHOIS Lookup.