What is DNS?
The Domain Name System (DNS) is the internet's distributed directory service. When you type example.com into your browser, DNS is responsible for translating that name into an IP address — the numeric address computers use to communicate.
Without DNS you would need to remember that Google is at 142.250.66.78. DNS makes the web human-readable.
How DNS Resolution Works
DNS is hierarchical. At the top are root nameservers, then top-level domain (TLD) servers like .com or .net, then authoritative nameservers for each domain.
When you visit a domain for the first time, the resolution process looks like this:
- Your browser checks its local cache. If the record is still valid, it uses it immediately.
- If not cached, it asks your operating system's resolver (usually your router or ISP's DNS server).
- Your resolver asks a root nameserver: "Who handles
.com?" - The root server replies with the address of the
.comTLD nameserver. - Your resolver asks the TLD server: "Who is authoritative for
example.com?" - The TLD server replies with the authoritative nameserver for
example.com. - Your resolver asks that nameserver for the A record. It returns the IP address.
- Your browser connects. The result is cached according to the record's TTL.
This entire chain typically completes in under 50 milliseconds.
DNS Record Types
DNS is not just IP address lookup. Different record types serve different purposes:
| Type | Purpose | Example value |
|---|---|---|
| A | Maps a hostname to an IPv4 address | 93.184.216.34 |
| AAAA | Maps a hostname to an IPv6 address | 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME | Alias — points to another hostname | www → example.com |
| MX | Mail server for the domain | 10 mail.example.com |
| TXT | Arbitrary text (SPF, DKIM, verification) | v=spf1 include:… -all |
| NS | Authoritative nameservers for the domain | ns1.example.com |
| CAA | Permitted certificate authorities | 0 issue "letsencrypt.org" |
TTL — Time to Live
Every DNS record has a TTL value in seconds. This tells resolvers how long to cache the answer before re-querying. A TTL of 3600 means the cached answer is valid for one hour.
Practical tip: if you are planning a DNS change (moving a site to a new host, changing MX records), reduce the TTL to 300 seconds a day in advance. When you make the change, it will propagate worldwide within minutes instead of hours.
DNS Security
Standard DNS queries are sent in plain text over UDP port 53. This creates two problems: anyone on the network path can see what domains you are looking up, and responses can be forged.
- DNSSEC — Adds cryptographic signatures to DNS records. Resolvers can verify the response is authentic and has not been tampered with. The downside is complexity: misconfigured DNSSEC is a common cause of domains going unreachable.
- DNS over HTTPS (DoH) — Wraps DNS queries inside regular HTTPS traffic. Prevents ISPs and network operators from monitoring which domains you look up. This site uses Cloudflare's DoH endpoint for all DNS lookups.
- DNS over TLS (DoT) — Same privacy benefit as DoH, but uses a dedicated TCP port (853) instead of blending with HTTPS traffic.
- CAA records — Restrict which certificate authorities are permitted to issue TLS certificates for your domain. A site with a properly configured CAA record is significantly harder to mis-issue certificates for.
Common DNS Troubleshooting
When a domain is not resolving as expected, check these in order:
- NS records — Are the authoritative nameservers what you expect? If you recently moved DNS providers, NS records may still be in propagation.
- TTL — Is the old value still being served from cache? Check both your local resolver and a public resolver like 1.1.1.1.
- A / AAAA — Does the record point to the correct IP? Cross-check with your hosting provider's expected address.
- MX records — If email is the issue, verify the MX record points to the correct mail server and the priority values make sense.