When you type a domain name into a browser, you normally think about the website that appears. The network has to solve a different problem first: it needs to discover where that name points.
That is the job of the Domain Name System (DNS). DNS provides a distributed naming system that lets applications use domain names and retrieve information associated with those names, including IP addresses. The result is a bridge between human-readable names and the network information used to reach services.
DNS translates a domain name into DNS records that tell a client or resolver where and how a service can be reached.
For a typical website, a browser needs an IP address before it can establish the network connection to the server. A DNS resolver looks for the requested record, using cached information when available or querying the DNS hierarchy when it is not. The authoritative DNS server for the domain ultimately provides the records for that zone.
- What DNS actually does and why domain names exist.
- The difference between a resolver, recursive DNS server, and authoritative DNS server.
- How a DNS lookup travels through the hierarchy.
- What A, AAAA, CNAME, NS, and TTL mean.
- How to inspect DNS records safely from Linux, macOS, or Windows.
- Why DNS problems can make a perfectly healthy server appear unreachable.
- 🌐 What Is DNS?
- 🧩 Why Do We Need DNS?
- Human-friendly
- Flexible
- Distributed
- 🔍 The Four Pieces You Should Know
- 1. Stub Resolver
- 2. Recursive Resolver
- 3. Authoritative Name Server
- 4. DNS Zone
- 🔄 What Happens During a DNS Lookup?
- The application needs a name resolved
- The resolver checks available information
- The DNS hierarchy is followed when necessary
- The authoritative server provides the record
- The resolver returns the result
- 🌳 The DNS Hierarchy: Root, TLD, and Domain
- 📋 Common DNS Record Types
- ⏱️ What Is DNS TTL?
- 📡 Does DNS Use UDP or TCP?
- 🔐 Is DNS Secure?
- 🧪 Mini Lab: Inspect DNS from Your Own Computer
- ⚠️ Common Mistakes Beginners Make
- 💡 Academy Insight: DNS Is Not the Connection
- 🔍 A Simple DNS Troubleshooting Method
- 📚 DNS in the Larger Server Stack
🌐 What Is DNS?
DNS is the Domain Name System, a distributed system for storing and retrieving information associated with domain names.
The easiest way to understand DNS is to compare it with a contact list. A person can remember a name more easily than a long numeric address. In networking, applications can use a domain name while DNS provides the information needed to locate the corresponding service.
For example, a user might enter:
example.comThe browser does not send that text directly as an IP packet destination. A DNS lookup can return an address record such as an IPv4 address or IPv6 address, after which the application can continue with the appropriate network connection.
DNS is not itself the website, web server, or IP network. It is a separate naming and information system that helps applications discover information about names.
🧩 Why Do We Need DNS?
People work naturally with names. Network protocols need structured addressing information.
Without DNS, users could still reach network services by entering IP addresses directly. That would make changing infrastructure, using multiple addresses, and maintaining readable service names much harder.
Human-friendly
People can use names such as example.com instead of remembering numeric network addresses.
Flexible
DNS records can change while the domain name remains the same.
Distributed
DNS data is divided across a hierarchy of zones and name servers rather than stored in one global database.
This distributed design is one of the fundamental ideas behind DNS. Different parts of the namespace can be managed independently while resolvers retrieve the information they need.
🔍 The Four Pieces You Should Know
Several DNS terms are often mixed together. Keeping their roles separate makes the whole system much easier to understand.
1. Stub Resolver
A device or operating system typically has a local resolver component that receives DNS requests from applications. It knows which DNS server or resolver it should use, but it does not necessarily contain the complete DNS hierarchy.
2. Recursive Resolver
A recursive resolver answers DNS questions on behalf of clients. It can use its cache or perform additional queries to obtain the required information.
This is often the DNS server your computer or network is configured to use.
3. Authoritative Name Server
An authoritative name server holds authoritative DNS data for one or more zones. If it is responsible for a zone containing a domain’s records, it can provide the records for names in that zone.
4. DNS Zone
A zone is an administratively managed portion of the DNS namespace containing resource records. The zone is served by authoritative name servers.
Do not think of DNS as one giant server. Think of it as a distributed database and lookup system. A recursive resolver may know the answer because it cached it earlier, or it may need to follow the DNS hierarchy to find authoritative information.
🔄 What Happens During a DNS Lookup?
Consider a client that needs to resolve a domain name such as example.com.
The exact path can vary because cached information may eliminate some of these steps. But the basic model is useful for understanding how DNS works.
The application needs a name resolved
A browser or another application needs information associated with a domain name. The request is passed to the local DNS resolution mechanism.
The resolver checks available information
A recursive resolver can first check its cache. If a valid cached answer exists, it may return the result without querying the DNS hierarchy again.
The DNS hierarchy is followed when necessary
If the resolver does not already have the required information, it can query DNS servers that lead it toward the authoritative information for the requested domain.
The authoritative server provides the record
The authoritative server for the relevant zone can return the requested resource record or information indicating that the requested name or record does not exist.
The resolver returns the result
The recursive resolver sends the result back to the client and can cache the information according to its DNS caching rules and the record’s TTL.
🌳 The DNS Hierarchy: Root, TLD, and Domain
DNS names are organized hierarchically.
Take the domain:
www.example.comAt the top is the DNS root. Below it are top-level domains, such as .com. Under a top-level domain are domains such as example.com, which can then contain names such as www.example.com.
The root zone contains delegations for top-level domains. The TLD infrastructure can then direct DNS queries toward the authoritative name servers responsible for a particular domain.
This hierarchy is important because no single DNS server needs to maintain the complete set of records for every domain on the Internet.
📋 Common DNS Record Types
DNS does not only store IP addresses. It stores different types of resource records, each describing a particular kind of information.
| Record | Purpose | Simple example |
|---|---|---|
| A | Maps a name to an IPv4 address. | example.com → IPv4 address |
| AAAA | Maps a name to an IPv6 address. | example.com → IPv6 address |
| CNAME | Creates an alias from one domain name to another domain name. | www.example.com → another name |
| NS | Identifies authoritative name servers for a zone or delegated domain. | example.com → authoritative DNS server names |
| MX | Specifies mail exchange information for a domain. | example.com → mail server name |
| TXT | Stores text data associated with a DNS name. | example.com → text value |
For a beginner, the most important distinction is between A, AAAA, and CNAME.
An A record contains an IPv4 address. An AAAA record contains an IPv6 address. A CNAME does not directly contain an IP address; it points one DNS name at another DNS name.
⏱️ What Is DNS TTL?
TTL means Time to Live. In DNS, it specifies the maximum time a cached resource record can remain valid for caching purposes.
For example, a DNS response might contain a record with a TTL value. A recursive resolver can cache that record and use it until the TTL expires, subject to the resolver’s own policies.
This is why changing a DNS record does not necessarily mean every resolver immediately starts returning the new value.
Changing a DNS record does not instantly replace every cached answer. Resolvers may still have an earlier response in cache until its applicable TTL expires. DNS propagation is therefore better understood as a combination of authoritative changes and cache expiration, rather than a single global switch.
📡 Does DNS Use UDP or TCP?
DNS supports both UDP and TCP transport. Traditional DNS queries commonly use UDP because it has low protocol overhead, while TCP is also a required part of full DNS implementations and is used in situations where TCP is appropriate.
For example, larger DNS responses and some DNS operations can require TCP. DNS-over-TLS also uses TCP as part of its secure transport, while DNS-over-HTTPS carries DNS messages through HTTPS.
For a beginner, the key point is simple: DNS is an application-layer system, and its messages can be transported using different protocols depending on how DNS is being used.
🔐 Is DNS Secure?
Basic DNS resolution and DNS security are separate concepts.
DNSSEC adds mechanisms for data origin authentication and integrity of DNS data. It allows validating resolvers to verify cryptographic signatures associated with DNS records.
DNSSEC does not provide confidentiality. In other words, DNSSEC is designed to help determine whether DNS data is authentic and has not been altered, not to hide the DNS query itself.
There are also encrypted DNS transports such as DNS over TLS and DNS over HTTPS. These address privacy of the communication channel between a DNS client and resolver, which is a different problem from DNSSEC’s data-authentication role.
| Technology | Main purpose | What it does not mean |
|---|---|---|
| DNS | Name resolution and DNS data retrieval | Not automatically encrypted |
| DNSSEC | DNS data origin authentication and integrity | Does not provide query confidentiality |
| DNS over TLS | Encrypts DNS communication using TLS | Does not replace DNSSEC’s data-validation role |
| DNS over HTTPS | Carries DNS queries and responses through HTTPS | Does not make the DNS hierarchy itself disappear |
🧪 Mini Lab: Inspect DNS from Your Own Computer
Goal: See DNS records yourself and connect the theory to an actual lookup.
dig example.com ALook for the answer section. An A record contains an IPv4 address associated with the queried name.
dig example.com AAAAThis asks specifically for IPv6 address records. If no AAAA record is returned, that does not necessarily mean DNS is broken; the name may simply have no AAAA record.
dig example.com NSThis asks for NS records associated with the domain. These records identify name servers responsible for the domain’s authoritative DNS information.
nslookup example.comnslookup is another commonly available DNS diagnostic utility. Compare its output with the information returned by dig.
Safety: These commands only perform DNS lookups. They do not change DNS configuration or modify your server.
⚠️ Common Mistakes Beginners Make
A registrar handles domain registration and related administrative functions. DNS is the technical system that stores and retrieves information associated with domain names. The two can be provided by the same company, but they are different functions.
A recursive resolver and an authoritative name server have different jobs. A recursive resolver finds answers for clients and may cache them; an authoritative server serves authoritative data for the zones it hosts.
An A record contains an IPv4 address. A CNAME points one DNS name to another DNS name. Confusing the two can lead to incorrect DNS configurations.
Caching means that resolvers can continue using previously retrieved data until its applicable TTL expires. The authoritative record may already be changed while some clients still see older information.
DNS only provides naming information. A correct DNS answer does not prove that the destination server is reachable, that the required port is open, or that the application itself is healthy.
💡 Academy Insight: DNS Is Not the Connection
One of the most useful mental models for server troubleshooting is to separate name resolution from network connectivity.
DNS can successfully return an IP address while TCP connections to that address fail. Conversely, a server can be perfectly healthy while users cannot reach it because its DNS records are missing or incorrect.
When troubleshooting a website, think in layers: Does the name resolve? → Does the network route exist? → Is the destination port reachable? → Is the service responding?
🔍 A Simple DNS Troubleshooting Method
When a domain appears to be broken, avoid changing several things at once. First determine which layer is actually failing.
- Check the DNS answer. Does the domain return the expected A or AAAA record?
- Check the authoritative information. Are the expected authoritative name servers associated with the domain?
- Check caching. Could the resolver still be returning an older cached record?
- Check connectivity separately. If DNS returns an address, test whether the relevant service can actually be reached.
- Check the application. If networking works, investigate the web server or other application listening behind the DNS name.
This approach prevents a common troubleshooting mistake: treating every website outage as a DNS problem simply because the browser displays a connection error.
📚 DNS in the Larger Server Stack
DNS becomes much easier to understand when you place it beside the concepts you already know.
DNS answers the naming question. IP provides the network address. A port identifies a service endpoint on the host. The application protocol then determines how the client and service communicate.
This separation is fundamental to server administration. When something fails, identifying which layer owns the problem is often more useful than immediately changing configuration.
In short: DNS is a distributed naming and information system. A client asks a resolver for information about a name. The resolver can use cached data or obtain the answer through the DNS hierarchy, eventually reaching authoritative data for the relevant zone.
For server work, remember the most important record types first: A for IPv4, AAAA for IPv6, CNAME for aliases, and NS for authoritative name-server information. TTL controls how long DNS data can remain cached.
- Why does a browser need DNS before it can normally establish a connection to a website by domain name?
- What is the difference between a recursive resolver and an authoritative DNS server?
- If a DNS record has changed but a client still receives the old value, what is one likely explanation?
- What is the difference between an A record and an AAAA record?
- Why does a successful DNS lookup not prove that a web server is healthy?
- What problem does DNSSEC solve, and why is it different from encrypted DNS transport?
🎓 Check Your Answers
- DNS provides information associated with the domain name, commonly including an IP address. The client can then use that network address when establishing the connection to the service.
- A recursive resolver finds answers on behalf of clients and can cache the results. An authoritative server serves authoritative DNS data for the zones it is responsible for, so its role is to provide the source data rather than perform general resolution for every Internet name.
- The resolver may still have the previous record cached. DNS TTL controls the maximum caching lifetime of a record, so different resolvers or clients can temporarily see older information after an authoritative change.
- An A record contains an IPv4 address, while an AAAA record contains an IPv6 address. They provide address information for different IP versions.
- DNS only answers a naming question. Even if the correct IP address is returned, the destination may have routing problems, a blocked port, a stopped service, or an application failure. DNS and application health are separate layers.
- DNSSEC provides mechanisms for authenticating the origin and integrity of DNS data. Encrypted DNS transports such as DNS over TLS or DNS over HTTPS protect the communication channel between a DNS client and resolver; they address privacy rather than replacing DNSSEC’s data-validation function.
DNS is the system that connects names with information about network services. A domain name is not itself an IP address; DNS provides records that let a resolver discover where and how the corresponding service can be reached.
The most useful mental model is name → DNS lookup → IP information → network connection → service. Keeping those layers separate will make both server administration and troubleshooting much easier.
