domain resolution - UnderTheHood IT

Understanding what is DNS and how it works is essential to understanding how the internet functions at all.

Every time you type a website name into your browser, send an email, or open an app, DNS is the first system that must respond before anything else can happen.

This guide explains what DNS is and how it works from the ground up — covering domain names, root servers, resolvers, caching, performance, security, and why DNS is one of the most critical pieces of global internet infrastructure.

DNS Is the Internet’s Phone Book — But Smarter

Every time you visit a website, send an email, or open an app, one system quietly runs first.

Before data can move, before servers can respond, before anything loads, DNS must work.

DNS — the Domain Name System — is what allows humans to use names like:

google.com
netflix.com
example.org

Instead of raw numerical IP addresses.

Without DNS:

The internet would still function
But only for machines
And only for people willing to memorize numbers

DNS is not just a convenience layer.
It is core internet infrastructure.

This article explains DNS from first principles:

What DNS actually is
Why it exists
How resolution works step by step
Where performance and failures come from
How modern DNS scales globally
Why DNS is also a security boundary

What DNS Actually Is

At its core, DNS is a distributed, hierarchical naming system.

It answers one fundamental question:

“Given a human-readable name, what network address does it map to right now?”

DNS maps:

Domain names → IP addresses
Services → locations
Human intent → machine routing

It does this without central control, at global scale.

DNS Is Not a Database

A common misconception is that DNS is a single global database.

It is not.

Instead, DNS is:

Distributed across many servers
Delegated by hierarchy
Cached aggressively
Updated continuously

No single system “knows” all DNS answers.

DNS Is a Translation System

DNS does not deliver content.
It does not route packets.
It does not host websites.

DNS only tells you where to go next.

Everything else depends on that answer.

Why DNS Exists

To understand DNS, you need to understand the problem it solves.

Machines Prefer Numbers

Networks route data using IP addresses.

An IP address:

Identifies a device or service
Is efficient for machines
Is terrible for humans

Example:

142.250.190.14 means nothing to most people

Humans Prefer Names

Humans think in:

Brands
Words
Meaningful labels

DNS bridges this gap by allowing:

Stable names
Changing addresses
Decoupling identity from location

This decoupling is critical.

Why Hardcoding Addresses Doesn’t Work

Without DNS:

Changing servers would break links
Load balancing would be impossible
Failover would be manual
Global scale would collapse

DNS enables flexibility at internet scale.

Domain Names Explained

A domain name is a structured identifier.

Example:

www.example.com

Each part has meaning.

Reading a Domain Name Right to Left

Domains are read from right to left, not left to right.

www → subdomain example → domain .com → top-level domain (TLD)

The rightmost part is the highest level.

This hierarchy is the backbone of DNS.

Why This Hierarchy Matters

Hierarchy allows:

Delegation of control
Distributed responsibility
Independent administration

No single entity owns all domains.

The DNS Hierarchy: Who Answers What

DNS resolution works by walking down the hierarchy, not up.

There are four major levels.

1. Root Level

At the top is the DNS root.

The root:

Knows where TLDs are
Does not know individual domains
Is extremely stable

There are only 13 logical root server identities, distributed globally.

2. Top-Level Domains (TLDs)

TLDs include:

.com
.org
.net
.io
Country codes like .uk, .de

TLD servers:

Know where domains are registered
Do not know subdomains

3. Authoritative Name Servers

These servers:

Are responsible for a specific domain
Contain the actual DNS records
Provide definitive answers

This is where truth lives.

4. Recursive Resolvers

Resolvers:

Perform lookups on behalf of users
Cache results
Speed up future queries

Your ISP or device typically uses a resolver.

What Is DNS and How It Works DNS Resolution: Step-by-Step

Let’s walk through what happens when you type:

example.com

Step 1: Local Cache Check

Before asking the internet, your device checks:

Browser cache
OS cache
Local DNS cache

If found, resolution stops here.

Step 2: Recursive Resolver Query

If not cached, your device asks a recursive resolver:

“Do you know the IP for example.com?”

If the resolver knows, it answers immediately.

Step 3: Root Server Query

If not, the resolver asks a root server:

“Who handles .com?”

The root replies with:

“Ask these .com servers.”

Step 4: TLD Server Query

The resolver asks a .com server:

“Who handles example.com?”

The TLD replies with:

“Ask these authoritative servers.”

Step 5: Authoritative Server Query

The resolver asks:

“What is the IP for example.com?”

The authoritative server replies with the answer.

Step 6: Caching and Return

The resolver:

Caches the answer
Returns it to your device

Only then does your browser connect to the server.

What Is DNS and How It Works DNS Records: What DNS Actually Stores

DNS doesn’t store “websites.”
It stores records.

Each record answers a specific question.

A Records and AAAA Records

A → IPv4 address
AAAA → IPv6 address

These map names to IPs.

CNAME Records

CNAME means:

“This name is an alias for another name.”

Used for:

Load balancing
Service abstraction
Infrastructure flexibility

MX Records

MX records specify:

Mail servers
Email routing priority

Without MX records, email doesn’t work.

TXT Records

TXT records store:

Verification data
Security policies
Metadata

They are heavily used in modern security systems.

What Is DNS and How It Works Caching: Why DNS Is Fast

DNS would be unusably slow without caching.

Caching happens at:

Browser level
OS level
Resolver level
ISP level

TTL (Time To Live)

Every DNS record includes a TTL.

TTL controls:

How long a result is cached
How quickly changes propagate
The trade-off between freshness and performance

Low TTL:

Faster updates
More queries

High TTL:

Better performance
Slower changes

Why DNS Failures Are So Disruptive

When DNS fails:

Websites appear offline
Apps stop working
Services seem “down”

Even when servers are fine.

DNS is a single dependency with global impact.

What Is DNS and How It Works DNS Performance: Why Resolution Is Usually Fast

At first glance, DNS resolution looks slow.

One lookup appears to involve:

Multiple servers
Multiple round trips
Global communication

Yet in practice, DNS lookups usually take milliseconds.

That speed comes from aggressive caching and smart distribution.

Where DNS Caching Happens

DNS answers are cached at many layers:

Browser cache
Operating system cache
Local network cache (router)
Recursive resolver cache
ISP cache

Most DNS queries never leave your local network.

DNS requests are also important in secure networking systems such as VPN connections, where DNS traffic may be routed through encrypted tunnels.

Why Most DNS Queries Never Reach Root Servers

Root servers only see a tiny fraction of total DNS traffic.

This is because:

TLD answers are cached
Authoritative answers are cached
Resolvers reuse answers across many users

The hierarchy is designed to push load downward, not upward.

Cold vs Warm DNS Lookups

Cold lookup: Nothing cached → full resolution path
Warm lookup: Cached answer → instant response

Most user experiences rely on warm lookups.

What Is DNS and How It Works Latency in DNS: What Actually Slows It Down

When DNS feels slow, it’s rarely because of DNS itself.

Common causes include:

Poorly located resolvers
Network congestion
High-latency last-mile connections
Misconfigured TTL values

DNS adds overhead — but it’s usually not the bottleneck.

Why Distance Still Matters

DNS resolution involves round trips.

Physical distance affects:

Time to root servers
Time to authoritative servers
Time to resolvers

This is why global DNS infrastructure focuses heavily on geographic distribution.

What Is DNS and How It Works Anycast: How DNS Scales Globally

One of the most important — and least understood — DNS technologies is anycast.

What Anycast Is

Anycast allows:

Many servers
In many locations
To share the same IP address

When you query that IP:

The network routes you to the nearest available server
Based on routing topology, not geography

Why Anycast Is Perfect for DNS

DNS traffic:

Is read-heavy
Is stateless
Can tolerate some inconsistency

Anycast enables:

Low latency
High redundancy
Massive scalability

This is how a small number of logical servers handle billions of queries per day.

What Is DNS and How It Works Authoritative DNS vs Recursive DNS

It’s important to distinguish between two very different DNS roles.

Authoritative DNS Servers

These servers:

Hold the official records
Answer definitively
Are controlled by the domain owner

They do not cache answers from others.

Recursive DNS Resolvers

These servers:

Act on behalf of users
Perform full resolution
Cache results aggressively

They trade freshness for speed.

Why This Separation Matters

Separating roles:

Improves scalability
Limits blast radius
Enables independent optimization

DNS is resilient because no single server type does everything.

DNS and Load Balancing

DNS is often used as a traffic steering mechanism.

Simple Load Balancing

DNS can return:

Different IPs
In different orders
Based on location or policy

This spreads load across servers.

Geographic Routing

DNS can direct users to:

The nearest data center
The lowest-latency region
A region with spare capacity

This improves performance and reliability.

Limitations of DNS Load Balancing

DNS decisions are:

Cached
Slow to change
Blind to real-time server health

This is why DNS is often combined with:

CDNs
Load balancers
Health checks

What Is DNS and How It Works DNS and Content Delivery Networks (CDNs)

DNS plays a critical role in how CDNs work.

How DNS Enables CDNs

When you request content:

DNS directs you to a CDN domain
The CDN’s DNS system evaluates your location
You receive an IP for a nearby edge node

This all happens before any content is requested.

Why DNS Is the First Decision Point

DNS decides:

Which network you hit
Which region serves you
Which cache layer responds

By the time HTTP begins, the path is already chosen.

DNS as an Optimization Layer

Modern DNS systems:

Integrate performance data
Adapt to network conditions
Shift traffic dynamically

DNS is no longer just naming — it’s traffic intelligence.

DNS Security: Why Naming Is a Target

Because DNS sits at the front of every connection, it is a high-value attack surface.

DNS Spoofing and Cache Poisoning

Attackers may try to:

Inject fake DNS answers
Redirect users to malicious servers
Intercept traffic

This is called DNS poisoning.

It works by exploiting trust in cached answers.

Man-in-the-Middle Attacks

If DNS is compromised:

Users can be redirected
Even if websites themselves are secure

This makes DNS a critical link in the security chain.

Why DNS Was Vulnerable Historically

DNS was designed:

Before widespread security threats
Without built-in authentication
With implicit trust between servers

Security had to be added later.

What Is DNS and How It Works DNSSEC: Securing DNS Answers

DNSSEC (DNS Security Extensions) addresses DNS authenticity.

What DNSSEC Does

DNSSEC allows resolvers to:

Verify that DNS answers are genuine
Detect tampering
Reject forged responses

It uses:

Cryptographic signatures
Chains of trust
Public key verification

What DNSSEC Does NOT Do

DNSSEC does not:

Encrypt DNS queries
Hide which domains you visit
Prevent all attacks

It ensures integrity, not privacy.

What Is DNS and How It Works DNS Privacy: Who Sees Your Queries

Traditional DNS is sent:

In plaintext
To your resolver
Over the network

This means DNS queries can be observed by:

ISPs
Network operators
Intermediaries

DNS reveals intent, even when content is encrypted.

Encrypted DNS (DoH and DoT)

Modern approaches include:

DNS over HTTPS (DoH)
DNS over TLS (DoT)

These encrypt DNS queries in transit.

Privacy Trade-Offs

Encrypted DNS:

Improves privacy
Centralizes trust
Shifts power to resolver providers

Privacy gains come with new dependencies.

What Is DNS and How It Works DNS and Tracking

DNS can be used for tracking and attribution.

Examples include:

Unique subdomains per user
Short-lived DNS records
Correlating query timing

DNS-based tracking is:

Indirect
Hard to block
Often invisible to users

This makes DNS both powerful and sensitive.

Operational DNS Failures

DNS failures tend to be systemic, not isolated.

Common causes:

Configuration errors
Expired domains
Registrar mistakes
Mis-set TTLs
DDoS attacks on DNS infrastructure

Because DNS is upstream of everything, failures propagate widely.

Why DNS Changes Feel Slow

When you change DNS:

Old records persist due to caching
Different resolvers update at different times
Global consistency takes time

This is not a flaw — it’s a consequence of scale.

Modern DNS Trends

DNS continues to evolve.

Key trends include:

More encryption by default
Smarter traffic steering
Integration with security systems
Edge-aware resolution
Greater regulatory scrutiny

Despite changes, the core model remains intact.

Mental Models for Understanding DNS

To reason clearly about DNS, keep these in mind:

DNS is distributed, not centralized
Caching is the reason DNS scales
DNS answers “where,” not “what”
Security and privacy are separate concerns
DNS failures are disproportionately visible

What Is DNS and How It Works Frequently Asked Questions

Is DNS required for the internet to work?
Yes — for humans. Machines can use IPs directly, but almost no systems do.

Can DNS be bypassed?
Technically yes, practically no at scale.

Why does DNS take time to update?
Because caching is necessary for performance and resilience.

Is changing DNS servers safe?
Usually, but it changes who you trust with your queries.

What Is DNS and How It Works Conclusion: What DNS Really Does

DNS is often described as the internet’s phone book.

That analogy understates its importance.

DNS is:

A global coordination system
A performance optimization layer
A security boundary
A privacy consideration
A critical dependency for almost everything online

Every click begins with DNS.

When DNS works, no one notices.
When DNS fails, everything breaks.

Understanding what DNS is and how it works reveals just how much of the internet depends on one quiet, distributed system doing its job perfectly, billions of times per day.

What Is DNS and How It Works Deep Dive: DNS Failure Modes and Recovery Patterns

DNS failures are uniquely disruptive because everything depends on them. When DNS breaks, the internet appears broken—even if servers and networks are healthy.

Understanding failure patterns is the key to designing resilient DNS.

Failure Mode 1: Configuration Errors

The most common DNS outages are self-inflicted.

Examples:

Typo in a record
Incorrect IP address
Missing record
Wrong TTL value
Broken delegation to name servers

Why this is dangerous:

DNS changes propagate globally
Caching amplifies mistakes
Rollbacks are slow

Recovery strategies

Staged rollouts with low TTLs
Change validation and linting
Dual-provider DNS (where feasible)
Explicit delegation checks

Failure Mode 2: Expired Domains

When a domain expires:

DNS stops resolving
Email fails
Services disappear instantly

This failure is:

Sudden
Public
Preventable

Recovery strategies

Auto-renewal at registrars
Multiple administrative contacts
Domain expiration monitoring

Failure Mode 3: DNS Provider Outages

Even highly reliable DNS providers can fail.

Causes include:

Software bugs
Control plane failures
DDoS attacks
Misrouted traffic

Because DNS is centralized per domain, provider outages can be catastrophic.

Recovery strategies

Secondary DNS providers
Anycast diversification
Split-horizon DNS (advanced)
Regular failover testing

Failure Mode 4: DDoS Attacks on DNS

DNS is a common DDoS target because:

It’s publicly reachable
It’s essential
Small queries can amplify traffic

Recovery strategies

Anycast distribution
Rate limiting
Response caching
DDoS mitigation services

DNS in Enterprise Environments

Enterprise DNS is more complex than public DNS.

It must handle:

Internal services
Private networks
Split-horizon resolution
Security policies
Compliance requirements

Internal vs External DNS

Enterprises often maintain:

Internal DNS for private resources
External DNS for public-facing services

The same domain name can resolve differently depending on:

Network location
User identity
Security context

This is called split-horizon DNS.

Why Enterprises Rely Heavily on DNS

DNS is used for:

Service discovery
Failover
Microservice routing
Policy enforcement

In many organizations, DNS becomes a control plane, not just a naming system.

Operational Risks in Enterprise DNS

Risks include:

Shadow DNS changes
Manual configuration drift
Poor documentation
Overlapping namespaces

Enterprises mitigate this with:

Infrastructure-as-code
Change management
Observability and logging

DNS in Cloud Environments

Cloud computing has reshaped DNS usage.

Dynamic Infrastructure Changes

In the cloud:

Servers are ephemeral
IPs change frequently
Scaling happens automatically

DNS enables:

Stable naming
Service abstraction
Dynamic routing

Without DNS, elastic infrastructure would be unmanageable.

Service Discovery via DNS

Cloud systems often use DNS to:

Locate services
Balance load
Enable zero-config communication

Examples include:

Database endpoints
Internal APIs
Regional services

DNS becomes the glue that holds microservices together.

Private DNS Zones

Cloud providers support:

Private DNS zones
Isolated name resolution
Network-scoped visibility

This allows:

Security isolation
Clean internal naming
Reduced attack surface

Advanced DNS + CDN Interaction Patterns

DNS and CDNs work together in increasingly sophisticated ways.

Real-Time Traffic Steering

Modern DNS systems integrate:

Latency measurements
Regional health checks
Capacity signals

DNS responses adapt based on:

User location
Network congestion
Backend availability

This happens before any content is fetched.

Failover and Disaster Recovery

DNS enables:

Regional failover
Traffic draining
Disaster recovery routing

When a data center fails:

DNS redirects new traffic
Existing connections may degrade gracefully

DNS is the first lever in large-scale incident response.

Multi-CDN Strategies

Some organizations use:

Multiple CDNs
DNS-based traffic splitting
Performance-based routing

This reduces:

Vendor lock-in
Outage impact
Regional performance variance

DNS becomes a meta-load-balancer.

DNS Observability and Monitoring

Because DNS issues are invisible until they’re catastrophic, monitoring is essential.

Key signals include:

Query latency
Error rates
NXDOMAIN spikes
TTL behavior
Resolver diversity

Modern systems treat DNS as critical infrastructure, not plumbing.

DNS and Regulation

DNS increasingly intersects with policy.

Examples:

Domain takedowns
Government-mandated blocking
ISP-level filtering
Jurisdictional control

Because DNS is upstream of content, it is a powerful control point.

This raises questions about:

Censorship
Neutrality
Governance

Why DNS Is Hard to Replace

Many attempts have been made to “improve” DNS.

They fail because DNS is:

Deeply embedded
Backward compatible
Globally coordinated
Simple at its core

Any replacement must:

Interoperate with DNS
Migrate gradually
Preserve reliability

So far, nothing has met those constraints.

What Is DNS and How It Works Common DNS Myths (Debunked)

Myth: DNS is centralized
Reality: It is distributed by design.

Myth: DNS just maps names to IPs
Reality: It’s a control layer for traffic, performance, and availability.

Myth: DNS changes are instant
Reality: Caching is necessary for scale.

Myth: DNS is simple
Reality: The concept is simple; the system is not.

Mental Models for Mastering DNS

To truly understand DNS, keep these models in mind:

DNS is a hierarchy of responsibility
Caching is the reason DNS works at scale
DNS answers “where,” not “what”
DNS failures amplify globally
DNS is both infrastructure and policy

These models help explain both behavior and failure.

Frequently Asked Questions About What Is DNS and How It Works

Can DNS be encrypted completely?
Queries can be encrypted in transit, but destination intent is still revealed eventually.

Why does DNS still use UDP?
Because it’s fast, simple, and sufficient for most queries.

Is DNSSEC widely used?
Adoption is growing, but uneven due to operational complexity.

Who controls the root DNS servers?
They are operated by multiple independent organizations under shared governance.

Final System-Level Synthesis

DNS works because it embraces a few powerful ideas:

Hierarchy instead of centralization
Caching instead of real-time coordination
Delegation instead of ownership
Redundancy instead of perfection

Every DNS query is a small act of global cooperation.

That cooperation scales to:

Billions of users
Trillions of queries
Constant change
Frequent failure

And yet, it mostly just works.

Conclusion: What DNS Really Is

DNS is often described as the internet’s phone book.

In reality, it is:

A global coordination system
A performance accelerator
A security boundary
A policy lever
A hidden dependency for everything online

Every website visit begins with DNS.
Every outage reminds us how much depends on it.

Understanding what DNS is and how it works reveals not just how the internet finds things—but how the internet holds itself together.

External references

RFC 1034 — Domain Names: Concepts and Facilities — The foundational specification describing the DNS model and concepts.
RFC 1035 — Domain Names: Implementation and Specification — The core DNS protocol and message format specification.