How DNS Works
BeginnerDNS — the Domain Name System — is the internet's phone book. Every website has a numeric IP address like 104.21.33.72, but humans use names like "google.com". DNS is the system that translates one into the other. Every time you visit a website, a DNS lookup happens in the background — usually in under 50 milliseconds — before your browser can even start loading the page.
Think of it like calling directory assistance
Before smartphones, you would call directory assistance and say "I want to reach Pizza Hut on Main Street" and an operator would find the phone number for you. DNS does exactly this — you ask for "google.com" and DNS finds the IP address. Like a good phone book, it also caches popular numbers so you don't have to ask every time.
Step by Step
Key Concepts
DNS Record (A Record)
The most common DNS record type. An A record maps a domain name to an IPv4 address. For example: google.com → 142.250.195.46.
Recursive Resolver
A DNS server that does the full lookup chain on behalf of your device. It queries root → TLD → authoritative nameservers and caches the result. Run by ISPs, Google, Cloudflare, and others.
Root Nameserver
There are 13 root nameserver IP addresses at the top of the DNS hierarchy. They don't store domain records directly — they redirect queries to the right TLD server (e.g., .com, .in, .org).
TLD Nameserver
Top-Level Domain servers manage a specific domain extension. The .com TLD server knows which authoritative nameserver handles every .com domain registered in the world.
Authoritative Nameserver
The final source of truth for a domain's DNS records. Managed by the domain owner or their DNS provider (Cloudflare, Route53, etc.). Returns the definitive IP address.
TTL (Time to Live)
A value set in DNS records that tells resolvers how long to cache the result. A TTL of 300 means cache for 5 minutes. Lower TTL = faster propagation of changes. Higher TTL = faster lookups.
DNS Cache
Every level of the DNS chain caches results to avoid repeating expensive lookups. Your browser, OS, and ISP resolver all maintain caches. This is why DNS changes can take time to propagate globally.
DNSSEC
DNS Security Extensions. A layer of cryptographic signatures added to DNS records to prevent attackers from spoofing DNS responses and redirecting you to fake websites.
Key Facts
- A full DNS lookup from scratch — root → TLD → authoritative — takes under 100 milliseconds in most cases.
- There are only 13 root nameserver IP addresses, but each is actually a cluster of hundreds of physical servers distributed worldwide using anycast routing.
- Cloudflare's 1.1.1.1 and Google's 8.8.8.8 are the two most-used public DNS resolvers, handling hundreds of billions of queries per day combined.
- DNS was invented in 1983 by Paul Mockapetris to replace a single hosts.txt file that was manually updated and emailed to every computer on the internet.
- A single DNS response packet is typically under 512 bytes — small enough to fit in a single UDP datagram.
- DNS over HTTPS (DoH) and DNS over TLS (DoT) are modern protocols that encrypt DNS queries so your ISP cannot see which domains you are looking up.
Real-World Applications
Website Loading
Every page load starts with a DNS lookup. Browsers aggressively cache DNS results and use techniques like DNS prefetching to resolve domains before you even click a link.
Email Delivery
When you send an email to user@company.com, the mail server does a DNS lookup for an MX (Mail Exchange) record to find which server accepts mail for that domain.
Content Delivery Networks
CDNs use DNS to route you to the nearest edge server. When you look up netflix.com, the DNS response returns the IP of a Netflix server close to your geographic location.
Load Balancing
Companies can return multiple IP addresses in a DNS response and rotate between them. This distributes traffic across multiple servers without the user knowing.
Parental Controls & Ad Blocking
Services like OpenDNS and Pi-hole block ads and malicious sites by intercepting DNS queries for known bad domains and returning nothing — the request never reaches the site.
Frequently Asked Questions
Why does clearing DNS cache fix some website problems?
Your browser and OS store DNS results locally for performance. If a website moves to a new server (new IP address), your cached DNS result still points to the old server. Clearing the DNS cache forces a fresh lookup that returns the correct new IP address.
What is the difference between DNS and a domain registrar?
A domain registrar (like GoDaddy or Namecheap) is where you purchase and register a domain name. DNS is the system that makes that name resolve to an IP address. You set your domain's authoritative nameservers at the registrar, and those nameservers store the actual DNS records.
Can someone spy on my DNS queries?
Traditional DNS queries are sent in plain text over UDP port 53, so your ISP, network administrator, or anyone on your network can see every domain you look up. DNS over HTTPS (DoH) encrypts these queries inside HTTPS traffic, making them private from network observers.
What happens if DNS goes down?
If DNS servers become unreachable, you cannot visit websites by domain name even though the websites themselves may be running fine. This is what happened in the 2016 Dyn DNS attack — a massive DDoS attack on DNS provider Dyn took down Twitter, Netflix, Reddit, and dozens of other major sites for hours.
Why do DNS changes take up to 48 hours to propagate?
When you update a DNS record, recursive resolvers around the world still have the old answer cached for the duration of the original TTL. Until every resolver's cache expires, different users may get different IP addresses for the same domain. Setting a low TTL (e.g., 300 seconds) before making changes minimises propagation delay.