What Is DNS? How the Domain Name System Turns Names Into Addresses

DNS, the Domain Name System, is the internet’s distributed directory that translates human-readable domain names like example.com into the numeric IP addresses that computers use to locate each other. Every time you load a page, send an email, or call an API by hostname, DNS quietly resolves that name to an address first. It is a hierarchical, cached, globally distributed database, and understanding it is essential for debugging connectivity, configuring domains, and deploying reliable services.

Key takeaways

• DNS maps names to addresses so people use names while machines use IP addresses.
• Resolution walks a hierarchy: root servers, TLD servers, then authoritative servers for the domain.
• Records have types such as A, AAAA, CNAME, MX, TXT, and NS.
• The TTL controls how long answers are cached, which is why changes are not instant.
• DNS runs on port 53; encrypted forms include DNS over HTTPS and DNS over TLS.
• DNSSEC adds cryptographic authentication to prevent forged responses.

How does DNS resolution work step by step?

When your browser needs the address for a hostname, it asks a recursive resolver, typically run by your ISP or a public provider. If the resolver does not already have the answer cached, it performs an iterative lookup down the hierarchy:

1. It asks a root server, which does not know the address but points to the correct top-level domain (TLD) servers, for example the servers for .com.
2. It asks the TLD server, which points to the authoritative name servers for the specific domain.
3. It asks the authoritative server, which returns the actual record, such as the A record with the IP address.

The resolver caches the answer for its TTL and returns it to your machine, which also caches it. The next lookup for the same name is answered instantly from cache until the TTL expires.

What are the main DNS record types?

A DNS zone is a set of records, each with a name, type, value, and TTL. The types you will meet most often are below.

What is the difference between an A record and a CNAME?

An A record points a name straight at an IP address. A CNAME points a name at another name, which the resolver must then look up in turn. Aliases are handy when you want several hostnames to follow one canonical target, but they come with rules.

• You cannot place a CNAME at the zone apex (the bare domain) because the apex must also hold SOA and NS records, and a CNAME cannot coexist with other records. Many providers offer an ALIAS or ANAME flattening feature to work around this.
• A CNAME adds one extra resolution step, though the effect is usually negligible thanks to caching.

Why do DNS changes take time to propagate?

DNS does not push updates. It relies on resolvers re-querying after a record’s TTL expires. If a record has a TTL of one hour, a resolver that cached the old value may keep serving it for up to an hour after you change it.

The practical technique before a planned migration is to lower the TTL well in advance, for example to 300 seconds, wait for the old long TTL to age out, make the change, confirm it, then raise the TTL again. This shrinks the window during which stale answers circulate. Note that some resolvers ignore very low TTLs and impose a minimum.

How do you query DNS from the command line?

Command-line tools let you inspect exactly what an authoritative server or resolver returns, which is invaluable for debugging.

dig example.com A +short
dig example.com MX
dig @1.1.1.1 example.com AAAA
nslookup example.com

Use dig to target a specific resolver with @, to request a specific record type, and to see the TTL counting down on cached answers. When results look wrong, query the authoritative name server directly to distinguish a stale cache from a genuine misconfiguration.

How is DNS kept secure?

Plain DNS was designed without authentication or encryption, which exposes it to spoofing and surveillance. Two layers of protection address different problems.

• DNSSEC adds digital signatures to records so a resolver can verify that an answer really came from the authoritative source and was not tampered with. It protects integrity but not privacy.
• DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the query between your device and the resolver, hiding which names you look up from anyone watching the network.

A related attack to know is cache poisoning, where a forged response tricks a resolver into caching a wrong address; DNSSEC and source-port randomization are the main defenses.

What are common DNS pitfalls?

• Expecting instant changes. TTL caching means updates take time; plan around it.
• Dangling records. A CNAME or A record pointing at a decommissioned resource can enable subdomain takeover if an attacker claims that resource.
• Missing trailing dots in zone files. In many zone-file formats a name without a trailing dot is treated as relative to the zone, silently producing the wrong fully qualified name.
• Misconfigured MX or SPF/DKIM/DMARC. Email delivery quietly fails or lands in spam when these TXT and MX records are wrong.
• Too many chained CNAMEs. Long alias chains add latency and can hit resolver limits.

How does DNS enable load balancing and failover?

DNS is more than a static phone book; it is also a lightweight traffic-management layer. Because a single name can return multiple addresses, and because resolvers pick from them, DNS becomes a first line of load distribution and resilience.

Several patterns build on this:

• Round-robin DNS. An A record can list several IP addresses, and resolvers hand them out in rotation, spreading traffic across servers. It is simple but crude, since it does not know which servers are healthy or busy.
• Geo-routing. A managed DNS provider can answer the same query with different addresses depending on the resolver’s location, directing users to the nearest data center.
• Health-checked failover. The provider monitors your endpoints and stops returning the address of one that fails, so traffic shifts to healthy servers automatically.
• Weighted routing. Different addresses receive different shares of traffic, which is useful for gradual rollouts or blue-green deployments.

The important caveat is TTL. Because failover works by changing which record is returned, clients that cached the old answer will keep using a dead server until their cache expires. This is why DNS-based failover uses low TTLs and why it is best treated as coarse-grained resilience rather than instant, per-request load balancing, which is better handled by a dedicated load balancer closer to the servers.

Frequently asked questions

What is the difference between an A record and a CNAME?

An A record maps a hostname directly to an IPv4 address, while a CNAME maps a hostname to another hostname (an alias). You cannot put a CNAME at the zone apex alongside other records.

Why do DNS changes take time to appear?

Resolvers cache records for the duration of the TTL, so old values can persist until that timer expires. Lowering the TTL before a planned change shortens the wait.

What is a TTL in DNS?

TTL, or time to live, is the number of seconds a resolver may cache a record before asking again. Lower values propagate changes faster but increase query volume.

What port and protocol does DNS use?

Traditional DNS uses port 53 over UDP for most queries and TCP for large responses or zone transfers. Encrypted variants use DNS over HTTPS or DNS over TLS.

What is a recursive resolver?

A recursive resolver is the server that does the lookup work on your behalf, querying root, TLD, and authoritative servers until it has an answer, then caching and returning it.

How is DNS made secure?

DNSSEC signs records cryptographically so resolvers can verify authenticity, while DNS over HTTPS and DNS over TLS encrypt the query itself to protect privacy in transit.

What does NXDOMAIN mean?

NXDOMAIN is the response indicating that the queried domain name does not exist. It is different from an empty answer, which means the name exists but has no record of that type.