DNS: the internet's directory
People use names like example.com; routers need IP addresses. The Domain Name System translates between them through a vast distributed, hierarchical database.
What DNS does
The Domain Name System (DNS), designed by Paul Mockapetris in 1983, maps host names to IP addresses and provides other services: aliases (one name pointing to another), mail server lookup, and load distribution by returning different addresses. Almost every internet connection begins with a DNS lookup, usually over UDP port 53.
The hierarchy
DNS is organised as a tree. At the top are the root servers: 13 named root server identities, operated by 12 organisations and replicated as well over a thousand instances worldwide using anycast. Below them are top-level domain (TLD) servers for .com, .org, country codes such as .uk and .jp, and others. Below those are authoritative servers that hold the actual records for each organisation's domains.
Resolvers and queries
A host asks a local recursive resolver, often run by its ISP or a public service. The resolver, if the answer is not cached, queries a root server, which refers it to the right TLD server; the TLD server refers it to the domain's authoritative server, which gives the answer. This chain of referrals is iterative querying; the host's single request to its resolver is a recursive query.
Caching and TTLs
Every DNS answer carries a time-to-live (TTL). Resolvers cache answers for that long, so popular names are answered instantly without contacting root or TLD servers. Short TTLs allow fast changes, such as moving a service to a new address; long TTLs reduce load and latency. Caching is what lets DNS scale to the whole internet.
Record types
A records map names to IPv4 addresses; AAAA records to IPv6 addresses; CNAME records create aliases; MX records name a domain's mail servers; NS records name a zone's authoritative servers; TXT records hold arbitrary text, used for email authentication and domain verification; and SOA records hold administrative information about a zone.
Registering a domain
To create example-shop.com, a person or company registers it through a registrar accredited for the .com registry, providing the names and addresses of their authoritative name servers. The registry inserts NS and glue records into the .com TLD servers so resolvers can find those authoritative servers.
Security and privacy
Classic DNS is unauthenticated and unencrypted. Attackers can try cache poisoning, inserting false answers into resolvers; DNSSEC adds digital signatures so resolvers can verify answers. DNS queries also reveal browsing to anyone on the path; DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt queries between clients and resolvers. DNS is also a target of large distributed denial-of-service attacks.
Worked example
A laptop looks up www.example.org for the first time that day. The resolver has the .org TLD servers cached but not example.org, so it skips the root, asks a .org server, which returns NS records for example.org; asks that authoritative server, which returns an A record such as 192.0.2.10 (an address range reserved for documentation) with TTL 3,600 seconds. The resolver caches it, answers the laptop, and serves any user asking within the next hour from cache.
Key takeaways
DNS (Mockapetris, 1983) maps names to addresses and supports aliases, mail routing, and load distribution, usually over UDP port 53. It is a hierarchy: 13 named root server identities replicated by anycast, TLD servers, and authoritative servers. Hosts send recursive queries to resolvers, which query iteratively through referrals. TTLs control caching, which makes DNS scale. Record types include A, AAAA, CNAME, MX, NS, TXT, and SOA. Registrars place NS records in TLD zones. DNSSEC authenticates answers; DoH and DoT encrypt queries.
Flashcard
Domain Name System
Check your understanding
Why can a company not instantly move its website to a new IP address everywhere just by changing its A record?