What is DNS?

DNS
Published by

Every time you type an address into your browser, something happens in the background that most people never notice. Your computer has no idea where "google.com" is, it only understands IP addresses, those strings of numbers like 142.250.74.46. DNS is the system that does the translation. Without it, you would need to memorise dozens of IP addresses just to browse the web.

A global, distributed directory

DNS stands for Domain Name System. It is a hierarchical system that maps human-readable domain names to machine-readable IP addresses. When you type "wikipedia.org", a DNS query fires off immediately to find the matching IP address, all of this happens in a few dozen milliseconds, before your browser even starts loading the page.

What makes DNS remarkable is its scale. It handles billions of queries per day across thousands of servers distributed around the world, with no single point of failure. It is one of the most critical and least visible pieces of infrastructure on the internet.

How DNS resolution actually works

When you type a URL, here is what really happens:

Your device first checks its local cache, if you visited that site recently, the answer may already be stored. If not, the query goes to your DNS resolver, typically provided by your ISP (Comcast, AT&T, BT, Virgin Media) or a third-party service like Google (8.8.8.8) or Cloudflare (1.1.1.1).

If the resolver does not have the answer cached, it queries a root server, there are 13 root server clusters worldwide, operated by organisations including ICANN, Verisign, and the University of Maryland. The root server points to the right TLD server (Top Level Domain) for ".com", ".uk", ".org", and so on. That TLD server then refers to the domain's authoritative nameserver, which holds the actual answer, the DNS records for that specific site.

The entire chain typically takes between 20 and 120 milliseconds. Responses are then cached at each step to speed up future queries.

DNS record types

A domain does not just resolve to a single IP address. It can hold several types of records depending on what is needed:

  • A: maps a domain name to an IPv4 address (e.g. example.com to 93.184.216.34)
  • AAAA: same, but for IPv6
  • CNAME: an alias pointing to another domain name (www.example.com to example.com)
  • MX: specifies the mail servers for the domain, without this, email delivery breaks
  • TXT: free-form text, used for domain verification (Google Search Console, SPF, DKIM) and other purposes
  • NS: identifies which DNS servers are authoritative for the domain
  • TTL: Time To Live, how long a response can be cached, expressed in seconds

When DNS goes wrong

A site that will not load is not always down, it is often a DNS issue. The most common causes:

  • A TTL set too high after switching hosting providers: old IP addresses stay cached for hours, sometimes 24 to 48 hours
  • A slow or failing resolver from your ISP: switching to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) often fixes this instantly
  • DNS spoofing (also called DNS cache poisoning): an attacker manipulates DNS responses to redirect you to a fake site, this is why DNSSEC was developed

To diagnose a DNS issue on Windows, nslookup example.com shows the response from your current resolver. On Linux and macOS, dig example.com is more detailed and also shows response time and which server was queried.

DNS and your privacy

By default, DNS queries travel in plain text across the network, your ISP, and anyone between your device and the resolver, can see which sites you visit. This is a significant privacy leak that most people are unaware of.

Two protocols exist to encrypt these queries: DNS over HTTPS (DoH) and DNS over TLS (DoT). Both wrap DNS requests inside encrypted connections. Firefox has enabled DoH by default since 2019, and Windows 11 supports DoT natively. Cloudflare (1.1.1.1), NextDNS and Quad9 all offer resolvers that support both.

Switching your DNS resolver to 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9) is one of the easiest changes you can make to improve both the speed and privacy of your browsing, it takes two minutes and costs nothing.