How DNS works: the internet’s distributed address notebook
You type a memorable name; DNS supplies the records software needs. The answer may come from cache, so a lookup is also a question about time.
Follow a DNS lookup from browser cache to recursive resolver and authoritative nameserver, including TTL and DNSSEC.
The recursive path
A stub resolver asks a recursive resolver. If the answer is not cached, that resolver follows delegations from the DNS root to a top-level-domain server and then to the domain’s authoritative server. It returns the record and caches it for the advertised lifetime.
Records answer different questions
A and AAAA records map names to addresses. MX records nominate mail exchangers. NS records identify authoritative servers, while TXT records carry assorted policy and verification data. CNAME aliases one name to another.
Integrity is not secrecy
DNSSEC can prove that signed data has not been altered, but it does not hide the query. Encrypted DNS transports such as DoH or DoT protect the path to the resolver; they do not make the destination invisible to every party.
Turn the DNS model into a focused name-resolution check
Choose the next page according to whether the problem is a cached record, an address-family destination, or the certificate served after the name resolves.
- Query published DNS records to inspect A, AAAA, MX, NS, TXT, and CNAME answers for the exact hostname.
- Resolve the hostname to IP addresses to isolate the destinations a client can try in each address family.
- Check the TLS certificate to verify the named encrypted endpoint after DNS has supplied an address.
A practical checklist
- Check authoritative records when validating a recent change.
- Lower TTL before a planned migration, then restore it afterward.
- Test A and AAAA independently when only some users report failure.
Questions readers ask next
What does flushing DNS do?
It removes cached answers on a device or resolver so the next query must obtain a fresh result.
Does DNS choose the fastest server?
It can return geographically tailored answers, but route selection and application behavior decide the actual connection.
Sources and further reading
The key ideas and how they connect
DNS separates the person asking, the resolver doing the work, and the authoritative server that owns the published answer.
Stub asks a recursive resolver
The device usually delegates the multi-step search.
Resolver follows delegation
Root and top-level servers point toward the authoritative zone.
TTL controls cache life
An old answer can remain until its allowed cache time ends.
A browser can reuse DNS without asking again
You load a site twice within a short period. The browser, operating system, or recursive resolver may reuse a cached answer, so no new authoritative query is needed. Use the DNS record lookup to inspect current published types, but record which resolver supplied the result.
Core semantic relationships
| Subject | Relationship | Object |
|---|---|---|
| Stub resolver | queries | a recursive resolver |
| Authoritative nameserver | publishes | zone records |
| TTL | permits caching for | a limited time |