Why the internet needs DNS
Computers find each other by IP address. People find things by name. DNS sits between the two: you type a name, DNS returns the address, and your browser connects to it.
It also lets owners move things without anyone noticing. When a site moves to a new server, the owner changes one DNS record and visitors follow it to the new address. Mail works the same way: an MX record tells other mail servers where to deliver mail for a domain.
What happens during a DNS lookup
Say you open www.example.com for the first time. Four kinds of server take part:
- Your device checks its own cache. If it has a fresh answer, it stops here.
- A recursive resolver gets the question. This is usually your provider's resolver, or a public one such as Google (8.8.8.8) or Cloudflare (1.1.1.1). If it has the answer cached, it replies straight away.
- If not, the resolver asks a root server, which doesn't know the answer but knows who runs
.com. - The resolver asks the .com TLD servers, which reply with the nameservers for
example.com. - The resolver asks those authoritative nameservers, which hold the domain's records and return the address.
- The resolver gives the address to your device and keeps a copy for as long as the record's TTL allows.
All of that usually takes a few tens of milliseconds, and most lookups never get past step 2 because the answer is already cached.
See what resolvers around the world return for a domain right now:
Resolvers and authoritative servers
People say "DNS server" for two different jobs, and mixing them up causes most confusion:
| Recursive resolver | Authoritative nameserver | |
|---|---|---|
| Job | Finds answers for users | Holds a domain's records |
| Run by | Your provider, or a public service | Your DNS host (often your registrar or CDN) |
| You change it | In your device or router settings | At your DNS host's control panel |
| Example | 1.1.1.1, 8.8.8.8, 9.9.9.9 | ns1.example-host.net |
Changing the resolver your computer uses changes who answers your questions. Changing a domain's records changes the answer everyone gets. You can compare well-known resolvers on the public DNS servers page and see a domain's nameservers with the NS lookup.
DNS records
A domain's zone is a list of records. The ones you meet most often:
- A: the IPv4 address for a name.
- AAAA: the IPv6 address for a name.
- CNAME: an alias that points one name at another. Check one with the CNAME lookup.
- MX: the mail servers that receive mail for the domain. See them with the MX lookup.
- TXT: free text, used for SPF, DKIM, DMARC and domain verification.
- NS: the authoritative nameservers for the domain.
- SOA: zone details such as the primary nameserver and serial number.
Here is what a lookup returns when you query an A record from the command line:
$ dig www.example.com A +noall +answer
www.example.com. 3600 IN A 203.0.113.42The 3600 is the TTL in seconds: resolvers may cache this answer for an hour.
Caching, TTL and why changes take time
Caching is what makes DNS fast, and it's also why a change doesn't show up everywhere at once. Each resolver keeps the old answer until its TTL runs out. Until then, some people see the old address and some see the new one. That period is called DNS propagation.
Plan for it: lower the TTL to around 300 seconds a day before a planned change, make the change, check it with the DNS propagation checker, then raise the TTL again.
How DNS travels, and how it is secured
Classic DNS (RFC 1035) uses port 53, mostly over UDP, and isn't encrypted, so anyone on the network path can see which names you look up. Two newer options encrypt it: DNS over HTTPS (port 443) and DNS over TLS (port 853). Most browsers and phones support at least one.
Encryption hides lookups from the network. A separate system, DNSSEC, signs records so a resolver can tell whether an answer was tampered with. A WHOIS lookup shows whether a domain is signed.
When DNS goes wrong
- "Server not found" or NXDOMAIN: the name doesn't exist, is misspelled, or the domain has expired. Check its registration with a WHOIS lookup.
- Old site still showing: a cached record has not expired yet. Compare resolvers with the propagation checker.
- Mail bouncing: missing or wrong MX records. Check them with the MX lookup.
- Works for others, not for you: your device or router has a stale cache, or your resolver is having trouble. Try another resolver.