Domain Name System (DNS)

DNS: domain names and IP addresses

The Internet connects networks and devices that identify one another with unique addresses. The basic addressing system is the , a sequence of numbers such as $198.133.219.25$ for IPv4 or $2001:db8:85a3::8a2e:370:7334$ for IPv6. Computers process these addresses directly, while users work with domain names that are easier to remember.

Domain names such as www.google.com and wikipedia.org replace numeric addresses in user interfaces. The provides the mapping between each name and its IP address through a hierarchical, distributed system of names and resource data.

DNS is a distributed database that maps domain names to IP addresses and other service data. A browser, mail server, or mobile application uses a DNS resolver to find the host named by a domain. DNS records can also describe mail servers, delegations, services, and domain policies. A resolver returns the data type requested by the client, such as an A or AAAA record. If resolution fails, a client cannot obtain the address needed to establish a connection.

The DNS hierarchy: a global, distributed system

One server containing the complete list of names could not handle all updates and queries from the Internet. DNS divides data into zones managed by different organizations and connects them in a hierarchy. Name servers hold their own zones and referrals to other servers, while resolvers cache results. A delegation identifies the servers responsible for a lower part of the namespace, so domain updates remain in the zone operated by its owner.

Levels of the DNS hierarchy

1. Root DNS servers: At the top of the hierarchy is the root zone, represented by a single dot ("."). The root system has 13 named server identities, served by many instances deployed around the world. These servers hold delegations to top-level domains, rather than the address of every website. A delegation contains name server information and supporting data needed for the next query. A resolver can ask a root server where to find the servers for .com.
2. Top-level domain (TLD) servers: The next level contains Top-Level Domains such as .com, .org, .net, and country-code TLDs such as .uk or .de. Each TLD operator maintains name servers for its zone. A .com server does not hold the IP address for www.google.com. It returns a delegation to the authoritative name servers for google.com. The resolver uses this delegation to send the next query to the appropriate zone.
3. Authoritative DNS servers: The authoritative name server for example.com holds the DNS records for that zone, including the address of www.example.com and mail data for mail.example.com. For an example A record, it can return the address $93.184.216.34$ . These data, known as , have a name, class, type, and record data. An authoritative response comes from the zone for which that server is responsible and supplies the source data for that part of the hierarchy.

The DNS resolution process: from name to number

DNS name resolution follows this hierarchy. It usually involves a fourth server type that works on the user's behalf, the Recursive DNS Resolver.

The role of the recursive resolver

A client computer usually does not communicate directly with root, TLD, and authoritative servers. It uses a . This can be a server run by an Internet Service Provider (ISP) or a public service such as Google DNS ( $8.8.8.8$ ) or Cloudflare DNS ( $1.1.1.1$ ). The resolver checks its cache and queries additional servers when required. For a recursive client query, it returns the final answer or an error result.

Step 1: The user makes a request. A user enters www.example.comin a browser and submits the request. The operating system's stub resolver first checks its local cache for the IP address. If no valid entry exists, it sends a query to the configured Recursive DNS Resolver.
Step 2: The resolver checks its cache. The Recursive Resolver receives the query and checks its own cache. If it contains a valid answer, the resolver returns it without further queries. This caching reduces transmissions for frequently requested names.
Step 3: The resolver queries a root server. If the answer is not in the cache, the resolver starts the iterative query process. It sends a query for www.example.com to one of the root DNS servers.
Step 4: The root server responds. The root server returns a referral to the .com name servers rather than the final address for www.example.com. The response contains NS records and, when needed, address records for those servers, so the resolver can continue the iterative lookup.
Step 5: The resolver queries a TLD server. The resolver then sends the same query for www.example.com to one of the .com TLD servers.
Step 6: The TLD server responds. The .com server returns a referral to the authoritative name servers for example.com rather than the final address. The response contains NS records and any required address records for those servers. The resolver uses them in its next query.
Step 7: The resolver queries an authoritative server. The resolver now sends its query to the authoritative name server for example.com.
Step 8: The authoritative server provides the answer. This server finally has the answer. It looks in its zone file and finds the A record for www, which contains the IP address $93.184.216.34$ . It sends this IP address and response parameters, including the TTL, back to the resolver.
Step 9: The resolver returns the answer to the client. The resolver receives the IP address. It stores this answer in its cache for a specific duration (defined by the TTL, or Time-To-Live, value in the DNS record) and then returns the IP address to the client computer. Later queries can use this entry until its TTL expires.
Step 10: The browser connects. The browser now has the destination IP address and can initiate an HTTP(S) connection to the server at that address to fetch the webpage.

DNS caching and TTL

A full resolution without a useful cached answer requires several queries and can take from milliseconds to several seconds, depending on server availability. Negative responses can also be cached according to cache rules and the time specified for the domain. Repeating this process for every request would increase network traffic. DNS therefore caches results at multiple levels.

Browser cache: Web browsers themselves maintain a small, short-term DNS cache. After resolving www.example.com once, the browser will store the result. If a user follows another link to the same domain, the browser can immediately use the cached IP without making another DNS query. The entry remains usable only for the period allowed by cache policy and TTL.
Operating system (stub resolver) cache: The OS also maintains a DNS cache. This cache is shared by all applications on the system.
Recursive resolver cache: The resolver maintains a larger cache shared by its clients. For a frequently requested name such as www.google.com, it can return a result stored after an earlier query.

Time-to-live (TTL)

The duration for which a DNS record can be cached is controlled by its value. The domain owner sets the TTL for their records on their authoritative name server. A longer TTL (e.g., 24 hours) reduces the load on the authoritative server and speeds up lookups for users, but it also means that if the IP address changes, the change will take longer to propagate across the internet as caches wait for the old entry to expire. A shorter TTL (e.g., 5 minutes) allows for faster updates but increases DNS traffic.

The `nslookup` Tool: Diagnosing DNS

Network administrators and developers use command-line tools to send DNS queries and inspect responses. One widely available tool is nslookup (Name Server Lookup).

A simple query might look like this in a Windows command prompt:

C:\>nslookup www.google.com
Server:  your.dns.server.name
Address:  your.dns.server.ip

Non-authoritative answer:
Name:    www.google.com
Addresses:  2a00:1450:400c:c08::71
          142.250.186.228

The tool first shows which DNS server it is using for the query.
"Non-authoritative answer" means that the response did not come directly from the authoritative zone. A recursive resolver usually returns it and may have used its own cache.
The response includes both the IPv6 address (AAAA record) and the IPv4 address (A record) for the domain.

nslookup and similar tools, including dig on Linux and macOS, help verify records, inspect server responses, and diagnose resolution problems. They can send a query to a selected server and request a selected record type. The ipconfig /displaydnscommand in Windows displays the local operating system's DNS cache.