DNS
The hierarchical lookup that turns names into records — usually addresses.
Level: beginner
What is it?
The Domain Name System is a tree of zones. A resolver starts at a root, is referred to a TLD, is referred to an authoritative name server, and caches the answer under a TTL.
Why does it matter?
Humans use names; packets use addresses. DNS is the seam. When it is slow or wrong, 'the internet is down' for everyone who cannot read an IP.
Mental model
A phone book that is sharded by suffix and cached everywhere. You do not call the root with every lookup — your stub asks a recursive resolver, which walks the tree once and remembers.
How it works
- Stub resolver (in the OS) → recursive resolver (ISP, 8.8.8.8, 1.1.1.1) → root → TLD → authoritative.
- Record types: A, AAAA, CNAME, MX, NS, TXT, SRV. The type is part of the question.
- UDP/53 for small answers; TCP/53 for large ones and zone transfers.
- TTLs are a consistency/performance knob. Low TTL: faster failover, more queries.
- DNS is not authentic by default. DNSSEC signs records; DoH/DoT hide queries from the path.
Steps
- Browser asks OS for example.com A.
- OS stub asks 1.1.1.1 (or whatever DHCP handed out).
- Resolver, if cold: queries a root for .com NS, then .com for example.com NS, then those NS for A.
- Answer comes back with TTL. Everyone along the path may cache it.
- Browser then opens TCP to that IP (and may query again for IPv6 AAAA).
Real-world usage
- Every URL bar
- Service discovery (SRV, and now HTTPS/SVCB records)
- Email (MX)
Common mistakes
- Assuming DNS 'returns the nearest server'. That is anycast or a CDN's geo-DNS policy, not the protocol.
- Forgetting CNAME chains and the extra lookups they cause.
- Using a 5-second TTL on a record that 10k clients will stampede.
Interview questions
Walk a recursive lookup for www.example.com.
Stub → recursive → root (com NS) → TLD (example.com NS) → authoritative (A/AAAA). Caches at each hop according to TTL.
A vs CNAME vs NS?
A maps a name to IPv4. CNAME aliases a name to another name. NS names the authoritative servers for a zone.
Why can DNS use UDP?
Questions and answers are usually small and idempotent. Loss is handled by timeout-and-retry. Truncated answers retry over TCP.