From Human to Machine
DNS translates yourbrand.com into 192.0.2.42 so browsers can fetch pages. The process involves recursive resolvers, root servers, TLD servers and authoritative nameservers in under 300 ms.
Step-by-Step Resolution
- Browser cache → OS cache → recursive resolver (ISP or 8.8.8.8)
- Resolver asks root (.) for .com servers
- Root replies with TLD server list (a.gtld-servers.net)
- TLL server replies with authoritative NS for yourdomain.com
- Authoritative returns A record 192.0.2.42
Recursive vs Authoritative
Recursive (public DNS like Cloudflare 1.1.1.1) chases the full chain and caches the answer. Authoritative (your registrar) only knows its own zone files and never queries upstream.
DNS Caching Layers
Browser (60 s-30 min), OS (5 min-24 h), recursive (TTL), authoritative (no cache). Lowering TTL before migrations flushes caches faster but increases query load on authoritative server.
Root Servers Myth
There are 13 logical root nameserver addresses but hundreds of physical instances using anycast. A single root failure doesn’t break resolution; traffic reroutes to next closest node.
Negative Caching
If a record doesn’t exist, the NXDOMAIN response is cached for the SOA MINIMUM field (often 3 hours). That’s why newly added subdomains can return “not found” even after you create them—wait or flush cache.
EDNS Client Subnet
Recursive servers can forward part of your IP to authoritative CDNs so you receive the closest edge node. Privacy advocates dislike it; performance engineers love it.
DNS over HTTPS (DoH)
Encrypts queries inside HTTPS so ISPs can’t sniff visited domains. Browsers enable DoH by default (Chrome for some countries). Enterprises often disable it to maintain logging and filtering.
Command-Line Tools
dig +trace yourdomain.com shows full delegation path. dig @1.1.1.1 yourdomain.com +stats measures query time. Use drill on Alpine or nslookup on Windows for quick checks.
Takeaway
DNS looks simple but involves a global, hierarchical, cached, redundant network. Understand each layer and you can diagnose any “site down” complaint in minutes instead of hours.