What Is DNS? How the Domain Name System Works
DNS turns google.com into an IP address. How a lookup travels from your browser to the root servers, the record types, caching, and what to do when it breaks.
DNS Explained in Plain Terms
DNS is the Domain Name System. It turns a name like google.com into an address like 142.250.185.206, which is what computers actually use to find each other. Every website, app and email starts with a DNS query to find the right server. Without it you would have to remember a number for every site.
Paul Mockapetris designed it in 1983 (RFC 882 and RFC 883). Before that, every computer downloaded one text file, HOSTS.TXT, with every known hostname in it. That broke once the network passed a few hundred machines. DNS spread the job out into a distributed database that now scales to billions of names.
How DNS Resolution Works Step by Step
You type example.com. Here is what happens:
- Browser cache. If the browser looked this name up recently and the TTL (time to live) has not run out, it uses the stored answer.
- Operating system cache. The OS stub resolver checks its own cache next (the DNS Client service on Windows, mDNSResponder on macOS).
- Recursive resolver. Nothing cached, so the query goes to your configured resolver: your ISP's, or a public one like Google (8.8.8.8) or Cloudflare (1.1.1.1). It does the rest of the work.
- Root nameserver. The resolver asks one of the 13 root server groups (a.root-servers.net through m.root-servers.net) who handles .com and gets a referral to the .com TLD servers.
- TLD nameserver. The .com server returns the nameservers registered as authoritative for example.com.
- Authoritative nameserver. This one holds the zone file with the domain's records and returns the IP address.
- Response. The resolver caches the answer for the TTL and passes it back. Your browser opens a TCP connection to that IP and loads the page.
This is called recursion: your device sends one query and the resolver handles everything else.
Types of DNS Servers
Four kinds of server take part in a lookup, each with one job.
Root nameservers sit at the top. There are 13 logical ones, lettered A to M, but each is a cluster of hundreds of machines around the world, reached by anycast. All they do is point you to the right TLD server.
TLD (Top-Level Domain) nameservers run the zone for each top-level domain: .com, .org, .net, .io, country codes like .de and .br, newer ones like .app and .dev. They answer with the authoritative nameservers for a domain.
Authoritative nameservers hold the real records. When you add an A or MX record for your site, this is where it lives. Cloudflare, AWS Route 53 and your registrar's nameservers are the usual choices.
Recursive resolvers are what your device talks to. They walk the root, TLD and authoritative servers, cache the result and hand it back. Your ISP runs some; Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) are open to anyone.
DNS Record Types
A domain carries several kinds of record, depending on what needs to hang off the name. The common ones:
| Record | What It Does | Example |
|---|---|---|
| A | Maps a domain to an IPv4 address | example.com → 93.184.216.34 |
| AAAA | Maps a domain to an IPv6 address | example.com → 2606:2800:220:1::248 |
| CNAME | Creates an alias that points one domain to another | www.example.com → example.com |
| MX | Specifies the mail server for the domain (with priority number) | 10 mail.example.com |
| TXT | Holds text data. Used for SPF, DKIM, domain verification | v=spf1 include:_spf.google.com ~all |
| NS | Delegates the domain to specific authoritative nameservers | ns1.cloudflare.com |
| SOA | Start of Authority. Contains zone metadata: primary NS, admin email, serial number, timers | Zone administration record |
| PTR | Reverse DNS. Maps an IP address back to a hostname | 34.216.184.93.in-addr.arpa → example.com |
| SRV | Specifies the host and port for a service (VoIP, messaging, etc.) | _sip._tcp.example.com 5060 |
| CAA | Controls which certificate authorities can issue SSL certificates for the domain | 0 issue "letsencrypt.org" |
Our DNS Lookup asks the authoritative servers and shows every record type for a domain.
TTL and DNS Caching
Every record carries a TTL (Time to Live): how many seconds a resolver may keep the answer before asking again. A TTL of 3600 means one hour in the cache, then a fresh lookup.
That number controls how fast a change spreads. Moving your site to a new IP? Drop the TTL to 300 seconds (5 minutes) a day ahead and resolvers everywhere pick up the new address within minutes. Leave it at 86400 (24 hours) and some visitors land on the old server for a full day.
Caching happens at every level, browser, operating system, home router and recursive resolver, each keeping its own copy for the TTL. To flush the local cache:
- Windows:
ipconfig /flushdns - macOS:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder - Linux (systemd):
sudo systemd-resolve --flush-caches - Chrome browser: open
chrome://net-internals/#dnsand click "Clear host cache"
What Is DNS Propagation?
Propagation is the time a changed record takes to reach every resolver in the world. Any resolver still holding the old record keeps serving it until its copy expires: a few minutes to 48 hours, depending on the old TTL and how aggressively each resolver caches. Our DNS Propagation Checker queries 23 resolvers across 6 continents at once and puts the answers on a live map.
DNS Security
A normal DNS query is plain text over UDP port 53. Anyone in the path (your ISP, a public Wi-Fi operator, an attacker) can read which domains you look up. Three things fix parts of that:
DNSSEC (DNS Security Extensions) signs responses so a resolver can check they were not altered on the way. It stops cache poisoning and spoofing but does not hide the query itself.
DNS over HTTPS (DoH) wraps the query in ordinary HTTPS on port 443, so it is encrypted and looks like any other web traffic. Firefox and Chrome support it natively.
DNS over TLS (DoT) encrypts the query with TLS on its own port, 853. Same privacy as DoH, easier for a network administrator to see and manage.
On a VPN, DNS should travel inside the tunnel. If it slips out to your ISP's resolver, your browsing is exposed anyway. Our DNS Leak Test shows whether that is happening.
Public DNS Resolvers
Most people never change the resolver their ISP set. A public one can be faster, more private and safer:
| Provider | Primary | Secondary | Strengths |
|---|---|---|---|
| Google Public DNS | 8.8.8.8 | 8.8.4.4 | Fast, globally distributed, extensive anycast network |
| Cloudflare | 1.1.1.1 | 1.0.0.1 | Fastest response times in independent benchmarks, strong privacy policy |
| Quad9 | 9.9.9.9 | 149.112.112.112 | Blocks known malicious domains by default, nonprofit operated |
| OpenDNS (Cisco) | 208.67.222.222 | 208.67.220.220 | Configurable content filtering, parental controls |
| AdGuard DNS | 94.140.14.14 | 94.140.15.15 | Blocks ads and trackers at the DNS level |
Change it in the router's admin panel to cover every device, or in one device's network settings to cover just that one.
Common DNS Problems and How to Fix Them
DNS server not responding
Your resolver is unreachable. Switch to a public one (8.8.8.8 or 1.1.1.1). If that works, the fault is your DNS provider, not your connection.
Slow DNS lookups
Pages take seconds to start loading, then load fast? Resolution is the bottleneck. Move to a faster resolver; Cloudflare (1.1.1.1) keeps scoring the lowest response times in global benchmarks.
DNS changes not showing up
An old record is still cached somewhere. Flush your local cache, try another browser or network, and use our DNS Propagation Checker to see which resolvers have the new record and which still serve the old one.
NXDOMAIN errors
The name does not exist in DNS. The domain may have expired, the nameservers may be wrong, or the record was deleted. Check the NS records first.
Frequently Asked Questions
What is DNS in simple terms?
The system that turns a name like google.com into the numeric IP address computers use to find each other. A phone book: look up the name, get the number.
What is a DNS server and what does it do?
It stores domain-to-IP mappings and answers queries. Recursive resolvers like 8.8.8.8 or 1.1.1.1 chase the answer through the hierarchy for you, authoritative servers hold the records for specific domains, and root servers point everyone in the right direction.
What is a DNS error?
Your device could not turn a name into an IP, almost always because the DNS server did not answer. On a PS4 or PS5 this usually means the ISP's resolver is slow or overloaded. In network settings set DNS to 8.8.8.8 (primary) and 8.8.4.4 (secondary), or Cloudflare's 1.1.1.1. The same fix works on Xbox and most routers.
What is a DNS record?
One entry tying a name to a piece of information: an A record to an IPv4 address, an MX record to a mail server, a TXT record to text such as an SPF policy. Each has a type, a value and a TTL.
What is a DNS zone?
A slice of the namespace under one administrator. example.com plus its subdomains (www.example.com, mail.example.com) is one zone. Its zone file holds all the records and lives on the authoritative nameserver.
What is a DNS provider?
The service that hosts your domain's authoritative nameservers and answers when someone looks it up. Cloudflare, AWS Route 53, Google Cloud DNS and most registrars do this. They differ in speed, reliability, price and extras like DNSSEC and geo-routing.
What is private DNS?
A setting on Android 9 and later (and some other devices) that turns on DNS over TLS. Set a provider such as dns.google or 1dot1dot1dot1.cloudflare-dns.com and every query is encrypted, so your ISP or the network operator cannot see the domains you visit.
What is a DNS leak?
Your VPN is connected but your DNS queries still go to your ISP's resolver, so the ISP sees every site you visit. Our DNS Leak Test checks for it.
How long does DNS propagation take?
A few minutes to 48 hours, set by the old record's TTL. At 300 seconds most resolvers update within 5 minutes; at 86400 seconds (24 hours) it can take a full day. Lower the TTL before you make the change.
What is DNS cache and should I clear it?
A local store of recent lookups that saves repeat queries. Clear it when records have changed but your device still uses the old values, or when stale DNS data seems to be behind a connection problem.
What port does DNS use?
UDP port 53, with TCP port 53 for large responses. DNS over HTTPS uses port 443 like regular HTTPS, DNS over TLS uses port 853.
Can my ISP see my DNS queries?
Yes, if you use their resolver or send DNS unencrypted. Use DoH or DoT with a resolver that supports them, or a VPN that carries DNS inside its tunnel.
What is the difference between DNS and DHCP?
DHCP (Dynamic Host Configuration Protocol) gives your device an IP address on the local network. DNS tells your device which IP belongs to the site you want. Different jobs, used together.
Is DNS the same as a URL?
No. A URL like https://www.example.com/page includes the protocol, the domain and the path. DNS only resolves the domain part (example.com) to an IP; the browser handles the rest.
Try it on a real address. Free, no account needed.