How DNS Works: From Browser to Server Without Getting Lost
How DNS works explained from first principles.
20+ years shipping large-scale distributed systems. Written from production experience, not tutorials.
DNS works by querying a hierarchy of servers: your browser first checks its cache, then asks a recursive resolver (usually your ISP or a public DNS like 8.8.8.8), which walks through root, TLD, and authoritative nameservers to find the IP address for a domain.
Think of DNS like a taxi dispatcher. You tell the dispatcher "Take me to Joe's Pizza" (the domain name). The dispatcher doesn't know every address, but they have a list of city zones (TLD servers). They call the zone for "Pizza" which knows all pizza places, and that zone gives them Joe's exact street address (IP). The dispatcher then tells the driver, and you get your pizza. Your phone book (cache) might already have Joe's address from last time, skipping the whole call.
You type a URL and hit Enter. Two seconds later, the page loads. Magic, right? Wrong. That two seconds hides a chain of network calls that can — and will — fail in spectacular ways. I've seen a misconfigured DNS record take down a payment service for 45 minutes because the TTL was set to 86400 seconds (24 hours) and nobody could flush the cache.
DNS is the internet's phonebook. Without it, you'd be typing 142.250.190.46 instead of google.com. But it's not just a simple lookup — it's a distributed, hierarchical system designed to handle billions of queries daily. Understanding how it works is the difference between a 5-minute fix and a 3am outage.
By the end of this article, you'll be able to trace a DNS lookup from browser to server, debug common failures using dig and nslookup, and explain why your DNS change isn't propagating (spoiler: it's the TTL).
The Problem DNS Solves: Human Memory vs. Machine Numbers
Computers communicate using IP addresses — strings of numbers like 192.0.2.1 (IPv4) or 2001:db8::1 (IPv6). Humans are terrible at remembering numbers. We remember names. DNS bridges this gap. Before DNS, the internet used a single file called HOSTS.TXT that mapped names to IPs. It was maintained by a central authority and downloaded nightly. As the internet grew, this became impossible — the file was huge, updates were slow, and there was no redundancy. DNS replaced it with a distributed, hierarchical system that scales globally.
127.0.0.1 myapp.local to test a local server without touching DNS. Just remember to remove it when done — I've seen staging boxes pointing to localhost for weeks.The DNS Hierarchy: Root, TLD, and Authoritative Nameservers
DNS is a tree. At the top are 13 root nameservers (named A through M), operated by organizations like Verisign, ICANN, and NASA. They don't know every domain — they know where to find the Top-Level Domain (TLD) servers. TLDs are .com, .org, .net, .io, etc. Each TLD has its own set of nameservers that know the authoritative nameservers for every domain under that TLD. The authoritative nameserver is the final source of truth for a domain — it holds the actual DNS records (A, AAAA, CNAME, MX, etc.). When you buy a domain from a registrar, you point it to your authoritative nameserver (often your hosting provider or a DNS service like Route53).
Recursive vs. Iterative Queries: Who Does the Work?
When your browser needs an IP, it sends a recursive query to a DNS resolver (usually your ISP or a public resolver like 8.8.8.8). The resolver does all the walking — it queries root, TLD, and authoritative servers on your behalf, then returns the answer. This is called recursion. Alternatively, the resolver can do an iterative query: it asks each server for a referral to the next level, without the server doing any extra work. The resolver itself follows the chain. Most end-user resolvers use recursion. Authoritative servers only answer for domains they own — they don't recurse. This separation of concerns is what makes DNS scalable.
DNS Caching: Speed vs. Freshness
Every DNS response includes a Time-To-Live (TTL) value in seconds. This tells the resolver how long to cache the record. Caching is essential — without it, every page load would trigger a full DNS walk, taking seconds. But caching is also the source of the classic 'DNS propagation delay' myth. There's no central propagation. Each resolver caches independently and respects TTL. If you change a DNS record, old cached entries persist until TTL expires. That's why you lower TTL before changes. Common TTLs: 300s (5 min) for dynamic environments, 86400s (24h) for stable records.
DNS Record Types: A, AAAA, CNAME, MX, and More
DNS records map domain names to various types of data. The most common: A (IPv4 address), AAAA (IPv6 address), CNAME (canonical name — alias to another domain), MX (mail exchange server), TXT (arbitrary text, often for SPF or verification), NS (nameserver), and SOA (start of authority — administrative info). A common mistake is using a CNAME for the root domain (e.g., example.com) — CNAMEs cannot coexist with other records at the same name. Use an ALIAS or A record for the root. For subdomains like www, CNAME is fine.
The Full DNS Lookup: Step by Step
Let's trace what happens when you type www.example.com in a browser. 1. Browser checks its own cache (Chrome: chrome://net-internals/#dns). 2. If not found, it asks the OS (which may have cached from other apps). 3. OS asks the configured resolver (usually your router or ISP). 4. Resolver checks its cache. 5. If not cached, resolver queries a root server (e.g., a.root-servers.net) for the .com TLD servers. 6. Root responds with a list of TLD servers for .com. 7. Resolver queries a .com TLD server (e.g., a.gtld-servers.net) for example.com's nameservers. 8. TLD responds with ns1.example.com and ns2.example.com. 9. Resolver queries ns1.example.com for www.example.com. 10. Authoritative server responds with the A record: 93.184.216.34. 11. Resolver caches the result for the TTL duration and returns it to the OS. 12. OS caches it and returns to browser. 13. Browser opens a TCP connection to that IP.
dig +trace. I've seen resolvers take 5+ seconds on cold cache — that's your page load time.DNS Security: DNSSEC and Spoofing
Standard DNS has no authentication. A malicious actor can spoof a DNS response and redirect users to a fake site (DNS cache poisoning). DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify authenticity. It uses a chain of trust from the root zone down to the domain. When DNSSEC is enabled, the resolver checks signatures. If a record is tampered with, the resolver returns SERVFAIL. However, DNSSEC adds complexity and latency. Many domains still don't use it. For critical services, always enable DNSSEC. The classic attack: Kaminsky attack (2008) allowed poisoning of recursive resolvers by flooding with fake responses. DNSSEC prevents this.
Common DNS Failures and How to Debug Them
DNS failures are insidious because they often look like network issues. The most common: NXDOMAIN (domain doesn't exist), SERVFAIL (server failure, often DNSSEC related), timeout (no response), and wrong IP (stale cache or misconfigured record). Debug with dig. For NXDOMAIN, check if the domain is registered and nameservers are correct. For SERVFAIL, check DNSSEC. For timeouts, check firewall rules (UDP port 53) and resolver availability. For wrong IP, check TTL and wait or flush cache. I once spent an hour debugging a 'connection refused' error only to find the A record pointed to an old server that had been decommissioned.
dig example.com SOA.The 24-Hour DNS Blackout
- Always lower TTL to 300 seconds at least 24 hours before any DNS change.
- Then wait for propagation before making the switch.
dig example.com from a server in the same region. 2. If NXDOMAIN, check domain registration and nameserver delegation. 3. Verify authoritative nameservers respond: dig @ns1.example.com example.com. 4. Check SOA record: dig example.com SOA. 5. If all else fails, contact domain registrar.dig example.com +ttlid. 2. If TTL is high (e.g., 86400), wait or flush caches. 3. Check if multiple A records exist (round-robin). 4. Verify all IPs are reachable: curl -I http://<ip>. 5. Consider using a traffic manager like Route53 latency-based routing.dig example.com +stats. 2. If query time > 1s, check resolver latency: dig @8.8.8.8 example.com. 3. If fast with 8.8.8.8, switch to a faster resolver. 4. Check if authoritative server is slow: dig @ns1.example.com example.com +stats. 5. Consider using a DNS caching proxy like dnsmasq locally.dig example.com SOAwhois example.comKey takeaways
Interview Questions on This Topic
How does DNS handle a CNAME record at the root domain, and what happens to other records like MX?
Frequently Asked Questions
20+ years shipping large-scale distributed systems. Written from production experience, not tutorials.
That's Networking. Mark it forged?
4 min read · try the examples if you haven't