Networking for Beginners

DNS

Learn how DNS turns names like example.com into IP addresses, what happens when you type a URL, what DNS records are, and how to query and troubleshoot DNS yourself.

~27 min Beginner

The problem DNS solves

Computers connect to each other using IP addresses such as 93.184.216.34. People are bad at remembering numbers like that, but they can remember names like example.com.

DNS (Domain Name System) is the system that translates a name into an IP address. You type a name, DNS returns the number, and your browser connects to that address. The lookup happens on every new site you visit, and you normally never notice it.

What happens when you type a URL

You type www.example.com and press Enter. Before any page loads, this happens:

  1. Your device checks its own cache. If it looked up this name recently, it already has the answer and stops here.
  2. It asks a DNS resolver. This is usually run by your internet provider, or by a public service such as Google (8.8.8.8) or Cloudflare (1.1.1.1).
  3. The resolver works its way to the answer if it does not already know it. It asks a root server which servers handle .com, then asks a .com server which servers handle example.com, then asks that domain's own authoritative server, which holds the real answer.
  4. The answer travels back, and the resolver keeps a copy for a while.
  5. Your browser connects to the IP address it received.

This normally takes a few milliseconds, and the cached answer makes the next lookup even faster.

Caching and TTL

If every lookup travelled to the root servers, the internet would be much slower. Answers are therefore cached (stored for reuse) in several places: your browser, your operating system and your resolver.

Each DNS record has a TTL (time to live), a number of seconds that says how long the answer may be kept. A TTL of 300 means the answer can be reused for 5 minutes before it must be looked up again.

  • A long TTL means fewer lookups and faster browsing.
  • A short TTL means changes reach users sooner. Administrators often shorten the TTL before moving a site to a new server.

This is why a DNS change can take time to "propagate". Caches around the world expire at different moments.

DNS records

A domain's settings are stored as records. These are the ones you will see most:

  • A: name to IPv4 address. example.com points to 93.184.216.34.
  • AAAA: name to IPv6 address.
  • CNAME: an alias that points one name to another name. www.example.com can point to example.com.
  • MX: the mail servers that receive email for the domain.
  • TXT: free text, often used to prove you own a domain or to help fight spam.
  • NS: the name servers that are in charge of the domain.

Look up records yourself

nslookup example.com
dig example.com
dig example.com MX
dig +short example.com

nslookup is available on almost every system. dig gives more detail: it shows the question, the answer and the TTL. Adding +short trims the output to just the answer, and a record type such as MX asks for that type instead of the default A record.

If a site opens when you type its IP address but not when you type its name, DNS is the likely cause.

Reading dig output

A normal dig example.com prints an answer section like this:

;; ANSWER SECTION:
example.com.   3600   IN   A   93.184.216.34

Read it from left to right: the name, the TTL in seconds (3600 is one hour), the class (IN means Internet), the record type (A) and finally the answer, which is the IP address.

dig example.com MX shows the mail servers in the same layout, and dig example.com NS shows the name servers in charge of the domain.

Public DNS servers

Your router normally passes on your provider's DNS servers, but you can use another one:

  • Google: 8.8.8.8 and 8.8.4.4
  • Cloudflare: 1.1.1.1
  • Quad9: 9.9.9.9, which blocks known malicious domains

Some are faster, and some add privacy or filtering. Switching takes a minute and is worth trying if browsing feels slow or your provider's DNS is unreliable.

When DNS goes wrong

Most DNS problems come from one of these:

  • The DNS server is unreachable. Everything by name fails, but pinging a number such as 8.8.8.8 still works.
  • A stale cache. You keep getting the old address after a change. Clear the cache with ipconfig /flushdns on Windows or resolvectl flush-caches on many Linux systems.
  • A wrong record. The domain points to the wrong address, often because of a typing mistake by the owner.
  • A bad hosts file entry. The computer never asks DNS because a local file answered first.

A good first test is to ask a different resolver directly:

dig @1.1.1.1 example.com

If that works and your normal lookup does not, the problem is your usual resolver.

The hosts file

Before it asks any DNS server, your computer checks a local file called the hosts file:

  • Linux and macOS: /etc/hosts
  • Windows: C:\Windows\System32\drivers\etc\hosts
127.0.0.1      localhost
192.168.1.50   myserver.local

Developers use it to point a name at a test machine. Attackers sometimes edit it to send you to a fake site, which is one reason the file is protected and why an unexpected entry in it deserves attention.

Sign up to track your progress Mark lessons as read and pick up where you left off Sign up free to unlock this practice Your first practice lesson is free to try. Create an account to unlock the rest and save your progress
Previous TCP, UDP and Ports Next Routers and NAT