Curious TechieDev Toolbox
← All Guides/NETWORKING & INFRASTRUCTURE•8 min read

What is DNS & How Does It Work?

A deep architectural breakdown of hierarchical name resolution, record types, caching mechanics, and encrypted DNS-over-HTTPS protocols.

ⓘKey Takeaways
  • DNS translates human-readable hostnames (e.g. google.com) into machine-routable IP addresses (e.g. 142.250.190.46 or 2607:f8b0:4005:805::200e).
  • Queries traverse a hierarchical resolution tree: Stub Resolver → Recursive Resolver → Root Servers (.) → TLD Servers (.com) → Authoritative Nameservers.
  • Common record types serve distinct roles: A (IPv4), AAAA (IPv6), MX (Mail Exchange), TXT (SPF/DKIM/Domain verification), CNAME (Canonical aliases), and CAA (Certificate Authority Authorization).
  • DNS-over-HTTPS (DoH, RFC 8484) and DNS-over-TLS (DoT, RFC 7858) encrypt queries to prevent ISP snooping, cache poisoning, and Man-in-the-Middle spoofing.
  • Time-to-Live (TTL) values control recursive caching duration, balancing DNS load against update propagation latency.

1. What is the Domain Name System (DNS)?

The Domain Name System (DNS) is the decentralized global naming system that translates human-memorable domain names (like curious-techie.com) into numerical IP addresses (such as 104.21.45.12 or 2606:4700:3037::6815:2d0c) needed for routing network packets across the Internet.

Standardized primarily by RFC 1034 and RFC 1035 in 1987, DNS functions as an enormous globally distributed key-value database designed to withstand single points of failure through extensive hierarchical caching and redundant server clustering.

2. The 4-Step Resolution Hierarchy

When your browser navigates to a new domain, if the IP address is not already cached locally in the operating system or browser cache, a recursive resolution sequence begins:

1. Stub Resolver (Your Device) → Requests IP from Local Recursive DNS (e.g. 1.1.1.1 or 8.8.8.8)
2. Recursive Resolver → Queries Root Name Server (.) for the Top-Level Domain (TLD)
3. TLD Name Server (.com) → Returns Authoritative Nameservers for example.com (e.g. ns1.cloudflare.com)
4. Authoritative Nameserver → Returns the final A / AAAA record with IP address + TTL

3. Essential DNS Record Types

TYPEPURPOSESAMPLE VALUE
AMaps hostname to 32-bit IPv4 address93.184.216.34
AAAAMaps hostname to 128-bit IPv6 address2606:2800:220:1:248:1893:25c8:1946
MXSpecifies priority-ordered mail servers10 mail.example.com
TXTArbitrary text for SPF, DKIM, verificationv=spf1 include:_spf.google.com ~all
CNAMECanonical alias pointing one name to anotherdocs.example.com → cdn.vendor.io
CAARestricts authorized TLS Certificate Authorities0 issue "letsencrypt.org"

4. DNS Security: DNSSEC, DoH & DoT

Legacy DNS operated unencrypted over UDP port 53, leaving traffic vulnerable to ISP tracking, surveillance, and cache poisoning (Kaminsky attacks). Modern security extensions address these risks:

  • DNSSEC (DNS Security Extensions): Signs DNS records cryptographically using public-key cryptography to guarantee authenticity and prevent DNS spoofing.
  • DNS-over-HTTPS (DoH, RFC 8484): Encapsulates DNS queries in encrypted HTTP/2 or HTTP/3 sessions over HTTPS port 443, making DNS lookups indistinguishable from regular web traffic.
  • DNS-over-TLS (DoT, RFC 7858): Encrypts raw DNS protocol queries using TLS over dedicated port 853.

5. Diagnosing Propagation & TTL Issues

When changing DNS records, Time-to-Live (TTL) specifies how many seconds intermediate recursive resolvers are allowed to cache the old record before querying authoritative servers again.

Setting a lower TTL (e.g. 300s / 5 minutes) 24 hours prior to a planned server migration ensures fast traffic redirection with minimal downtime.