100% Client-Side Computation • Zero Server Logs • Instant Execution
Curious TechieDev Toolbox
← All Guides/Networking•8 min read

What is DNS & How Does It Work?

A deep architectural breakdown of hierarchical name resolution, record types, caching mechanics, and encrypted DNS-over-HTTPS protocols.

ⓘKey Takeaways
  • DNS translates human-readable domain names into machine-routable IP addresses (IPv4 & IPv6).
  • Resolution follows a strict hierarchy: Recursive Resolver → Root Server → TLD Server → Authoritative Nameserver.
  • Core DNS record types include A (IPv4), AAAA (IPv6), CNAME (Alias), MX (Mail), and TXT (SPF/DKIM).
  • Modern DNS encrypts queries using DNS-over-HTTPS (DoH, RFC 8484) and DNS-over-TLS (DoT, RFC 7858) to prevent ISP surveillance.

1. What is the Domain Name System (DNS)?

The Domain Name System (DNS) is the decentralized global naming system that translates human-memorable domain names (like curious-techie.com) into numerical IP addresses (such as 104.21.45.12 or 2606:4700:3037::6815:2d0c) needed for routing network packets across the Internet.

Standardized primarily by RFC 1034 and RFC 1035 in 1987, DNS functions as an enormous globally distributed key-value database designed to withstand single points of failure through extensive hierarchical caching and redundant server clustering.

2. The 4-Step Resolution Hierarchy

When your browser navigates to a new domain, if the IP address is not already cached locally in the operating system or browser cache, a recursive resolution sequence begins:

1. Stub Resolver (Your Device) → Requests IP from Local Recursive DNS (e.g. 1.1.1.1 or 8.8.8.8)
2. Recursive Resolver → Queries Root Name Server (.) for the Top-Level Domain (TLD)
3. TLD Name Server (.com) → Returns Authoritative Nameservers for example.com (e.g. ns1.cloudflare.com)
4. Authoritative Nameserver → Returns the final A / AAAA record with IP address + TTL

3. Essential DNS Record Types

TYPEPURPOSESAMPLE VALUE
AMaps hostname to 32-bit IPv4 address93.184.216.34
AAAAMaps hostname to 128-bit IPv6 address2606:2800:220:1:248:1893:25c8:1946
MXSpecifies priority-ordered mail servers10 mail.example.com
TXTArbitrary text for SPF, DKIM, verificationv=spf1 include:_spf.google.com ~all
CNAMECanonical alias pointing one name to anotherdocs.example.com → cdn.vendor.io
CAARestricts authorized TLS Certificate Authorities0 issue "letsencrypt.org"

4. DNS Security: DNSSEC, DoH & DoT

Legacy DNS operated unencrypted over UDP port 53, leaving traffic vulnerable to ISP tracking, surveillance, and cache poisoning (Kaminsky attacks). Modern security extensions address these risks:

  • DNSSEC (DNS Security Extensions): Signs DNS records cryptographically using public-key cryptography to guarantee authenticity and prevent DNS spoofing.
  • DNS-over-HTTPS (DoH, RFC 8484): Encapsulates DNS queries in encrypted HTTP/2 or HTTP/3 sessions over HTTPS port 443, making DNS lookups indistinguishable from regular web traffic.
  • DNS-over-TLS (DoT, RFC 7858): Encrypts raw DNS protocol queries using TLS over dedicated port 853.

5. Diagnosing Propagation & TTL Issues

When changing DNS records, Time-to-Live (TTL) specifies how many seconds intermediate recursive resolvers are allowed to cache the old record before querying authoritative servers again.

Setting a lower TTL (e.g. 300s / 5 minutes) 24 hours prior to a planned server migration ensures fast traffic redirection with minimal downtime.