How DNS Works: From Domain Name to IP Address

Type example.com into a browser and a page appears almost instantly. Between those two moments, a distributed database spanning the entire planet answered a question: what IP address belongs to this name? That system is DNS, the Domain Name System.

It is worth understanding properly, because nearly every confusing website problem — a change that has not taken effect, email vanishing, a site working on one device but not another — traces back to how DNS resolution and caching actually behave.

The four participants

• The stub resolver — the small DNS client built into your operating system. It knows almost nothing and delegates immediately.
• The recursive resolver — usually run by your ISP, or a public one like 1.1.1.1 or 8.8.8.8. This is the workhorse that chases the answer down and caches it.
• Root and TLD servers — they do not know the answer, but they know who does. Root points to .com; the .com TLD servers point to the domain's own nameservers.
• Authoritative nameservers — the servers that hold the domain's real records. Whatever they say is, by definition, the truth.

A lookup, step by step

1. 1

   Check the local caches first

   Your browser has its own DNS cache, and so does your OS. If either holds an unexpired answer for example.com, the lookup is over in microseconds and no network traffic happens at all.

2. 2

   Ask the recursive resolver

   On a miss, the stub resolver sends the query to the configured recursive resolver — one UDP packet, usually on port 53.

3. 3

   Resolver asks a root server

   If the resolver has nothing cached, it starts at the top. The root server does not know example.com, but replies: here are the nameservers for .com.

4. 4

   Resolver asks the TLD servers

   The .com servers reply with a referral: the authoritative nameservers for example.com are these. Still not the answer — another pointer.

5. 5

   Resolver asks the authoritative nameserver

   This one has the actual zone file. It returns the A record: 93.184.216.34, along with a TTL saying how long the answer may be reused.

6. 6

   The answer is cached and returned

   The resolver caches the result for the TTL duration, hands it to your OS, which hands it to the browser. Only now can a TCP connection to the server begin.

Recursive versus authoritative: the distinction that matters

People blur these constantly, and it causes real debugging mistakes.

The practical consequence: when you change a DNS record, the authoritative server updates instantly. Every recursive resolver on earth keeps serving its cached copy until the TTL expires. That gap is what people call DNS propagation.

What a resolver actually returns

A response is more than an address. It carries a record type, a value, and a TTL — plus flags saying whether the answer was authoritative or served from cache. A single domain publishes many record types at once: A and AAAA for addresses, MX for mail routing, NS for its nameservers, and TXT for verification and policy.

example.com.    3600    IN    A        93.184.216.34
example.com.    3600    IN    AAAA     2606:2800:220:1::248
example.com.    3600    IN    MX       10 mail.example.com.
example.com.   86400    IN    NS       ns1.example.com.

The number after the name is the TTL in seconds. IN means the internet class. The rest is the record type and its value.

Where DNS goes wrong in practice

• The change has not propagated. The authoritative server is correct; a cache between you and it is not. Nothing to fix — only to wait out.
• Nameservers point to the wrong provider. You edited records at your registrar, but the domain delegates to your host's nameservers, so the edits are ignored.
• A missing trailing dot. In a zone file, mail.example.com without the trailing dot can be interpreted relative to the zone, producing mail.example.com.example.com.
• No AAAA record but IPv6-only clients. The site is unreachable for them while working perfectly for everyone else.

You can see every one of these records for any domain with the lookup tool on the homepage — it queries them independently, so a domain missing one type still shows the rest.