1st Principles
Menu

Networking · 34 min read

DNS

The distributed naming system that turns human-readable names into machine-routable addresses and other records, via hierarchy, caching, and delegation.

Why this exists

People remember names; routers need numbers (and other structured data). A single global phone book cannot be hosted on one machine or updated by one organization.

DNS is the internet's hierarchical, cached, delegated directory: names map to addresses and service data without centralizing every lookup on one server.

Almost every higher-layer story (HTTP, email, TLS name checks) begins with a DNS answer. When DNS is wrong, higher layers look haunted.

Axioms & primitives

  1. 01Names are looked up via a hierarchy of resolvers and authoritative servers.
  2. 02Caching makes DNS fast and occasionally stale.
  3. 03DNS answers are data; integrity and authenticity require extra mechanisms (for example DNSSEC) when stakes demand them.
  4. 04Delegation mirrors organizational ownership of zones.
  5. 05Clients usually talk to a recursive resolver; that resolver does the iterative hunting.
  6. 06TTLs are contracts about cache lifetime, not magical global propagation waves.

Learning objectives

After this lesson you should be able to:

  • Trace a recursive lookup from stub resolver to authoritative answer at a high level.
  • Explain what a TTL controls and how it affects both freshness and load.
  • List at least four RR types beyond A/AAAA and what problem each solves.
  • Diagnose whether a failure is NXDOMAIN, SERVFAIL, or a local cache issue.
  • Explain why changing a record is not instantaneous for all users worldwide.

Progressive depth

Read the layers in order for a full explanation. Or open the layer you need.

01

Intuition

Typing a website name starts a scavenger hunt: your device asks a resolver, which may ask root servers, top-level domain servers, and finally the name's authority, unless a cache already knows.

You rarely speak to the root yourself. Your ISP or public resolver does the walking and remembers answers for a while.

The hunt returns more than addresses. Mail routing, service discovery, and security policies also live as DNS records.

02

Formal shape

Recursive resolvers chase delegations until they obtain an answer or an error. Authoritative servers own zones. Records bind names to values with TTLs.

Common RR types: A/AAAA (addresses), NS (delegation), MX (mail exchangers), CNAME (aliases), TXT (arbitrary text; often policy), SRV (service location), CAA (certificate authority authorization).

Failures include NXDOMAIN (name does not exist), SERVFAIL (resolver trouble), REFUSED, and timeouts. Truncation may trigger TCP retry. DNS over TLS/HTTPS encrypts the stub-to-resolver leg.

Glue records prevent chicken-and-egg delegation problems when a zone's name servers live inside the zone itself.

DNS resolution walk

Click a stage to follow the scavenger hunt this page describes: resolver walking root, TLD, then authority.

Loading diagram...

Select a stage to read the boundary detail.

03

Worked examples

Deploying a new site: create an A/AAAA or CNAME at your DNS host pointing to your server or CDN. Users with cached old answers wait until TTL expiry (and sometimes longer if stubborn middle caches exist).

Email deliverability depends on MX and often TXT records (SPF/DKIM/DMARC). Those are still DNS, not a separate mystical mail internet.

dig +trace or iterative mental simulation: root hint -> TLD NS -> apex NS -> answer for www. Comparing answers from different resolvers reveals caching and split-horizon effects.

CNAME chain: www.example.com -> example.cdn.net -> address records. Each step has its own TTL and failure modes.

04

Edge cases

DNS can be censored, spoofed on local networks, or used as a covert channel. DoH/DoT encrypt lookups to resolvers but do not by themselves authenticate the entire name system end to end (DNSSEC is the authenticity story for zone data).

Split-horizon DNS shows different answers inside a company than outside. Useful for internal services; confusing when a laptop moves networks.

Anycast roots and TLDs are critical infrastructure with operational and geopolitical realities.

NXDOMAIN caching (and aggressive negative caching) can make a briefly wrong denial linger. TTL zero is not a magic 'push update now' button for every resolver on earth.

Mental models

  • Library catalog

    You ask the front desk; they may know, or send you to the right wing. Delegation mirrors organizational ownership of names.

  • Sticky notes (TTL)

    Caches keep answers for a time-to-live. Shorter TTL means fresher data and more lookup load.

  • Phone tree

    Root knows who runs .com; .com knows who runs example.com; example.com answers for www.

  • Bulletin board with expiry dates

    Each posted answer has a take-down date. After that, you must ask authority again.

Common misconceptions

  • Myth

    DNS only maps names to IPv4 addresses.

    Reality

    DNS carries many record types: A/AAAA, MX, TXT, CNAME, SRV, NS, and more.

  • Myth

    Flushing DNS always fixes the internet.

    Reality

    It clears one cache layer. Failures may be authoritative misconfiguration, deeper caches, or unrelated outages.

  • Myth

    DNS is always instantaneous and global at once.

    Reality

    Propagation is mostly cache expiry and resolver behavior, not a mystical wave.

  • Myth

    If dig works, the browser must resolve the same way.

    Reality

    Browsers and OSes may use different resolvers, DoH, or caches. Split-horizon answers differ by network.

Exercises

Work these without looking up answers first. Check yourself against the intent notes.

  1. Exercise 01

    A record's TTL is 3600 seconds. You change the A record. Why might some users still hit the old IP an hour later?

    What good looks like

    Resolvers and stub caches may retain the old answer until TTL expiry; some layers may cache longer incorrectly.

  2. Exercise 02

    Outline the queries a cold recursive resolver makes for www.example.com assuming no cache.

    What good looks like

    Root hint -> TLD NS -> example.com NS -> A/AAAA for www (details may include referrals). Mentions NS lookups.

  3. Exercise 03

    You see NXDOMAIN at home but the name resolves on your phone's LTE. Give two plausible DNS-layer explanations.

    What good looks like

    Split horizon / ISP filter / poisoned or stale local resolver vs clean recursive on mobile; different DoH settings.

Sources & further reading

External references. Prefer primary documents and clear explainers.

Go deeper on your own

These picks go past the foundation in this lesson. Use them when you want a primary spec, official docs, or a longer walkthrough.