How Does DNS Work?

// What is DNS?

The Domain Name System (DNS) is the internet's phone book. It translates human-readable domain names like google.com into machine-readable IP addresses like 142.250.74.46. Without DNS, you would need to memorise the IP address of every website you want to visit.

DNS is a distributed, hierarchical database. No single server holds all domain information — instead, responsibility is split across millions of servers worldwide. This design makes DNS fast, resilient, and scalable to billions of queries per day.

DNS operates primarily over UDP port 53 for speed, falling back to TCP port 53 for responses larger than 512 bytes or for zone transfers between authoritative servers.

// DNS Resolution Step by Step

When you type example.com into your browser, a complex lookup process happens in milliseconds:

// DNS Record Types

DNS stores information in resource records. Each record type serves a different purpose:

You can look up all DNS records for any domain using ip-tracker.eu — it queries A, AAAA, MX, NS, TXT, and SOA records in real time.

// TTL — Time to Live

Every DNS record has a TTL (Time to Live) value measured in seconds. TTL tells resolvers how long they may cache the record before re-querying the authoritative server.

When you change a DNS record, the change propagates globally only after the old TTL expires on all caching resolvers. This is why DNS changes can take up to 48 hours to "propagate" — older resolvers may serve cached data until their TTL runs out.

// The SOA Record

The Start of Authority (SOA) record is the first record in every DNS zone. It defines administrative information about the zone:

• Primary NS — the master nameserver for this zone
• Hostmaster — admin email (@ replaced with .)
• Serial — version number; slaves refresh when this increments
• Refresh — how often secondary servers check for updates
• Retry — how long to wait before retrying a failed refresh
• Expire — how long a secondary server can serve data without a successful refresh
• Minimum TTL — default TTL for negative responses (NXDOMAIN)

// Public DNS Resolvers

By default, your device uses the DNS resolver assigned by your ISP. You can override this with a faster or more privacy-focused public resolver:

Cloudflare's 1.1.1.1 consistently ranks as the fastest public resolver in global benchmarks, with average response times under 15 ms.

// DNSSEC — Securing DNS

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS responses, allowing resolvers to verify that the data hasn't been tampered with in transit. Without DNSSEC, attackers can perform DNS cache poisoning — injecting false records into a resolver's cache to redirect users to malicious sites.

DNSSEC uses a chain of trust from the root zone down to individual domain records. Each zone signs its records with a private key; resolvers verify the signature using the corresponding public key published in DNS.

DNSSEC protects against data forgery but does not encrypt DNS queries. For query privacy, use DNS over HTTPS (DoH) or DNS over TLS (DoT).

// DNS Privacy — DoH and DoT

Traditional DNS queries are sent in plaintext over UDP, meaning your ISP, network administrators, and anyone on the network path can see every domain you look up. Two protocols address this:

DNS over HTTPS (DoH)

DoH sends DNS queries over HTTPS (port 443), making them indistinguishable from regular web traffic. Supported natively by Firefox, Chrome, and Edge. Cloudflare, Google, and NextDNS offer DoH endpoints.

DNS over TLS (DoT)

DoT encrypts DNS queries using TLS on a dedicated port (853). More transparent than DoH — network administrators can allow or block it by port, while DoH blends with HTTPS traffic.

// Common DNS Tools

These command-line tools let you query DNS directly:

Or use ip-tracker.eu for a visual DNS lookup with no command line required.

// Related Articles