DNS Resolution

The Domain Name System (DNS) translates human-readable names like example.com into the IP addresses machines use to talk to each other. Resolution is a hierarchical, cached walk: the browser asks a recursive resolver, which asks a root server, then a TLD server, then the authoritative nameserver for the domain, caching the answer at every level for the record’s TTL.

Mental Model

DNS (Domain Name System) acts as the phonebook of the internet, translating human-readable domain names (like example.com) into machine-readable IP addresses (like 93.184.216.34).

The resolution process is a hierarchical, distributed query system:

1. The Browser checks its local cache.
2. The Operating System checks its hosts file and system cache.
3. The query is forwarded to a Recursive Resolver (your ISP or public services like Cloudflare 1.1.1.1 or Google 8.8.8.8).
4. If the resolver doesn’t have it cached, it queries the Root Server (.), which points it to the Top-Level Domain (TLD) Server (like .com).
5. The resolver queries the TLD server, which points it to the Authoritative Nameserver for the specific domain.
6. The resolver gets the final record and returns it to the client, caching it at every level along the way based on its TTL (Time to Live).

Components and Why They Exist

Browser

The browser initiates hostname lookups whenever a user navigates to a domain, checking its own in-memory DNS cache before asking the operating system. Its card shows the initial local cache check and the live TTL countdown on cached IP entries.

OS DNS Client

The operating system stub resolver maintains a system-wide DNS cache and /etc/hosts table shared by all local applications. When a browser lookup misses, the OS card checks its local cache and forwards unresolved queries over the network to the Recursive Resolver.

Recursive Resolver

The recursive resolver walks the DNS hierarchy on behalf of the client, turning a single recursive request into a sequence of iterative queries so user devices do not have to chase referrals themselves. Iterative query arrows fan out from the resolver card to the Root, TLD, and Authoritative servers before the final answer is cached and returned.

Root Server (.)

The root nameserver sits at the top of the DNS hierarchy and directs resolvers toward the appropriate Top-Level Domain (TLD) registry. It inspects the domain suffix on incoming queries and returns a referral response containing the .com TLD nameserver addresses.

TLD Server (.com)

The Top-Level Domain (TLD) server maintains the delegation records for every domain registered under its extension, such as .com or .org. When queried by the recursive resolver, the TLD card returns a referral pointing to the domain’s Authoritative Nameserver IP.

Authoritative Server (ex.com)

The authoritative nameserver holds the definitive zone file (A, AAAA, CNAME, and MX records) configured by the domain owner. It answers the resolver’s final iterative query with the authoritative IP address and record TTL along a green response path.

Edge Cases and Misconceptions

• Anycast routing vs physical location: Root and TLD servers are not single physical servers in one room. They use Anycast routing, meaning the same IP address is advertised globally by multiple data centers. Routers send the query to the topologically nearest physical instance, making the root queries much faster than they appear.
• Iterative vs Recursive queries: Clients (like browsers) perform recursive queries to resolvers, meaning they expect the resolver to do all the work and return the final answer. Resolvers perform iterative queries to Root, TLD, and Authoritative servers, meaning they receive referrals and must execute each subsequent step themselves.
• CNAME lookup overhead: A CNAME (Canonical Name) record is an alias pointing to another domain name. If a domain points to a CNAME, the resolver must restart the entire resolution process for the target domain name, doubling the lookup latency.
• Negative caching: When a domain does not exist, nameservers return an NXDOMAIN (Non-Existent Domain) response. Resolvers cache this negative response for a duration defined by the zone’s SOA (Start of Authority) record, preventing clients from DDoS-ing nameservers with requests for nonexistent sites.