DNS protocol

What DNS does

Applications need addresses to reach services, but people prefer names such as www.example.com. DNS answers questions about those names. The familiar question is “what IP address belongs to this host?”, but DNS also says where email should go, which servers know about a domain, and how a domain proves certain policies.

It is distributed: no single machine stores every answer. Responsibility is delegated down a tree and organisations manage their own portion. It is also cached: an answer can be reused for a stated time, making the system fast and resilient.

Names form a hierarchy

Read a fully qualified domain name from right to left. In www.shop.example.com., the final dot represents the DNS root, com is a top-level domain, example is registered beneath it, and shop and www are names managed inside that domain.

A zone is an administratively managed part of that tree, held on authoritative name servers. A domain and a zone are related but not always identical: a parent can delegate a child domain into its own zone.

DNS names ignore letter case. A complete name may be up to 255 octets on the wire, with each label limited to 63. Internationalised display names are represented in DNS using ASCII-compatible encoding (often visible as xn--…).

A lookup, step by step

Suppose a browser needs the address for www.example.com and nothing useful is cached.

1. The application asks a stub resolver. This small resolver in the operating system sends the question to a recursive resolver configured by DHCP, manually, or by the application.
2. The recursive resolver asks a root server. The root does not know the host address; it refers the resolver to the name servers for .com.
3. It asks a .com server. That server refers it to the authoritative name servers for example.com, including the addresses needed to reach them when necessary.
4. It asks an authoritative server. That server returns the requested record, or a CNAME leading to another name that must be resolved.
5. It caches and returns the answer. The recursive resolver sends the result to the client and keeps it until its TTL expires.

The client made one recursive request: it wanted a final answer. The resolver performed a series of mostly iterative requests, following referrals through the hierarchy.

Who does what?

A registrar sells and manages domain registrations. A DNS hosting provider operates authoritative servers. They may be the same company, but they perform different jobs.

Common DNS record types

A CNAME aliases one name, not an HTTP URL: it cannot redirect a browser to a different path. MX and SRV priorities use lower numbers first; SRV weights distribute work among equal-priority targets.

Caching, TTL and “propagation”

Each answer has a time to live (TTL) in seconds. A cache counts it down and may reuse the answer while time remains. This greatly reduces delay and load.

When a record changes, there is no wave that actively “propagates” to every resolver. Authoritative servers publish the new value, while independent caches continue returning the old one until its previous TTL expires. Lowering the TTL before a planned migration shortens this overlap—but only after the old, longer TTL has itself aged out.

Negative answers can be cached too. A resolver that recently learned a name does not exist may continue saying so for the zone’s negative-cache interval even after the name is created.

Transport, privacy and authenticity

Traditional DNS usually uses UDP port 53 because a question and answer fit in one small exchange. It uses TCP when needed, including many zone transfers and responses that do not fit or are marked truncated. EDNS extends message capabilities and permits larger UDP payloads, though oversized packets can fragment and fail.

Encryption hides questions from observers on the local path but moves trust to the resolver. DNSSEC and encrypted DNS solve different problems and can be used together.

Failures and useful tools

dig shows records, flags, TTLs and responding servers; dig +trace follows delegation from the root. nslookup is widely available. resolvectl can show a Linux system’s configured resolvers and cache state. Always ask the same question of both the normal recursive resolver and the authoritative server: the difference often reveals a stale cache or publication problem.