What is DNS and how does a DNS lookup work?

What DNS does#

Computers route traffic by IP address, and people remember names. The Domain Name System is the distributed database that connects the two. You type www.example.com, your device asks DNS what address that name has, and only then can it open a connection. Nearly every page load, app request and email delivery starts with at least one lookup.

No single computer holds the whole database. Names are arranged in a hierarchy that reads right to left: the root, then a top-level domain such as .com, then the domain someone registered, example, then whatever they add on the left, such as www. Each level is run by a different party, and each one knows only who is responsible for the level below. That is what lets the system scale to hundreds of millions of names with no central list.

How a DNS lookup works#

1. Your device asks its resolver. The browser and operating system first check their own caches. If the answer is not there, they ask a recursive resolver: usually your ISP's, or a public one you chose, such as 1.1.1.1 or 8.8.8.8.
2. The resolver asks a root server. It does not know example.com, but it knows how to reach the root servers, which know who runs each top-level domain. The root replies with a referral to the .com servers, not with the answer.
3. The resolver asks a `.com` server. That server does not hold the record either. It knows which authoritative name servers the owner of example.com chose, and says so.
4. The resolver asks the authoritative server. This is the one place the actual record lives, so this time the reply is the answer: an address, such as 203.0.113.10.
5. The resolver answers you, and remembers. It returns the address and keeps a copy for as long as the record's time to live allows. The next person to ask gets the cached copy in milliseconds.

There are 13 root server addresses, named a.root-servers.net to m.root-servers.net. Each is served by many machines around the world using anycast, so there are far more than 13 physical servers. IANA publishes the list.

The record types you will meet#

PTR records work the other way round and are managed by whoever owns the address, not the domain: see reverse DNS.

Run a DNS lookup yourself#

The quickest way is the DNS lookup tool: type a domain, choose a record type or all of them, and read the answers with their TTLs. The same query from a terminal:

dig example.com A +short          # Linux, macOS
dig example.com MX
nslookup -type=MX example.com     # Windows, macOS, Linux
Resolve-DnsName example.com -Type A   # PowerShell

To follow the chain in the diagram, dig +trace example.com asks the root, then the top-level servers, then the authoritative servers directly, and prints every step.

DNS and privacy#

Every name you look up goes to your resolver, which therefore sees a list of the sites you visit even when the connections themselves are encrypted. Plain DNS is also unencrypted, so anyone on the path can read it and, in some networks, alter it.

• Encrypted DNS hides the queries from the network between you and the resolver. DNS over HTTPS (RFC 8484) and DNS over TLS both do this. Browsers and operating systems now support them.
• Your choice of resolver decides who sees the list. Your ISP's resolver, a public one such as Cloudflare's, Google's or Quad9's, and a resolver run by your VPN each have different policies. Read the one you use.
• A DNS leak is when a VPN is connected but DNS queries still go to your ISP's resolver, so the ISP can see every name you look up. The leak test checks for it.

Common questions#