DNS translates domain names into IP addresses, enabling every browser request, email delivery, and API call on the internet.
TL;DR DNS (Domain Name System) is a globally distributed database that translates human-readable domain names (like
example.com) into IP addresses (like93.184.216.34) that computers use to connect. A DNS lookup typically completes in under 100 milliseconds. Without DNS, every internet user would need to memorize numeric IP addresses instead of website names. DNS operates through a hierarchy of servers — resolvers, root servers, TLD servers, and authoritative servers — each handling part of the translation process.
What is DNS?
DNS (Domain Name System) is the internet’s naming system. It translates domain names into the IP addresses computers use to identify each other on a network.
DNS operates as a distributed, hierarchical database. No single server holds all DNS records — the data is split across millions of servers worldwide, each authoritative for its portion of the namespace.
How DNS works: the resolution process
When you type azion.com into a browser, DNS resolves it in up to six steps:
- Local cache check — Your device checks its own DNS cache. If a recent answer exists and hasn’t expired, it returns immediately.
- Recursive resolver — Your ISP or a public resolver (e.g.,
8.8.8.8) receives the query and checks its own cache. - Root server — If the resolver has no cached answer, it queries one of the 13 root server clusters, which direct it to the correct TLD server.
- TLD server — The TLD server (e.g., for
.com) directs the resolver to the authoritative name server for the domain. - Authoritative server — The authoritative server returns the actual DNS record (e.g., an A record with the IP address).
- Response delivery — The resolver caches the answer according to its TTL and returns the IP to your device.
A full DNS lookup from scratch typically takes 20–120 milliseconds. Cached lookups return in under 1 millisecond.
DNS record types
DNS stores different types of records. Each serves a specific purpose:
| Record type | Purpose | Example |
|---|---|---|
| A | Maps domain to IPv4 address | azion.com → 186.4.36.100 |
| AAAA | Maps domain to IPv6 address | azion.com → 2606:4700::1 |
| CNAME | Alias pointing to another domain | www.azion.com → azion.com |
| MX | Mail server for the domain | azion.com → mail.azion.com |
| TXT | Arbitrary text — used for SPF, DKIM, domain verification | "v=spf1 include:..." |
| NS | Authoritative name servers for the domain | azion.com → ns1.azion.com |
| SOA | Start of Authority — zone metadata | Serial number, refresh interval |
| PTR | Reverse lookup — IP to domain | 100.36.4.186 → azion.com |
The A record is the most common. The CNAME cannot be used at the zone apex (root domain) — use an ALIAS or ANAME record instead.
DNS TTL: how long records are cached
Every DNS record has a TTL (Time To Live), measured in seconds. TTL controls how long resolvers and clients cache the record before re-querying the authoritative server.
- A TTL of 300 (5 minutes) means changes propagate within 5 minutes.
- A TTL of 86400 (24 hours) is common for stable records — changes take up to 24 hours to reach all resolvers.
- Best practice before a migration: lower TTL to 300 at least 24 hours before the change, then raise it again after stabilization.
DNS propagation is not instantaneous. It is bounded by the TTL values already cached across resolvers worldwide.
DNS server types
| Server type | Role |
|---|---|
| Recursive resolver | Accepts queries from clients, performs the full lookup on their behalf, caches results |
| Root name server | 13 root clusters worldwide; directs resolvers to the correct TLD server |
| TLD name server | Manages top-level domains (.com, .org, .net); points to authoritative servers |
| Authoritative name server | Holds the actual DNS records for a domain; gives the final answer |
DNSSEC: verifying DNS answers
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that answers haven’t been tampered with. DNSSEC prevents cache poisoning and spoofing attacks.
DNSSEC does not encrypt DNS queries. For query privacy, use DNS over HTTPS (DoH) or DNS over TLS (DoT).
Common DNS problems and fixes
| Problem | Cause | Fix |
|---|---|---|
| Slow first visit, fast on return | Cold DNS cache miss | Normal behavior; reduce TTL or use anycast DNS |
| Site unreachable after migration | TTL too high when change was made | Lower TTL 24h before next change |
| NXDOMAIN error | Domain doesn’t exist or NS records misconfigured | Verify NS delegation and zone file |
| CNAME at zone apex fails | DNS spec doesn’t allow CNAME at root | Use ALIAS/ANAME or A/AAAA at apex |
| DNS spoofing risk | No DNSSEC | Enable DNSSEC on authoritative zones |
Frequently asked questions
What is DNS in simple terms? DNS is the system that translates website names into the numeric IP addresses computers use to connect. It works like a phone book for the internet — you look up a name, it returns a number.
What is the difference between DNS and DHCP? DNS translates domain names to IP addresses. DHCP automatically assigns IP addresses to devices on a network. They are complementary but separate systems.
How long does DNS propagation take? DNS propagation time depends on the TTL of the record being changed. A record with TTL 86400 (24 hours) can take up to 24 hours to update across all resolvers worldwide. Lowering TTL before a change reduces this window.
What happens when DNS fails? When DNS fails, domain names cannot be resolved into IP addresses. Browsers show errors like “DNS_PROBE_FINISHED_NXDOMAIN” or “Server not found.” The underlying servers may be working perfectly — only name resolution is broken.
What is an authoritative DNS server? An authoritative DNS server is the server that holds the actual DNS records for a domain. When a recursive resolver can’t answer from cache, it ultimately queries the authoritative server to get the definitive answer.
What is the difference between a DNS resolver and an authoritative server? A DNS resolver (also called recursive resolver) queries other servers on behalf of the client and caches results. An authoritative server holds the actual records and gives final answers. A resolver asks; an authoritative server answers.
Does DNS affect website speed? Yes. DNS lookup time adds to total page load time. A cold DNS lookup adds 20–120ms. Using low-latency, anycast authoritative DNS reduces this to under 10ms for most users globally.
What is DNS over HTTPS (DoH)? DNS over HTTPS encrypts DNS queries by sending them over HTTPS instead of plain UDP port 53. This prevents ISPs and network observers from seeing which domains you’re querying.