The Domain Name System (DNS) is one of the most fundamental technologies powering the internet. Every time you visit a website, send an email, or use an app, DNS is working behind the scenes to make it happen. This guide explains everything you need to know.
How DNS Works
At its core, DNS translates human-readable domain names (like example.com) into machine-readable IP addresses (like 93.184.216.34). Think of it as the internet's phone book — you look up a name, and it returns a number. Without DNS, you'd need to memorize IP addresses for every website you visit.
DNS is a distributed system — no single server holds all the records. Instead, authority is delegated across millions of servers worldwide, creating a hierarchical structure that's both resilient and fast.
The DNS Resolution Process
When you type a URL in your browser, a multi-step process happens in milliseconds:
Step 1: Browser Cache. Your browser first checks its local cache for a recent DNS lookup of the domain. If you visited the site recently, the answer may already be stored locally.
Step 2: Operating System Cache. If not found in the browser, the OS checks its own DNS cache, which may have results from other applications.
Step 3: Recursive Resolver. The query goes to a recursive DNS resolver — usually operated by your ISP or a public service like Cloudflare's 1.1.1.1 or Google's 8.8.8.8.
Step 4: Root Servers. The resolver queries one of the 13 root server clusters, which direct it to the appropriate TLD server (e.g., the servers responsible for .com domains).
Step 5: TLD Server. The TLD server returns the authoritative name server for the specific domain — this is the server that has the actual DNS records.
Step 6: Authoritative Server. The authoritative server returns the actual IP address for the domain. The resolver caches this result and returns it to your browser.
This entire process typically takes 20-120 milliseconds. Subsequent lookups for the same domain are nearly instant due to caching.
DNS Record Types
DNS records are instructions that tell resolvers how to handle requests for a domain. Here are the types you'll encounter most:
A Record: Maps a domain to an IPv4 address (e.g., example.com → 93.184.216.34). This is the most common record type and what makes your website accessible by name.
AAAA Record: Maps a domain to an IPv6 address. Functions identically to an A record but for the newer address format.
MX Record: Directs email to the correct mail server. Priority values determine the fallback order — lower numbers mean higher priority. Without MX records, email to your domain won't work.
CNAME Record: Creates an alias from one domain to another. Commonly used to point www.example.com to example.com, or to connect services like CDNs or email platforms.
TXT Record: Stores text data for various purposes. Most commonly used for SPF (email authentication), DKIM (email signing), domain verification (proving ownership to services like Google or Cloudflare), and DMARC policies.
NS Record: Delegates a zone to specific authoritative name servers. These tell the DNS system which servers are responsible for your domain's records.
SOA Record: Contains administrative information about the zone, including the primary nameserver, the responsible party's email, serial number, and refresh intervals.
You can inspect any domain's records using our free DNS lookup tool.
DNS Propagation
When you change a DNS record, the update doesn't take effect instantly worldwide. DNS propagation is the time it takes for the change to spread across all DNS resolvers globally. This typically takes 1-48 hours, depending on several factors.
The primary factor is TTL (Time to Live) — a value set on each DNS record that tells resolvers how long to cache it. A TTL of 3600 means resolvers will use their cached copy for up to 1 hour before checking for updates. Lower TTLs mean faster propagation but more DNS queries.
Pro tip: If you're planning a DNS change (like switching hosting providers), lower your TTL to 300 seconds (5 minutes) 24-48 hours before the change. Make the change, then raise the TTL back afterward.
Common DNS Mistakes
Setting a CNAME on the root domain. Many DNS providers don't allow CNAME records at the zone apex (example.com without www). Use an A record instead, or choose a provider that supports CNAME flattening (like Cloudflare).
Forgetting MX records after a DNS migration. When switching nameservers, all records need to be recreated on the new provider. Missing MX records means email silently stops working.
Not configuring SPF/DKIM/DMARC. Without proper email authentication records, your emails are more likely to land in spam folders. These TXT records are essential for deliverability.
Using high TTLs during migrations. If you change your hosting but had a 24-hour TTL, some visitors will see the old site for up to a day. Always lower TTL before making infrastructure changes.
DNS Security (DNSSEC)
DNSSEC adds a layer of security by digitally signing DNS records. This prevents DNS spoofing attacks where malicious actors could redirect your traffic to fake websites by poisoning DNS caches. While not universally deployed, DNSSEC adoption is growing.
Most major registrars now support DNSSEC — Cloudflare enables it with one click, and Namecheap and Porkbun offer straightforward setup. Check whether your registrar supports DNSSEC before committing, especially if security is a priority for your domain.
For more on choosing a registrar with strong DNS features, see our registrar selection guide.