How DNS and Domain Names Work Together
The journey from typing a domain to loading a website — step by step.
The big picture
DNS (Domain Name System) is a distributed, hierarchical database that maps human-readable names (example.com) to machine-readable addresses (93.184.216.34 or 2606:2800:220:1:248:1893:25c8:1946).
Resolution walkthrough
When you type https://www.example.com in your browser:
- Browser checks cache — Has it resolved this recently? If yes, skip to step 8.
- OS resolver checks cache — Same idea at the OS level.
- Recursive resolver — Your ISP, Google (8.8.8.8), Cloudflare (1.1.1.1), or a custom resolver. It starts the recursive query.
- Root name servers — Resolver asks a root server (a.root-servers.net through m.root-servers.net): "Where is
.com?" Root responds with the.comTLD name servers (a.gtld-servers.net through m.gtld-servers.net). - TLD name servers — Resolver asks a
.comTLD server: "Where isexample.com?" TLD responds with the authoritative name servers forexample.com(e.g.ns1.example.com,ns2.example.com). - Authoritative name servers — Resolver asks
ns1.example.com: "What is the A record forwww.example.com?" Authoritative responds with the IP address. - Response cached — Resolver caches the answer (TTL seconds) and returns it to your OS/browser.
- Browser connects — Browser opens a TCP/TLS connection to the IP, sends HTTP request, receives the page.
Key DNS record types
| Type | Purpose | Example |
|---|---|---|
| A | IPv4 address | 93.184.216.34 |
| AAAA | IPv6 address | 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME | Alias to another name | www → example.com |
| MX | Mail exchanger | 10 mail.example.com |
| TXT | Arbitrary text (SPF, DKIM, verification) | v=spf1 include:_spf.google.com ~all |
| NS | Name server delegation | ns1.example.com |
| SOA | Start of authority (zone metadata) | Serial, refresh, retry, expire, minimum |
| CAA | Certification Authority Authorization | 0 issue "letsencrypt.org" |
TTL (Time To Live)
Every record has a TTL (seconds) telling resolvers how long to cache it.
- Low TTL (60–300s) = fast changes, more query load.
- High TTL (3600–86400s) = slower changes, less load.
- Common pattern: 300–1800s for active records; 86400s for stable ones.
DNSSEC
DNSSEC adds cryptographic signatures to DNS records so resolvers can verify authenticity. It prevents cache poisoning and spoofing.
- Chain of trust: Root → TLD → Domain.
- Not universally deployed, but growing.
- Your registrar/registry manages keys; you just enable it.
Common misconceptions
- "DNS is a single database"
- It's distributed — millions of servers, no central database for all records.
- "Changing DNS is instant"
- Propagation = cache expiry. Old TTLs must expire globally.
- "My registrar controls my DNS"
- You can point NS records to any DNS provider.
- "A record = website"
- A record = IP. The web server at that IP serves the site.