Every time you type a website address into your browser, something invisible happens in the background that makes the whole internet work. That invisible system is called DNS, the Domain Name System, and without it, you would have to memorize a string of numbers just to visit your favourite sites. DNS is one of the oldest and most critical pieces of internet infrastructure, yet most people have never heard of it until something goes wrong. This guide breaks down exactly what DNS is, how it works from start to finish, and why understanding it gives you real power over your internet experience.
What DNS Actually Is
DNS stands for Domain Name System. At its core, it is a giant distributed phone book for the internet. When you type example.com into your browser, your computer does not inherently know where that website lives. Websites live on servers, and servers are identified by IP addresses, numerical labels like 93.184.216.34. Humans are terrible at remembering strings of numbers, so DNS was invented to map human-readable domain names to machine-readable IP addresses.
The system was created in 1983 by Paul Mockapetris and replaced a single flat text file called HOSTS.TXT that everyone on the early internet shared. As the internet grew, a single file became unmanageable, and the hierarchical, distributed DNS system took its place. Today, DNS handles billions of queries every single day without most users ever noticing it.
The DNS Hierarchy Explained
DNS is not a single server somewhere. It is a layered, distributed system with several types of components working together. Understanding the hierarchy makes everything else click into place.
Root Name Servers
At the very top sit 13 sets of root name servers, labelled A through M, operated by organizations like ICANN, Verisign, and NASA. These servers do not know where every website is, but they know where to find the authoritative servers for every top-level domain like .com, .net, .ca, and .org. There are actually hundreds of physical machines behind those 13 logical addresses, distributed around the world using a technique called anycast routing.
Top-Level Domain (TLD) Servers
Below the root servers sit TLD servers. When you query for example.com, a root server points your query to the .com TLD servers. Those servers know which authoritative name servers are responsible for example.com specifically. Every domain extension has its own TLD server cluster.
Authoritative Name Servers
These are the servers that hold the actual DNS records for a domain. When your domain registrar or hosting provider publishes DNS records, those records live on authoritative name servers. This is the final stop in a DNS lookup, where your query gets a real answer, an IP address or another record type.
Recursive Resolvers
Your device does not talk directly to root servers. Instead, it talks to a recursive resolver, also called a recursive nameserver or DNS resolver. This is typically provided by your Internet Service Provider, or you can use a public one like Google (8.8.8.8), Cloudflare (1.1.1.1), or OpenDNS (208.67.222.222). The resolver does the heavy lifting: it queries the root servers, then the TLD servers, then the authoritative servers, and finally returns the answer to your device.
How a DNS Query Works Step by Step
Here is what happens in roughly 50 milliseconds when you type dnschecker.ca into your browser and press Enter.
- Browser cache check: Your browser first checks its own internal DNS cache. If it has recently looked up this domain, it uses the stored answer and skips the rest of the steps.
- Operating system cache: If the browser has no answer, it asks the operating system. Windows, macOS, and Linux all maintain their own DNS cache.
- Recursive resolver query: Your OS sends the query to your configured DNS resolver, usually your ISP or a public resolver like 1.1.1.1.
- Root server query: If the resolver has no cached answer, it asks a root name server which TLD servers handle .ca domains.
- TLD server query: The resolver then asks the .ca TLD servers which authoritative name servers are responsible for dnschecker.ca.
- Authoritative server query: The resolver asks the authoritative name server for dnschecker.ca and gets back the actual IP address.
- Answer returned: The resolver sends the IP address back to your browser and caches it for future use based on the TTL value.
- TCP connection: Your browser now opens a connection to the IP address and loads the website.
Common DNS Record Types
DNS is not just about IP addresses. A domain can have many different types of records, each serving a specific purpose. Here are the ones you will encounter most often.
A Record
An A record maps a domain name to an IPv4 address. This is the most fundamental record type. When someone visits your website, an A record is almost certainly involved. Example: example.com IN A 93.184.216.34.
AAAA Record
Same as an A record but for IPv6 addresses, which look like 2606:2800:220:1:248:1893:25c8:1946. As IPv6 adoption grows, AAAA records are becoming increasingly important.
CNAME Record
A CNAME, or Canonical Name record, is an alias. It points one domain name to another domain name rather than directly to an IP address. Common uses include pointing www.example.com to example.com, or pointing a subdomain to a third-party service's hostname.
MX Record
Mail Exchanger records tell the internet where to deliver email for your domain. Without correct MX records, email sent to your domain simply bounces. MX records have a priority value, so you can have backup mail servers.
TXT Record
TXT records store arbitrary text and are used for an enormous range of purposes: domain ownership verification, SPF records for email authentication, DKIM keys, DMARC policies, and more. If you have ever set up Google Workspace or configured email security, you have dealt with TXT records.
NS Record
Name Server records identify which servers are authoritative for a domain. When you change your domain's name servers at your registrar, you are updating NS records. These point the rest of the internet to the right place for all your other DNS records.
SOA Record
The Start of Authority record contains administrative information about a DNS zone, including the primary name server, the email address of the zone administrator, and various timing values that control how secondary servers handle the zone.
What is TTL and Why Does It Matter
Every DNS record has a TTL, which stands for Time to Live. TTL is a value measured in seconds that tells resolvers and caches how long to hold onto a cached copy of the record before asking for a fresh one. A TTL of 3600 means resolvers cache the record for one hour.
TTL has a direct practical impact on two scenarios. First, if you lower your TTL before making DNS changes, such as migrating your website to a new server, the changes propagate much faster because resolvers discard their cache sooner. A common strategy is to drop TTL to 300 seconds (5 minutes) a day before making a change. Second, very low TTLs increase the load on authoritative name servers because resolvers have to query them more frequently.
Public DNS Resolvers Worth Knowing
Your ISP provides a DNS resolver by default, but it is not always the fastest or the most privacy-respecting option. Switching to a public resolver is one of the easiest performance and privacy tweaks you can make. Here are the major options.
- Cloudflare (1.1.1.1 / 1.0.0.1): Consistently the fastest public resolver in global benchmarks. Strong privacy policy, does not log queries for advertising purposes.
- Google Public DNS (8.8.8.8 / 8.8.4.4): Extremely reliable and widely supported. Google does collect some query data for security and performance analysis.
- OpenDNS (208.67.222.222 / 208.67.220.220): Operated by Cisco. Offers optional content filtering, useful for families or businesses wanting to block certain categories of sites.
- Quad9 (9.9.9.9 / 149.112.112.112): Focuses on security, blocking known malicious domains using threat intelligence feeds. Non-profit operated.
To check what DNS records a domain is currently publishing, use our DNS Lookup tool to query any record type from multiple locations simultaneously.
How to Change Your DNS Server
Changing your DNS resolver can be done at the device level or at the router level. Changing it at the router level applies the new resolver to every device on your network automatically.
On Windows
On macOS
On Your Router
The admin panel address varies by brand. Common addresses are 192.168.1.1, 192.168.0.1, tplinkwifi.net (TP-Link), routerlogin.net (Netgear), and asusrouter.com (ASUS). Log in with your admin credentials, then find the WAN or Internet settings section. Look for a DNS field and enter your preferred resolver addresses there. Save and restart the router.
DNS Security: What You Should Know
DNS was designed in the early days of the internet when security was an afterthought. Several attacks exploit this original lack of security.
DNS Spoofing (Cache Poisoning): An attacker injects false DNS records into a resolver's cache, redirecting users to malicious sites while the address bar still shows the legitimate domain name. DNSSEC (DNS Security Extensions) was developed to counter this by adding cryptographic signatures to DNS records.
DNS Hijacking: Malware or a compromised router changes your configured DNS resolver to one controlled by attackers, who then return manipulated results for certain queries.
DNS over HTTPS (DoH) and DNS over TLS (DoT): Traditional DNS queries are sent in plaintext, meaning your ISP or anyone on the network can see every domain you look up. DoH and DoT encrypt DNS queries so they cannot be intercepted or tampered with in transit. Modern browsers like Firefox and Chrome support DoH natively.
Why DNS Sometimes Fails and What to Do
When DNS breaks, websites appear unreachable even though your internet connection is working fine. Common causes include misconfigured DNS records at the authoritative server, expired domain registrations causing NS records to be removed, ISP resolver outages, and TTL-related propagation delays after making DNS changes.
If you suspect a DNS problem, start with a quick test. Open a command prompt or terminal and run a manual lookup:
If nslookup example.com 8.8.8.8 works but your default resolver fails, your ISP's resolver has a problem and switching to a public resolver like 8.8.8.8 or 1.1.1.1 will fix it immediately. If neither works, the issue is at the authoritative level, meaning the domain's own DNS records are broken or missing.
Key Takeaways
- DNS translates human-readable domain names into IP addresses that computers use to route traffic.
- The system is hierarchical: root servers, TLD servers, authoritative servers, and recursive resolvers all play distinct roles.
- Record types like A, AAAA, CNAME, MX, and TXT each serve specific purposes beyond just pointing to web servers.
- TTL controls how long records are cached and directly affects how quickly changes propagate.
- Switching to a public DNS resolver like Cloudflare or Google can improve speed, reliability, and privacy.
- Tools like nslookup and dig let you troubleshoot DNS problems directly from the command line.
- Modern extensions like DNSSEC, DoH, and DoT address the security gaps in the original DNS design.
DNS touches virtually every internet activity you perform. Understanding how it works means you can diagnose problems faster, make smarter configuration decisions, and appreciate why certain internet performance issues happen the way they do. Once it clicks, DNS stops being a mysterious black box and becomes a tool you can actually control.