When you type github.com, your browser doesn't know where github.com lives. DNS (Domain Name System) is the global distributed database that translates names to IP addresses. Without it, you'd have to memorise 140.82.121.4 instead of github.com.
Why DNS is Distributed#
There are over 350 million registered domain names. A single server couldn't handle global query load (trillions per day) or be a single point of failure. DNS is designed as a distributed, hierarchical, cached system.
The DNS Hierarchy#
Each level is managed by different nameservers:
- Root nameservers: 13 logical servers (A to M), anycast to 1500+ physical servers worldwide. Know where TLD servers are.
- TLD nameservers: run by registry operators (Verisign operates .com). Know where each domain's nameservers are.
- Authoritative nameservers: run by the domain owner (or their DNS provider). Hold the actual DNS records.
The Full Resolution Process#
Each step is a UDP query (usually) to port 53.
The trace above is one lookup, and read on its own it makes DNS look expensive:
four round trips before a single byte of the page arrives. The simulation below
runs that walk for this site, tryalgoviz.com, typed into a phone, and then
opens it again a minute later, so you can watch the second visit skip the whole
chain. The lookup time under it is the sum of the round trips actually taken,
not a figure typed into the caption, which is why the second visit costs only
the phone's own hop. (The address it finds is from the range reserved for
examples, not this site's real one.)
DNS Record Types#
| Type | Meaning | Example |
|---|---|---|
| A | Hostname → IPv4 address | github.com → 140.82.121.4 |
| AAAA | Hostname → IPv6 address | github.com → 2606:50c0:8003::154 |
| CNAME | Alias → canonical hostname | www.github.com → github.com |
| MX | Mail exchanger (with priority) | github.com MX 1 aspmx.l.google.com |
| TXT | Arbitrary text | SPF records, DKIM keys, domain verification |
| NS | Nameserver for a zone | github.com NS ns1.github.com |
| PTR | Reverse DNS: IP → hostname | 140.82.121.4 → github.com |
| SOA | Start of Authority: zone metadata | Serial number, refresh interval |
| SRV | Service location | _http._tcp.example.com 5 0 80 server.example.com |
TTL (Time to Live)#
Every DNS record has a TTL (in seconds). After TTL expires, caches discard the record and re-query.
TTL trade-offs:
- Low TTL: changes propagate quickly; higher load on nameservers
- High TTL: less DNS traffic; DNS changes take longer to propagate
Before changing a DNS record: lower the TTL days in advance so the old value expires quickly once you make the change.
Recursive vs Iterative Resolution#
Recursive resolver (what you use): you ask it one question, it does all the work and returns the answer.
Iterative resolution (what resolvers do internally): each nameserver returns the next server to ask, not the final answer.
Your DNS resolver (configured in /etc/resolv.conf or DHCP) does recursive resolution on your behalf.
Popular Public Resolvers#
| Resolver | IP | Provider | Feature |
|---|---|---|---|
| 8.8.8.8 | Speed, reliability | ||
| Cloudflare | 1.1.1.1 | Cloudflare | Privacy-focused |
| Quad9 | 9.9.9.9 | Quad9 | Security (blocks malicious domains) |
| OpenDNS | 208.67.222.222 | OpenDNS | Content filtering, family controls |
Python: DNS Lookups#
DNS Caching Chain#
Caching happens at multiple levels, each with its own TTL tracking:
/etc/hosts is checked before DNS, so you can override any name locally:
DNS Security#
DNS Spoofing / Cache Poisoning: an attacker injects fake DNS responses into a resolver's cache, redirecting users to malicious IPs.
DNSSEC (DNS Security Extensions): digitally signs DNS records so resolvers can verify authenticity. Widely deployed for TLDs but not yet universal at the domain level.
DoH (DNS over HTTPS) and DoT (DNS over TLS): encrypt DNS queries to prevent eavesdropping and tampering. Used by modern browsers and OS resolvers.
What to Remember#
- DNS translates hostnames to IPs via a distributed, hierarchical, cached system
- Root → TLD → authoritative nameservers; each knows who to ask next
- TTL controls how long caches hold a record; lower TTL means faster propagation
- A, AAAA, CNAME, MX, TXT are the most common record types
- DNSSEC signs records and DoH/DoT encrypts queries; together they harden DNS against attack