DNS Resolution

The Domain Name System (DNS) translates human-readable names like example.com into the IP addresses machines use to talk to each other. Resolution is a hierarchical, cached walk: the browser asks a recursive resolver, which asks a root server, then a TLD server, then the authoritative nameserver for the domain, caching the answer at every level for the record’s TTL.

Mental Model

DNS (Domain Name System) acts as the phonebook of the internet, translating human-readable domain names (like example.com) into machine-readable IP addresses (like 93.184.216.34).

The resolution process is a hierarchical, distributed query system:

1. The Browser checks its local cache.
2. The Operating System checks its hosts file and system cache.
3. The query is forwarded to a Recursive Resolver (your ISP or public services like Cloudflare 1.1.1.1 or Google 8.8.8.8).
4. If the resolver doesn’t have it cached, it queries the Root Server (.), which points it to the Top-Level Domain (TLD) Server (like .com).
5. The resolver queries the TLD server, which points it to the Authoritative Nameserver for the specific domain.
6. The resolver gets the final record and returns it to the client, caching it at every level along the way based on its TTL (Time to Live).

Components and Why They Exist

Browser

This component exists to initiate user requests, cache resolved IPs locally, and handle HTTP transactions. It intercepts web address requests, performs local cache lookups, and triggers the OS resolver if the record is missing. In the demo, observe the initial local cache lookup and the TTL countdown of cached records.

OS DNS Client

This component exists to maintain system-wide cache records and manage hostname lookups across applications. It checks local hosts files, queries system caches, and forwards unresolved queries to recursive DNS servers. In the demo, observe OS cache checks and downstream query generation to the Recursive Resolver.

Recursive Resolver

This component exists to perform iterative lookups on behalf of clients, reducing client network overhead and round trips. It resolves queries recursively by querying root, TLD, and authoritative nameservers, caching results for future requests. In the demo, observe iterative query arrows branching out to Root, TLD, and Authoritative servers.

Root Server (.)

This component exists to act as the entry point of the DNS hierarchy, directing queries to TLD servers. It parses domain suffixes and returns references to the nameservers responsible for the respective Top-Level Domain. In the demo, observe root referral responses containing TLD nameserver addresses.

TLD Server (.com)

This component exists to maintain registrations for domain extensions and point resolvers to authoritative targets. It matches domain names to their registered authoritative nameserver IP addresses. In the demo, observe referral responses containing Authoritative Nameserver IP addresses.

Authoritative Server (ex.com)

This component exists to hold the definitive resource mappings configured by the domain owner. It manages DNS records (like A, AAAA, MX) and returns final IP addresses along with TTL values. In the demo, observe the A record IP address returned with green query response lines.

Edge Cases and Misconceptions

• Anycast routing vs physical location: Root and TLD servers are not single physical servers in one room. They use Anycast routing, meaning the same IP address is advertised globally by multiple data centers. Routers send the query to the topologically nearest physical instance, making the root queries much faster than they appear.
• Iterative vs Recursive queries: Clients (like browsers) perform recursive queries to resolvers, meaning they expect the resolver to do all the work and return the final answer. Resolvers perform iterative queries to Root, TLD, and Authoritative servers, meaning they receive referrals and must execute each subsequent step themselves.
• CNAME lookup overhead: A CNAME (Canonical Name) record is an alias pointing to another domain name. If a domain points to a CNAME, the resolver must restart the entire resolution process for the target domain name, doubling the lookup latency.
• Negative caching: When a domain does not exist, nameservers return an NXDOMAIN (Non-Existent Domain) response. Resolvers cache this negative response for a duration defined by the zone’s SOA (Start of Authority) record, preventing clients from DDoS-ing nameservers with requests for nonexistent sites.