DNS
The Domain Name System resolves names through delegated zones, recursive resolvers, authoritative servers, and caches.
Jul 11, 2026
The Domain Name System (DNS) is a distributed database for names and typed records. An address lookup is common, but DNS also publishes mail routing, service discovery, delegation, verification, and other data.
Resolver Roles
A client normally uses a stub resolver in its operating system. The stub sends a recursive query to a configured recursive resolver, such as one operated by a network provider or public DNS service.
If the answer is not cached, the recursive resolver follows referrals:
- A root server refers it to the name servers for a top-level domain.
- A top-level-domain server refers it to the authoritative servers for the requested zone.
- An authoritative server answers from the zone it serves or returns another referral.
The recursive resolver performs this iterative work for the stub. Root and TLD servers usually return referrals, not the final address.
A name can have multiple A or AAAA records, a CNAME that points to another name, or no address record at all. DNS therefore does not simply map every domain to one server IP.
Caching
Resource records include a time to live (TTL) chosen by the zone operator. A cache can reuse a record until its remaining TTL reaches zero. Browsers and operating systems may add local caching behavior, but they do not change the authoritative TTL carried by DNS.
DNS also caches negative answers. An authoritative NXDOMAIN or NODATA response includes the zone’s SOA record, which provides the value used to limit negative caching. Caching non-existence reduces repeated queries but also means a newly created record may not become visible until the negative entry expires.
Caching removes a DNS lookup only when a usable answer already exists. It does not make the rest of a page load instant; connection setup, TLS, HTTP requests, application work, and rendering still remain.
UDP, TCP, And Encryption
Traditional DNS commonly sends queries over UDP port 53. EDNS(0) lets a requester advertise the UDP payload size it can receive. Large advertised sizes can still encounter fragmentation or middlebox loss.
If a response is truncated, indicated by the TC bit, a resolver can retry over TCP. TCP is also used for operations such as AXFR and IXFR zone transfers. DNS is therefore not limited to UDP, and a 512-byte message is not the general modern ceiling.
Encrypted transports include:
These protect DNS traffic between two endpoints. They do not by themselves make the DNS data authentic; DNSSEC addresses origin authentication and integrity for signed DNS data.