DNS explained: what really happens when you open a website

DNS looks simple—name in, IP out. In reality, browser caches, operating-system caches, recursive resolvers, root servers, TLD servers, authoritative nameservers, TTL and DNSSEC all participate.

The browser does not start at the root

Browsers, operating systems and local resolvers may already have a cached answer. The hosts file can also override normal DNS.

The recursive resolver

The network resolver performs recursive lookups when necessary and caches results.

Root, TLD and authoritative servers

If the resolver has no answer, it starts with root servers, follows the TLD such as `.com`, and reaches the domain’s authoritative nameserver.

A and AAAA

A records provide IPv4 addresses; AAAA records provide IPv6 addresses.

CNAME

A CNAME points one name to another. Chains should be kept understandable because they can add lookups.

MX

Mail servers are discovered through MX records. Web and mail infrastructure do not have to be the same.

TXT

TXT records are used for SPF, domain verification and other policies.

TTL and caching

TTL controls how long resolvers may cache an answer, so changes are not necessarily visible everywhere immediately.

DNSSEC

DNSSEC adds cryptographic signatures to DNS data and protects against certain forms of manipulation. It does not encrypt DNS traffic.

Tools

On Windows, `nslookup` and `Resolve-DnsName` are useful; on Linux and Unix, `dig` is a core diagnostic tool.

Resolve-DnsName example.com
nslookup example.com
dig example.com A
dig example.com MX

Practical diagnosis

Compare different resolvers, query authoritative servers directly and inspect A, AAAA, MX, TXT and NS records.

Conclusion

Understanding DNS explains a large part of modern network troubleshooting. Many apparent web-server problems are actually DNS problems.