Last updated · reviewed for accuracy
How DNS resolves a name
Every connection starts with a name becoming an address. This lesson traces that lookup through the global tree (resolver, root, TLD, authoritative) and explains the caching that makes DNS fast and DNS changes slow.
What is DNS?
DNS is the internet’s distributed directory: a delegated tree of name servers that translates human-readable names like linktonetera.com into machine-usable records (addresses, mail servers, verification text). No single server holds the whole map; each level knows only who to ask next.
What actually happens when you type a name?
Your device asks a recursive resolver, which walks the tree on your behalf: the root servers point it at the .com servers, which point it at the domain’s own authoritative servers, which return the answer. The resolver caches every step, so repeat lookups skip the journey entirely.
$ dig linktonetera.com +trace . NS a.root-servers.net … ← root com. NS a.gtld-servers.net … ← TLD linktonetera.com. NS ns1.dns-parking.com ← authoritative linktonetera.com. A 84.32.84.32 ← the answer
Recursive vs authoritative: who answers what?
A recursive resolver (your ISP’s, or 1.1.1.1, 8.8.8.8) answers any question by doing the legwork and caching results. An authoritative server answers only for the zones it owns, but its answers are the truth. Every lookup is a recursive server relaying an authoritative one.
How do TTLs and caching work?
Every record carries a TTL: how many seconds any cache may keep it before asking again. A 3600 TTL means a change can take up to an hour to be seen everywhere. That countdown is why DNS feels instant day to day and sluggish on migration day.
The professional habit: lower the TTL to 300 a day before a planned change, migrate, confirm, then raise it back. Watch the trick in action by querying the same name twice in our DNS Lookup tool: the second answer arrives from cache in a fraction of the time.
Which record types matter?
Six cover daily work: A and AAAA map names to IPv4 and IPv6 addresses, CNAME aliases one name to another, MX names the mail servers, TXT holds verification and email-security text, and NS declares which servers are authoritative for the zone.
Each is covered with sample output on the DNS Lookup tool page, including when you would reach for it in a ticket.
Related tool: DNS Lookup
Run real queries as you read with DNS Lookup, then see where encrypted DNS is heading in our blog post on DoH by default.
Frequently asked questions
What is a resolver, and which one am I using?
The recursive server that does lookups for you. By default it is your router’s, which forwards to your ISP’s; many people switch to public resolvers like 1.1.1.1 or 8.8.8.8. Increasingly your browser also runs its own DNS-over-HTTPS resolver, so one machine may be using two at once.
Why do I get a different answer than someone else?
Caching and geography. Their resolver may hold an older cached record than yours, and large sites deliberately return different addresses per region via anycast or geo-routing. Both answers are usually correct: observed from different places at different moments in the TTL countdown.
How long does a DNS change take to propagate?
“Propagation” is really just caches expiring: the old record survives everywhere until its TTL runs out. With a 3600 TTL, up to an hour; with 86400, a day. Lowering the TTL before a change is the standard way to make migrations feel instant.
Is DNS traffic private?
Classically no: queries travelled as plaintext UDP that any network on the path could read. DNS over HTTPS and DNS over TLS encrypt the query to the resolver, which is why browsers now default to them; our DoH article covers what that fixes and what it complicates.