NETWORK
DNSDomain Name System
DNS (Domain Name System) is the distributed directory that translates human-readable names such as example.com into IP addresses. A recursive resolver, usually provided by your ISP, router or a public service like 1.1.1.1, answers queries by asking the root, top-level-domain and authoritative servers in turn and caching the results.
How a lookup works
When a browser needs the address for www.example.com:
- The stub resolver in the operating system checks its cache and the hosts file.
- If there is no answer, it sends the query to the configured recursive resolver (router, ISP, or a public resolver) on port 53.
- The recursive resolver, if it has no cached answer, asks a root server for
.com, gets referred to the.comTLD servers, asks them forexample.com, gets referred to that zone's authoritative servers, and asks them forwww.example.com. - The authoritative server answers with the record and a TTL. The resolver caches the answer for that many seconds and returns it to the stub, which caches it as well.
The whole chain usually takes tens of milliseconds and, thanks to caching, most queries never go beyond step 2.
Record types you will meet
| Type | Maps | Example use |
|---|---|---|
| A | Name → IPv4 address | Website address |
| AAAA | Name → IPv6 address | Same, for IPv6 |
| CNAME | Name → another name | www pointing to the bare domain, CDN hostnames |
| MX | Domain → mail server names with priority | Where email for the domain is delivered |
| TXT | Name → free text | SPF, DKIM, DMARC, domain verification |
| NS | Zone → its authoritative servers | Delegation |
| SOA | Zone → primary server, serial, timers | Zone administration |
| PTR | IP address → name | Reverse DNS |
| SRV | Service → host and port | Active Directory, SIP, XMPP |
| CAA | Domain → permitted certificate authorities | TLS issuance control |
| HTTPS/SVCB | Name → connection hints | HTTP/3 advertisement, ECH |
Caching and TTL
Every record carries a time-to-live. A record with TTL 3600 may be served from caches for up to an hour after it changed, which is what people mean by DNS propagation. Lowering the TTL before a planned change shortens the window.
Windows keeps its own cache in the DNS Client service. ipconfig /displaydns shows it and ipconfig /flushdns clears it; see the flush DNS guide.
Recursive resolvers
| Resolver | Address | Notes |
|---|---|---|
| Cloudflare | 1.1.1.1, 1.0.0.1 | Privacy-focused, supports DoH/DoT |
| 8.8.8.8, 8.8.4.4 | Widely used | |
| Quad9 | 9.9.9.9 | Blocks known-malicious domains |
| Your ISP | via DHCP | Default for most users |
Changing resolvers changes who sees your queries and which filtering applies; it does not change which addresses names resolve to, except where a resolver filters or a CDN steers by resolver location.
Security
- DNSSEC signs zone data so a validating resolver can detect forged answers. It authenticates the data, not the transport.
- DoH / DoT encrypt the transport between client and resolver, preventing on-path snooping and tampering.
- Cache poisoning attacks, largely mitigated by source-port randomisation and DNSSEC, aimed to insert false records into resolver caches.
- DNS as a channel: malware uses DNS queries to exfiltrate data or receive commands; monitoring query volume and unusual domains catches it.
Testing on Windows
nslookup example.com
nslookup -type=MX example.com 1.1.1.1Resolve-DnsName example.com -Type AAAA
Resolve-DnsName example.com -Server 9.9.9.9 -DnsOnlyThe second nslookup form queries a specific server, which separates "my resolver is wrong" from "the record is wrong". See nslookup and Resolve-DnsName.
Frequently asked questions
What DNS server am I using?
ipconfig /all lists the DNS Servers for each adapter. On a home network it is usually the router, which forwards to the ISP. You can change it per adapter or on the router to a public resolver such as 1.1.1.1, 8.8.8.8 or 9.9.9.9.
What is the difference between an A record and a CNAME?
An A record maps a name directly to an IPv4 address. A CNAME maps a name to another name, which is then resolved. www.example.com CNAME example.com means "use whatever example.com resolves to". A name with a CNAME cannot have other records.
Why does a site work by IP but not by name?
DNS resolution is failing while routing works. Check the configured DNS servers, try nslookup example.com 1.1.1.1 to bypass them, and flush the cache with ipconfig /flushdns.
Is DNS encrypted?
Classic DNS on port 53 is not. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the query between you and the resolver. Windows 11, Android, iOS and all major browsers support DoH.