What Is DNS and How Does It Work?
When you type a domain name such as example.com into a browser, your device needs to find the server responsible for that website. The browser cannot connect using the domain name alone. It first needs technical information such as an IP address.
The Domain Name System, usually called DNS, provides that information.
DNS is responsible for translating human-readable domain names into records that computers and network services can use. It helps browsers locate websites, directs email to the correct mail servers, identifies authoritative name servers, and supports many other internet services.
Most DNS lookups finish in a fraction of a second. Behind that quick response, however, several systems may be involved, including your device, a recursive DNS resolver, root name servers, top-level domain servers, and the authoritative name servers for the domain.
Understanding how this process works makes it much easier to troubleshoot problems such as a domain pointing to the wrong server, DNS changes not appearing, email delivery failures, or a website becoming unreachable.
What Does DNS Mean?
DNS stands for Domain Name System.
Its best-known job is connecting a hostname to an IP address. A DNS record might look like this:
example.com. 3600 IN A 192.0.2.10
This record says that example.com points to the IPv4 address 192.0.2.10.
DNS is often described as the internet’s phone book. That comparison is useful, but DNS does more than match names with addresses. It can also publish information about:
- IPv4 and IPv6 addresses
- Mail servers
- Authoritative name servers
- Domain aliases
- Email authentication policies
- Service verification records
- Reverse DNS hostnames
DNS is not a single database stored in one place. It is a distributed and hierarchical system. Responsibility for different domains is divided among many independently operated DNS servers.
Why Is DNS Necessary?
Domain names are designed for people. IP addresses are designed for networks.
It is easier to remember:
example.com
than an address such as:
192.0.2.10
Using IP addresses directly would also be unreliable. A website may change hosting providers, move to another server, use multiple addresses, or distribute traffic across several locations.
DNS allows the public name of a website to remain the same even when the underlying infrastructure changes.
For example, a website owner can move a site to a new server and update the domain’s A record. Visitors continue using the same domain name, while DNS directs them to the new address.
How Does a DNS Lookup Work?
Suppose you enter the following address into a browser:
www.example.com
Your browser needs to find the IP address associated with that hostname. A typical DNS lookup follows several steps.
1. The browser checks its cache
The browser may already have a recent DNS result stored locally. If the cached result is still valid, the browser can reuse it instead of starting a new lookup.
Browsers may manage their own DNS caches separately from the operating system.
2. The operating system checks its DNS cache
If the browser does not have a usable answer, the operating system may check its own cache.
A previously resolved hostname may still be stored there. This is one reason DNS changes can appear differently on two devices. One device may still be using an older cached answer while another has already requested the updated record.
3. The query is sent to a recursive DNS resolver
When no valid local answer is available, the device sends the query to a recursive DNS resolver.
The resolver may be operated by:
- An internet service provider
- A company or school network
- A hosting provider
- A public DNS provider
- A locally managed DNS server
The resolver performs the lookup on behalf of the user. It also keeps its own cache, so it may already have the answer from an earlier request.
4. The resolver may contact a root name server
If the resolver does not have the required information cached, it may begin at the DNS root.
The root name server normally does not return the final IP address. Instead, it directs the resolver to the servers responsible for the relevant top-level domain.
For www.example.com, the top-level domain is .com.
5. The resolver contacts a top-level domain server
The .com server tells the resolver which authoritative name servers are responsible for example.com.
The response may contain records similar to:
example.com. 86400 IN NS ns1.example-dns.net.
example.com. 86400 IN NS ns2.example-dns.net.
These NS records delegate responsibility for the domain to the listed name servers.
6. The resolver asks the authoritative name server
The resolver then sends the query to an authoritative name server for the domain.
The authoritative server stores the DNS records published for that domain. It may return an A record, AAAA record, CNAME record, or another response depending on the query.
A simplified response could look like this:
www.example.com. 3600 IN A 192.0.2.10
7. The resolver returns the result
The recursive resolver sends the answer back to the user’s device. The browser can then connect to the returned IP address.
If the website uses HTTPS, the browser must also establish an encrypted connection and validate the site’s TLS certificate.
DNS helps the browser locate the server. It does not download the website or confirm that the web server is working correctly.
Recursive DNS and Authoritative DNS
Recursive resolvers and authoritative name servers perform different jobs.
Recursive DNS resolver
A recursive resolver finds answers for users and applications. It may contact several other DNS servers before obtaining the final result.
It also caches responses to improve speed and reduce unnecessary queries.
Authoritative name server
An authoritative name server publishes DNS information for a domain or DNS zone.
When a domain owner changes an A record, MX record, or another DNS setting, the updated value is stored on the authoritative DNS service.
Recursive resolvers retrieve that information and may cache it for a limited period.
A simple way to remember the difference is:
- A recursive resolver looks for the answer.
- An authoritative name server provides the published answer.
What Is a DNS Zone?
A DNS zone is an administratively managed section of the DNS namespace.
A zone usually contains records for a domain and some or all of its subdomains. In larger setups, responsibility for a subdomain may be delegated to another set of name servers.
A simplified DNS zone might contain:
example.com. 3600 IN A 192.0.2.10
www.example.com. 3600 IN CNAME example.com.
example.com. 3600 IN MX 10 mail.example.com.
example.com. 86400 IN NS ns1.example-dns.net.
example.com. 86400 IN NS ns2.example-dns.net.
Each record has a specific purpose.
Common DNS Record Types
A record
An A record maps a hostname to an IPv4 address.
example.com. 3600 IN A 192.0.2.10
A records are commonly used to point a domain or subdomain to a web server.
AAAA record
An AAAA record maps a hostname to an IPv6 address.
example.com. 3600 IN AAAA 2001:db8::10
A domain can publish both A and AAAA records if the service supports IPv4 and IPv6.
CNAME record
A CNAME record makes one hostname an alias of another hostname.
www.example.com. 3600 IN CNAME example.com.
The destination of a CNAME record is another hostname, not an IP address.
MX record
An MX record identifies the mail servers that accept email for a domain.
example.com. 3600 IN MX 10 mail.example.com.
The number before the mail server is the preference value. Lower values normally have higher priority.
NS record
An NS record identifies an authoritative name server for a DNS zone.
example.com. 86400 IN NS ns1.example-dns.net.
Incorrect NS records or incomplete delegation can prevent users from resolving the domain correctly.
TXT record
A TXT record stores text-based information.
TXT records are commonly used for:
- Domain ownership verification
- SPF policies
- DKIM public keys
- DMARC policies
- Third-party service verification
An SPF-related TXT record may look like this:
example.com. 3600 IN TXT "v=spf1 include:_spf.example.net -all"
PTR record
A PTR record is used for reverse DNS.
Instead of mapping a hostname to an IP address, reverse DNS maps an IP address back to a hostname.
PTR records are especially important for mail servers because some receiving systems check reverse DNS when evaluating incoming email.
SOA record
An SOA record contains administrative information about a DNS zone.
It normally includes:
- The primary authoritative name server
- A responsible contact address
- A zone serial number
- Refresh and retry values
- Expiration settings
- A negative caching value
The serial number is often updated when the zone changes so that secondary DNS servers can identify a newer version.
What Is DNS TTL?
TTL stands for Time to Live.
TTL tells recursive resolvers how long they may cache a DNS record before requesting it again.
In this record:
example.com. 3600 IN A 192.0.2.10
the TTL is 3600 seconds, which equals one hour.
A resolver may reuse the record during that period. Once the cached value expires, the resolver should request a fresh answer.
TTL has an important effect on DNS changes. Updating a record on the authoritative name server does not immediately remove old values from every resolver cache.
Resolvers that already cached the previous record may continue using it until its original TTL expires.
What Is DNS Propagation?
DNS propagation is the common name for the period during which users and DNS resolvers begin receiving an updated record.
The term can be slightly misleading. DNS changes are not usually copied from one resolver to every other resolver in a single global process.
Instead, individual resolvers refresh their cached records when those records expire or when a new query requires an updated answer.
During this period:
- One resolver may still return the old value.
- Another resolver may already return the new value.
- A browser may have its own cached result.
- An operating system may retain an older response.
- Different authoritative name servers may return inconsistent records if the DNS configuration is incomplete.
When checking a recent DNS change, it is useful to compare results from multiple locations. The DomainScan DNS Propagation Check can show whether different DNS resolvers are returning the same record.
If most resolvers return the new value and only a few still return the previous value, caching is the most likely explanation.
If the authoritative name servers themselves return different answers, the problem may be an inconsistent zone configuration rather than normal propagation.
How Long Do DNS Changes Take?
There is no single propagation time for every DNS change.
The delay depends on several factors:
- The previous TTL value
- Resolver caching behavior
- Local operating system caches
- Browser caches
- Whether name server delegation was changed
- Whether all authoritative servers contain the same records
- Negative caching after a failed lookup
Many record changes become visible within minutes or hours. Name server changes can sometimes take longer because delegation information may be cached at several levels.
It is also important to consider the TTL that existed before the change. Reducing the TTL after updating the record does not shorten the lifetime of copies that were already cached with the old TTL.
For a planned migration, administrators often reduce the TTL in advance, wait for the previous cache period to expire, and then make the final DNS change.
DNS Errors and Common Failure Types
A DNS lookup does not always return an IP address. It may return an error or an empty response.
NXDOMAIN
NXDOMAIN means the requested domain name does not exist according to DNS.
Possible causes include:
- The domain name was typed incorrectly.
- The hostname has not been created.
- The domain has expired.
- The authoritative DNS configuration is missing.
- A cached negative response is still being used.
SERVFAIL
SERVFAIL means the DNS server could not complete the query successfully.
Possible causes include:
- Broken DNSSEC validation
- Unreachable authoritative name servers
- Invalid DNS responses
- Misconfigured delegation
- Temporary server problems
Timeout
A timeout occurs when no response is received within the expected period.
This can happen because of network problems, firewall rules, overloaded DNS servers, or unavailable authoritative name servers.
NOERROR with no expected answer
A DNS response can succeed without containing the requested record.
For example, a hostname may exist but have no A record. The response may be valid even though no IPv4 address is returned.
DNS Does Not Guarantee That a Website Is Working
A correct DNS response only confirms that the domain is publishing a record.
It does not confirm that:
- The web server is online.
- The website is configured for the domain.
- Port 80 or port 443 is open.
- The SSL certificate is valid.
- The application is running correctly.
- The server is returning a successful HTTP response.
For example, a domain can point to the correct IP address while the server returns an error page or refuses the connection.
DNS is only one part of the connection process.
How to Check a Domain’s DNS Records
You can use the DomainScan DNS Lookup tool to inspect the records currently published for a domain.
A typical check involves:
- Entering the domain or hostname.
- Selecting the required record type.
- Reviewing the returned value.
- Comparing the result with the intended configuration.
- Checking multiple DNS resolvers when a recent change is involved.
For example, if a website is loading from the wrong server, check the A and AAAA records first.
If email is not being delivered, check the MX records and any relevant SPF, DKIM, or DMARC records.
If the domain cannot be resolved at all, check the NS records, delegation, and authoritative name server responses.
When Should You Clear the DNS Cache?
Clearing a local DNS cache can help when a device continues using an old or incorrect result after a DNS change.
It may be useful when:
- A website has moved to a new server.
- A domain works on one device but not another.
- The browser keeps opening an old server.
- A hostname recently began returning a new IP address.
- A temporary DNS error has already been corrected.
Clearing the local cache does not clear caches operated by internet service providers or public DNS resolvers. It only removes stored results from the device or application where the cache is cleared.
Frequently Asked Questions
Is DNS the same as an IP address?
No. DNS is the system used to publish and retrieve information about domain names. An IP address identifies a network destination.
DNS often connects a hostname to an IP address, but it also stores many other types of records.
Who controls DNS?
No single organization controls every part of DNS.
The system is distributed among root zone operators, top-level domain registries, domain registrars, DNS hosting providers, network operators, and domain owners.
A domain owner normally manages DNS records through a hosting provider, registrar, or dedicated DNS provider.
What happens if DNS stops working?
If a device cannot resolve a hostname, it may be unable to locate the website, mail server, or other service associated with that name.
The server may still be online, but users cannot reach it by domain name without a successful DNS lookup.
Can one domain point to multiple IP addresses?
Yes. A hostname can publish multiple A or AAAA records.
This may be used for load distribution, redundancy, geographic routing, or other infrastructure designs.
Can multiple domains use the same IP address?
Yes. Shared hosting platforms and reverse proxy services commonly host many domains on the same IP address.
The web server identifies the requested domain from the HTTP request and serves the correct website.
Does changing DNS also move the website?
No. Changing DNS only changes where the domain points.
The website files, database, application, and server configuration must be moved separately.
Does DNS provide website security?
DNS helps users locate internet services, but standard DNS does not encrypt website traffic or prove that a website is trustworthy.
HTTPS and TLS protect the connection between the browser and the web server. DNSSEC can help protect DNS data from certain types of tampering, but it does not replace HTTPS.
Final Thoughts
DNS is one of the basic systems that makes the internet usable.
It allows people to use readable domain names while computers retrieve the addresses and service information required to complete a connection.
A typical DNS lookup may involve local caches, a recursive resolver, root servers, top-level domain servers, and authoritative name servers. Caching makes this process fast, but it also explains why recent DNS changes may not appear everywhere at the same time.
When a domain is not working as expected, DNS should be checked carefully, but it should not be treated as the only possible cause. A correct DNS result does not guarantee that the web server, SSL certificate, firewall, or application is configured correctly.
Use DomainScan’s DNS Lookup, DNS Propagation Check, and DNS Delegation Check tools to inspect a domain’s records and identify where a configuration problem may be occurring.