What Is DNS and How Does It Work?

DNS (Domain Name System) translates human-readable domain names like google.com into IP addresses that computers use to find each other. It is often called the 'phone book of the internet'.

What Is DNS?

DNS stands for domain-kerberos-directory-services-explained) Name System. It is a distributed, hierarchical naming system that translates human-friendly domain names — like mariamehwish.org — into machine-readable IP addresses like 104.26.10.79.

Without DNS, you would have to remember the exact [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) of every website you wanted to visit. DNS acts as the internet's phone book, handling billions of lookups every day automatically and invisibly.

Why DNS Exists

Computers communicate using IP addresses, not names. But IP addresses are hard for humans to remember. When the internet was small, a single file called HOSTS.TXT listed every host and its address. By the early 1980s, the internet had grown too large for this approach.

DNS was invented in 1983 by Paul Mockapetris to solve this problem. Instead of one central file, DNS distributes the naming responsibility across thousands of servers organized in a hierarchy.

How DNS Resolution Works

When you type a URL into your browser, a process called DNS resolution happens before any webpage loads:

Browser → DNS Resolver → Root Server → TLD Server → Authoritative Server

Step 1: Browser Cache Check

The browser first checks its own cache. If you visited the site recently, the [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) may already be saved locally.

Step 2: OS Cache and hosts file

If not in the browser cache, the operating system checks its own DNS cache, then the local /etc/hosts file.

Step 3: Recursive Resolver

If not cached locally, the query goes to a recursive resolver — usually provided by your ISP or a public DNS service like Google (8.8.8.8) or Cloudflare (1.1.1.1).

Step 4: Root Name Server

The resolver queries one of the 13 root name server clusters. The root server tells the resolver which TLD server to ask.

Step 5: TLD Name Server

The TLD server handles all domains under a specific extension — .com, .org, .uk. It responds with the address of the domain-kerberos-directory-services-explained)'s authoritative name server.

Step 6: Authoritative Name Server

The authoritative name server holds the actual DNS records for the domain-kerberos-directory-services-explained) and returns the [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained).

Step 7: Response Cached and Delivered

The resolver caches the answer (based on the TTL) then returns the IP to your browser. The entire process typically takes 20–120 milliseconds.

Common DNS Record Types

| Record Type | Purpose | Example | |-------------|---------------------------------------------------|--------------------------------------| | A | Maps a domain-kerberos-directory-services-explained) to an [IPv4-address-ipv4-IPv6-and-addressing-explained) address](/learning-center/what-is-an-ip-address-ipv4-ipv6-and-addressing-explained) | mariamehwish.org → 104.26.10.79 | | AAAA | Maps a domain-kerberos-directory-services-explained) to an [IPv6-address-ipv4-ipv6-and-addressing-explained) address](/learning-center/what-is-an-ip-address-IPv4-ipv6-and-addressing-explained) | mariamehwish.org → 2606:4700::1 | | CNAME | Alias — points one domain-kerberos-directory-services-explained) to another domain | www → mariamehwish.org | | MX | Specifies mail servers for the domain-kerberos-directory-services-explained) | mail.mariamehwish.org priority 10 | | TXT | Stores text data (SPF, DKIM, domain-kerberos-directory-services-explained) verification) | "v=spf1 include:sendgrid.net ~all" | | NS | Lists the authoritative name servers | ns1.cloudflare.com | | PTR | Reverse lookup — maps IP to domain-kerberos-directory-services-explained) name | Used in email spam filtering |

DNS Caching and TTL

DNS responses are cached to reduce query volume and speed up browsing. The TTL (Time to Live) value in each DNS record tells caches how long to hold the response:

mariamehwish.org.   300   IN   A   104.26.10.79
                    ↑
               TTL = 300 seconds (5 minutes)

A low TTL means faster propagation of changes but more DNS queries. A high TTL reduces load but means updates take longer to reach users.

DNS Security Threats

DNS Spoofing / Cache Poisoning

An attacker injects false DNS records into a resolver's cache, redirecting users to malicious IP addresses. Victims trying to visit their bank may land on a fake phishing site instead.

DNS Amplification DDoS

Attackers send small DNS queries with a spoofed source IP (the victim's address). The DNS server sends a much larger response to the victim, amplifying the attack traffic.

DNS Tunneling

Attackers encode data inside DNS queries and responses to exfiltrate data or establish command-and-control (C2) channels through firewalls that allow DNS traffic.

DNS Hijacking

Attackers redirect DNS queries to their own malicious resolvers by compromising routers, ISPs, or registrar accounts.

How to Secure DNS

DNSSEC (DNS Security Extensions)

DNSSEC adds digital signatures-symmetric-vs-asymmetric) to DNS records. Resolvers can verify that responses are authentic and have not been tampered with.

DNS over HTTPS (DoH) and DNS over TLS (DoT)

Traditional DNS queries are sent in plaintext. DoH and DoT encrypt DNS traffic to prevent eavesdropping by ISPs or attackers on the same network.

Use Trusted Resolvers

Cloudflare 1.1.1.1 — privacy-focused, very fast
Google 8.8.8.8 — reliable and widely used
Quad9 9.9.9.9 — blocks known malicious domains

Useful DNS Commands

# Query the A record for a domain
nslookup mariamehwish.org

# Detailed DNS lookup
dig mariamehwish.org A

# Check MX records
dig mariamehwish.org MX

# Reverse lookup (IP to domain)
dig -x 104.26.10.79

# Check which DNS server your system uses
cat /etc/resolv.conf

Quick Recap

DNS translates domain-kerberos-directory-services-explained) names to IP addresses using a distributed hierarchy of servers.
The resolution chain goes: Recursive Resolver → Root Server → TLD Server → Authoritative Server.
Key record types include A, AAAA, CNAME, MX, TXT, NS, PTR.
TTL controls how long DNS responses are cached.
Major security threats include cache poisoning, DNS amplification, DNS tunneling, and hijacking.
DNSSEC, DoH, and DoT are the primary DNS hardening techniques.

DNS knowledge is tested in virtually every cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication) certification — CEH, CompTIA Security+, OSCP, and CISSP all cover DNS attacks and defenses in depth.