DNS

DNS (Domain Name System) is the system that turns easy-to-remember website names (like example.com) into the strings of numbers (IP addresses, like 93.184.216.34) that devices actually use to find each other on the internet. The simplest way to picture it is as the phone book of the internet: you know the name, and DNS quietly looks up the “number” you need to dial to connect.

What is DNS?

People prefer names; computers prefer numbers. You’ll remember example.com, but the machines on the other side recognize each other by IP addresses — strings of digits like 93.184.216.34. DNS is the translator between these two worlds: it takes the name you typed and hands back the matching IP address, so a connection can actually happen.

Importantly, there’s no single giant server that knows every name in the world. The knowledge is spread across a huge number of servers that talk to each other. That makes the system fast and hard to knock out entirely — think of a network of cooperating libraries rather than one warehouse. (IP addresses come in two flavors: the older IPv4, e.g. 93.184.216.34, and the newer, longer IPv6 — DNS handles both.)

How does DNS work?

When you type an address into your browser, your device first has to learn the website’s IP address before it can fetch anything. That “asking for the address” is called name resolution. If the answer isn’t already remembered, the question travels through a few servers that, step by step, pass it closer to the right source.

For you, all of this happens in a fraction of a second and is completely invisible. Behind the scenes, though, several separate questions were asked, and the finished answer was remembered — so that next time the same site opens instantly.

What are the types of DNS servers?

In the classic setup, your question is handled in turn by four kinds of servers. You can think of them as a chain of people, each knowing a bit more and pointing you further along:

• Resolver (the server that does the asking) — the starting point. It takes your question and takes on the job of finding the answer by querying the other servers. It’s usually provided by your internet provider or a public service.
• Root server — doesn’t know specific addresses itself, but knows who handles a given name ending, such as .com or .org, and points there.
• TLD server — responsible for a whole domain ending (like .com, .org, or .net) and points to whoever knows the specific website.
• Authoritative server — this is the one that holds a domain’s real data and gives the final, definitive answer with the IP address.

What is a DNS resolver?

A resolver is like a concierge that handles the errand for you. You ask one question (“what’s the address of example.com?”), and it goes around calling the root server, the domain-ending server, and the authoritative server until it has the answer. It also has a good memory — if you asked about that site recently and the answer is still valid, it hands it back instantly, without running around the servers again.

What does a single DNS query look like?

For a site nobody has asked about yet, the journey looks roughly like this:

1. You type an address (e.g. example.com), and your system passes the question to the resolver.
2. The resolver first checks its own memory. If it knows a current answer, it returns it right away and that’s the end of it.
3. If it doesn’t know, it asks one of the root servers.
4. The root server points it to the server in charge of the domain ending (e.g. .com).
5. The resolver asks that domain-ending server about the site.
6. The domain-ending server points to the authoritative server that knows this specific domain.
7. The resolver asks the authoritative server for the address.
8. The authoritative server returns the IP address.
9. The resolver remembers the answer for a while and passes the address to your device, which then connects to the site.

What are the types of DNS queries?

• Recursive query — you tell the resolver “go find me a finished answer,” and it handles everything, coming back either with an address or with an error.
• Iterative query — a server says “I don’t know this myself, but go ask over there.” That’s how the resolver talks to the root, domain-ending, and authoritative servers.
• Non-recursive query — a server already knows the answer (it has it remembered, or it’s the one in charge of that domain) and gives it straight away.

Why does DNS remember answers, and what is TTL?

To make the internet faster and avoid flooding servers with millions of identical questions, DNS answers are remembered (cached) in several places along the way:

• in the browser — the first place it looks when you open a site,
• in the operating system — your computer or phone keeps recent answers before it even sends a question out onto the network,
• in the resolver — your provider’s or a public service’s server remembers answers for many users at once.

How long an answer stays “valid” is set by the TTL (Time To Live) — a number of seconds chosen by the domain’s owner. Think of it as a best-before date: once it passes, the answer is treated as stale and fetched again on the next question. A short TTL means changes to a site spread faster but generate more questions; a long TTL eases the load on servers but makes changes take longer to reach everyone.

What are the types of DNS records?

A domain’s data is organized into “entries” (records) of different kinds — each one doing a different job. The most important are:

• A — assigns an IPv4 address to a domain name.
• AAAA — assigns an IPv6 address to a domain name.
• CNAME — an alias, pointing one name to another (like a redirect to the right address).
• MX — points to the servers that receive email for the domain.
• NS — says which servers are authoritative for the domain.
• TXT — stores arbitrary text; used among other things to prove domain ownership and for email security (SPF, DKIM, DMARC).
• PTR — works the other way around: it recovers a domain name from an IP address (reverse DNS).
• SOA — the domain’s “header” entry, holding the basic settings for the zone.

Why does DNS matter for security?

DNS was created long ago, when the main goal was simply to make it work — it wasn’t built to check whether an answer truly comes from a trusted source. That’s why it’s both a target of attacks and a tool in attackers’ hands. On the flip side, it’s everywhere, so what someone looks up in DNS, and when, is a great clue for spotting threats. The key terms worth knowing:

• Cache poisoning / spoofing — slipping a fake answer to the resolver, so you land on the attacker’s server even though you typed the correct address. A bit like someone swapping a number in the phone book.
• DNS hijacking — changing DNS settings on your device, router, or domain provider so that all traffic flows to rogue servers.
• DNS tunneling — smuggling other data hidden inside DNS queries. Attackers like it because DNS traffic is rarely blocked and few people watch it closely — they use it quietly to control infected computers and steal data.
• DGA (Domain Generation Algorithm) — malware that invents lots of ever-changing domain names itself, to make it harder to block and cut off from its “home base.”
• DNS DDoS attacks — flooding DNS servers with so many requests that they can’t keep up; they’re also abused to amplify attacks against other victims.
• DNSSEC — an add-on that digitally signs DNS answers so you can check they came from the right source and weren’t changed along the way (it protects authenticity, but doesn’t hide the contents).
• DoH and DoT — ways to encrypt DNS queries so no one along the route can eavesdrop or tamper with them. They boost privacy but also make it harder for defenders to see what’s happening in DNS traffic.

For security teams (SOC) and tools that monitor networks, DNS data is therefore very valuable. It shows lookups of known malicious domains, odd “machine-like” query patterns typical of DGAs, suspiciously long TXT entries that may hint at tunneling, or a sudden change in how a device behaves. Watching DNS often catches an attack early — before any actual data theft happens.

Learn more

• DNS Spoofing / Cache Poisoning — Attackers forge DNS data to redirect queries to malicious destinations.
• Secure Access Service Edge (SASE) — SASE often includes DNS security and filtering as part of cloud-delivered access control.
• Encrypted Traffic Analysis (ETA) — ETA can help detect DNS over HTTPS or suspicious DNS-related traffic patterns.
• Fast Flux — Fast flux uses rapidly changing DNS records to hide malicious infrastructure.
• Amplification Attack — DNS can be abused in amplification attacks by reflecting small queries into large responses.