What is the Domain Name System and how does DNS work?

Rather than a single database, DNS is a hierarchical naming system involving multiple server types working together. This article covers how the DNS resolution process works, the four server types involved, common DNS record types, and what domain owners need to understand about DNS.

How DNS lookup and resolution work

When you enter a domain name into a browser, a multi-step lookup process called DNS resolution runs in the background. It happens in milliseconds, but involves several distinct servers:

1. Browser checks local cache. Your operating system and browser store recent DNS lookups and DNS information locally. If the domain was visited recently, the IP address may already be cached; no external query needed.
2. Query goes to a recursive resolver. If there's no cached result, the query is sent to a recursive DNS resolver; typically operated by your ISP, or a public DNS resolver like Google (8.8.8.8) or Cloudflare (1.1.1.1). The recursive resolver does the legwork of querying other servers on your behalf.
3. Resolver queries a root nameserver. The recursive resolver asks a root nameserver where to find the TLD (top-level domain) nameserver for the domain's extension (e.g., .com). There are 13 root server clusters worldwide, coordinated by ICANN.
4. Root nameserver points to a TLD nameserver. The root nameserver returns the IP address of the TLD nameserver responsible for that extension.
5. TLD nameserver returns the authoritative nameserver. The TLD nameserver (for example, Verisign's servers handle all .com lookups) returns the IP address of the authoritative nameserver for the specific domain name.
6. Authoritative DNS server provides the IP address. The authoritative DNS server holds the actual DNS records for the domain and returns the corresponding IP address. The recursive resolver caches this result and returns it to your browser, which then loads the site.

This entire process typically completes in under 100 milliseconds.

The four types of DNS servers

DNS involves four distinct server types. Each type of DNS server plays a specific role in the resolution chain:

These four server types form a chain. The recursive resolver is the only one your device communicates with directly. The other three are queried by the resolver in sequence until the authoritative server provides the final answer — the IP address for the domain.

Common DNS record types

Records are the individual entries that tell the system how to handle traffic for a domain. A domain owner with access to their DNS settings can view and edit these records. The most common types are:

The A record is the most fundamental — it maps domain names into IP addresses. When someone enters your domain, the A record tells resolvers which IP address to return. NS records determine which name servers are authoritative for the domain, which in turn controls where all other records are managed.

What DNS means for domain registrants

Most DNS documentation is written for network engineers. For someone who has just registered a domain, here is what actually matters:

1. Your registrar sets default NS records. When you register a domain, your registrar automatically sets NS (nameserver) records pointing to their own nameservers. Your registrar stores DNS zone data on their name servers by default — and your DNS records (A, MX, TXT, etc.) are managed through their interface.
2. You can change nameservers. Pointing a domain to a different web hosting provider, CDN, or DNS service requires updating the NS records at your registrar to point to the new provider's nameservers. Once updated, all record management moves to the new provider.
3. DNS propagation takes time. After changing nameservers or updating a DNS record, the new information takes time to spread across DNS servers worldwide. This is called propagation. The updated IP address or other DNS data may not be visible everywhere right away — most changes resolve within a few hours, but it can take up to 48 hours.
4. Domain registration and DNS hosting are separate. You can register a domain with one provider and manage DNS with a completely different one.
5. To understand what a domain name is and how the different parts relate, see the foundational guide. To compare registration costs across extensions and registrars, compare domain extension prices.

DNS security basics

Three DNS security mechanisms are worth understanding for domain owners:

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that responses haven't been tampered with. It protects against DNS cache poisoning — an attack where a resolver is fed false IP addresses, redirecting users to malicious sites. DNSSEC is optional, but enabling it is a good practice if your registrar supports it. Not all registrars offer DNSSEC management.

DNS cache poisoning is an attack that exploits the caching behavior of recursive resolvers. An attacker injects false DNS data into a resolver's cache, causing users to be directed to fraudulent sites even when they type the correct domain name. DNSSEC is the main defense against this attack.

DNS over HTTPS (DoH) encrypts DNS queries so they can't be intercepted or read in transit. Traditional DNS queries are sent in plain text, which means your ISP or anyone on the same network can see which domains you're querying. DoH wraps those queries in HTTPS encryption. For most domain owners, DoH is handled at the browser or operating system level — it's not something you configure on your domain's DNS settings directly.

Frequently asked questions

Once you understand how DNS maps your domain to an IP address and connects it to the web, the next step is finding the right extension and comparing registration costs. Compare registration, renewal, and transfer prices for any TLD; TLD-list tracks data from 50+ registrars.

About the Author:

TLD-list

Editor team

Small crew of builders who believe a great idea should not be held back by a bad domain deal. We know this space inside out, from obscure new extensions to the registrar tricks that quietly inflate your renewal. We put that knowledge to work so you can spend less time worrying about domains and more time building the thing that matters.