DNS — How Resolution Works

Humans remember names (example.com); machines route by numbers (93.184.216.34). DNS (Domain Name System) is the distributed directory that translates one into the other, at massive scale, for the whole internet.

DNS is organized as a tree, read right to left:

Root (.)

The top; knows where each TLD lives.

TLD (.com, .org …)

Knows which server is authoritative for each domain under it.

Authoritative

Holds the real records for example.com and gives the final answer.

Your device runs a tiny stub resolver that offloads the real work to a recursive resolver — usually run by your ISP or a public one like 8.8.8.8. The recursive resolver does all the asking around and returns just the final answer.

To resolve www.example.com the resolver asks in turn: the root ("where is .com?"), the .com TLD ("where is example.com?"), and finally example.com’s authoritative server ("what is the IP?"). Each step narrows it down until the address is found.

That full walk would be slow to repeat, so every answer carries a TTL (time to live). Resolvers cache the record for that duration and answer subsequent queries instantly from cache — which is why the first lookup of a site is slower than the rest.

Two query styles exist. In a recursive query, you ask the resolver and it does everything, returning the final IP. In iterative queries (what the resolver itself uses upstream), each server simply replies with a referral to the next server to ask.

DNS uses port 53. Most lookups go over UDP because they are small and fast — a single query and reply. But when a response is too large to fit, or for zone transfers between servers, DNS switches to TCP for reliable, larger transfers.