What is DNS?#

DNS translates human-readable domain names into IP addresses. It’s a distributed, hierarchical database — the “phone book” of the internet.

flowchart LR
    Browser["www.example.com"] -->|DNS Query| Resolver["DNS Resolver"]
    Resolver -->|"93.184.216.34"| Browser

Without DNS, you’d need to memorize IP addresses for every website.

DNS Hierarchy#

flowchart TD
    Root[". (Root)"]
    Root --> COM[".com"]
    Root --> ORG[".org"]
    Root --> NET[".net"]
    COM --> Example["example.com"]
    COM --> Google["google.com"]
    Example --> WWW["www.example.com"]
    Example --> API["api.example.com"]

DNS Resolution Process#

sequenceDiagram
    participant B as Browser
    participant R as Recursive Resolver (ISP/8.8.8.8)
    participant Root as Root Server
    participant TLD as .com TLD Server
    participant Auth as example.com Authoritative

    B->>R: What is www.example.com?
    R->>Root: What is www.example.com?
    Root->>R: I don't know, ask .com TLD (ns1.verisign.com)
    R->>TLD: What is www.example.com?
    TLD->>R: Ask example.com nameservers (ns1.example.com)
    R->>Auth: What is www.example.com?
    Auth->>R: A record: 93.184.216.34 (TTL: 3600)
    R->>B: 93.184.216.34 (cached for 1 hour)

Resolver Types#

DNS Record Types#

CNAME Rules#

• Cannot coexist with other records at the same name
• Cannot be used at the zone apex (example.com) — only subdomains
• AWS Route 53 “Alias” records solve the apex limitation

TTL (Time To Live)#

How long resolvers cache a record (in seconds):

Lower TTL = faster propagation of changes, but more DNS queries (higher load).

Migration pattern: Lower TTL days before a change, make the change, verify, then raise TTL back.

DNS Caching Layers#

Browser cache (seconds) → OS cache (minutes) → Router → Recursive resolver (TTL) → Authoritative

# Flush DNS cache
# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Linux (systemd-resolved)
sudo systemd-resolve --flush-caches

# Windows
ipconfig /flushdns

DNS Tools#

dig — The Standard DNS Tool#

# Basic query
dig example.com

# Specific record type
dig example.com MX
dig example.com TXT

# Query specific resolver
dig @8.8.8.8 example.com

# Short output
dig +short example.com

# Trace full resolution path
dig +trace example.com

# Reverse lookup
dig -x 93.184.216.34

nslookup (simpler, cross-platform)#

nslookup example.com
nslookup -type=MX example.com
nslookup example.com 8.8.8.8

DNS Security#

DNSSEC#

Adds cryptographic signatures to DNS records — resolvers can verify authenticity:

example.com.  A     93.184.216.34
example.com.  RRSIG A  (signature proving the A record is authentic)

DNS in Cloud (AWS Route 53)#

Key Takeaways#

1. DNS is hierarchical — root → TLD → authoritative
2. A records map names to IPs; CNAME creates aliases
3. TTL controls caching — lower before changes, raise after
4. dig +short for quick lookups, dig +trace for debugging
5. DNS is often the first thing to check when “the site is down”
6. Propagation isn’t instant — TTL determines how fast changes spread