How DNS Turns a Web Address Into an IP Address

The Domain Name System, or DNS, translates a name such as www.example.com into the numeric IP address that computers use to find each other. Your browser asks a chain of servers, each pointing it closer to the answer, and then remembers the result so the next visit is faster. This article walks through that chain and explains the records and timers that make it work.

Why names need translating

Computers on the internet are reached by IP addresses, which are strings of numbers. People prefer names. DNS is the system that links the two. Before DNS existed, one central file called HOSTS.TXT, kept at the Stanford Research Institute, listed the names and addresses of machines on the ARPANET, and addresses were assigned by hand. According to the Wikipedia article on DNS, Paul Mockapetris designed the Domain Name System in 1983 at the University of Southern California's Information Sciences Institute. The first specifications appeared as RFC 882 and 883 in November 1983 and were replaced by RFC 1034 and 1035 in November 1987.

Instead of one file, DNS spreads the work across many servers arranged as a hierarchy. No single machine has to know every name.

The steps of a lookup

Amazon Web Services describes a typical lookup in a handful of steps. Suppose you type www.example.com into a browser:

• Your device sends the question to a recursive resolver. This is usually run by your internet provider or your workplace network. It owns no records itself; it finds answers on your behalf, much like a hotel concierge.
• The resolver asks a root name server. The root does not know the final answer, but it knows which servers handle each top-level domain such as .com.
• The resolver asks the .com top-level domain (TLD) server. That server replies with the names of the name servers responsible for example.com.
• The resolver asks one of those authoritative name servers. An authoritative server has the final say over a domain. It looks up the www record and returns its value, for example an IP address.
• The resolver passes the address back to your browser and stores it for a while. The browser then connects to that address.

The Wikipedia article describes the same idea. A recursive server starts from root hints, a built-in list of the root servers' addresses, and follows referrals down the hierarchy until it reaches an authoritative answer.

Caching and time to live

Asking three or four servers for every page would be slow and would overload the root servers. So answers are cached. Each DNS record carries a time to live, or TTL, a number of seconds set by whoever runs the domain. Until that time runs out, a resolver can answer from memory without repeating the lookup. The Wikipedia article notes that, because of caching, root servers see only a relatively small share of all requests.

Caching also explains why a change to a DNS record is not instant everywhere. Old copies stay in caches until their TTL expires. The same article says TTLs can range from a few seconds to days or weeks, and mentions that RFC 1912 suggests one to five days for typical records. Some resolvers apply their own limits, so the real delay can differ.

Common record types

A domain's settings are stored as records, and each record type answers a different question:

• A maps a name to an IPv4 address.
• AAAA maps a name to an IPv6 address.
• MX names the mail server for a domain, with a priority number.
• CNAME makes one name an alias of another.

The root servers

The top of the hierarchy is the root zone. The Wikipedia article says it is served by thirteen groups of root name servers. Copies of each group are spread around the world using anycast, a method in which many machines share one address and a request reaches a nearby one. This is why the root can serve a global audience without being a single point of failure. The article does not give a total count of machines, so this article does not either.

What DNS does not do

DNS only finds the address. It does not load the page, and it does not by itself hide which names you look up. Whether the lookups are encrypted depends on the resolver and the settings your device uses. If a site seems unreachable, the cause can be DNS, the server, or the network, and each needs a different check.

In short, DNS is a distributed directory. A resolver walks down from the root to the TLD to the domain's own servers, then caches what it learned for as long as the record's TTL allows. That layered design, and the caching on top of it, is what lets billions of lookups happen every day.

This is general information about how the system works, not advice on configuring any particular domain or network.

Sources

• What is DNS?, Amazon Web Services (Route 53)
• Domain Name System, Wikipedia