My IP Help

DNS

Also known as: Domain Name System

The Domain Name System — the internet's phone book, translating human-readable domain names like example.com into numeric IP addresses.

Last updated:

What is DNS?

DNS (Domain Name System) is the hierarchical, distributed naming system that turns human-readable names like www.example.com into the numeric IP addresses that computers use to route traffic. Every time a browser, app, or server connects to a host by name, it first performs a DNS lookup to resolve that name. DNS was defined in RFC 1034 and RFC 1035 in 1987.

How a DNS lookup works

A typical recursive lookup for www.example.com involves four parties and multiple steps:

  1. Stub resolver on your device asks its configured recursive resolver (your ISP, 1.1.1.1, 8.8.8.8, etc.)
  2. The recursive resolver queries a root name server for the .com TLD
  3. It then queries the .com authoritative server for example.com
  4. Finally it queries example.com's authoritative server for the www record
  5. The resolver caches the answer (respecting TTL) and returns it to the stub

The whole round-trip usually takes 20-80 ms when nothing is cached, and sub-millisecond for cache hits.

Common record types

| Record | Purpose | |--------|---------| | A | IPv4 address for a name | | AAAA | IPv6 address for a name | | CNAME | Alias pointing one name at another | | MX | Mail server responsible for a domain | | TXT | Arbitrary text (SPF, DKIM, DMARC, verification tokens) | | NS | Authoritative name servers for the zone | | PTR | Reverse lookup — IP → hostname (see reverse DNS) | | SRV | Service discovery (hostname + port for a named service) | | CAA | Which CAs are allowed to issue TLS certificates for the domain |

Transport and encryption

Classic DNS runs over UDP port 53 (or TCP 53 for large responses). Modern privacy-focused variants encrypt queries:

  • DNS-over-TLS (DoT) on TCP 853
  • DNS-over-HTTPS (DoH) on HTTPS 443
  • DNS-over-QUIC (DoQ) on UDP 853

Use our DNS lookup tool to inspect A, AAAA, MX, TXT, NS, and other records for any domain.

Frequently Asked Questions

Sites become unreachable by name even though the underlying servers are still running. Browsers, email clients, APIs, and background services that rely on hostnames all fail. Most DNS outages are partial — a single resolver or a single authoritative provider goes down, affecting a subset of users or domains. Major outages like the 2021 Akamai and Facebook DNS incidents showed how widely a single provider failure can cascade.
An authoritative DNS server holds the actual records for a zone — for example, the nameservers that publish the records for `example.com`. A recursive resolver (such as 1.1.1.1, 8.8.8.8, or your ISP's resolver) is the one your device queries; it does the work of asking the root, TLD, and authoritative servers in turn, then caches and returns the answer. End users almost never query authoritative servers directly.
DNS does not "propagate" — it expires from caches. The time depends on the record's TTL: a 300-second TTL means resolvers will refresh within 5 minutes, while a 24-hour TTL means some users will see the old answer for a full day. Lower the TTL on a record at least one TTL before any planned change. The widely cited "24-48 hours" figure is a conservative upper bound for stale enterprise resolvers and DNS clients that ignore TTLs.
Classic DNS over UDP port 53 is plaintext — anyone on the network path can see and modify queries. Modern encrypted DNS standards fix this: DNS-over-HTTPS (DoH) on port 443, DNS-over-TLS (DoT) on port 853, and DNS-over-QUIC (DoQ). All major browsers, iOS, Android, and Windows 11 support encrypted DNS, but it is opt-in in many configurations and your ISP-provided resolver may not support it at all.
DNS cache poisoning (or DNS spoofing) is an attack that injects a forged response into a resolver's cache, making it return a malicious IP for a legitimate domain. Modern resolvers defend against this with randomized source ports, query-ID entropy, 0x20 case randomization, and DNSSEC signature validation when the zone is signed. Wide-scale poisoning is now rare on the public internet but still possible on compromised local networks or rogue Wi-Fi.
Back to glossary