DNS Resolution#

DNS turns a hostname into an IP address by walking a tree of authoritative servers. Recursive resolvers (your ISP's, 8.8.8.8, 1.1.1.1) cache every step.

sequenceDiagram
  participant App
  participant Stub as Stub resolver
  participant Rec as Recursive resolver (8.8.8.8)
  participant Root as . root
  participant TLD as .com TLD
  participant Auth as ns1.example.com
  App->>Stub: gethostbyname(api.example.com)
  Stub->>Rec: query A api.example.com
  Rec->>Root: ?
  Root-->>Rec: ask .com servers
  Rec->>TLD: ?
  TLD-->>Rec: ask ns1.example.com
  Rec->>Auth: ?
  Auth-->>Rec: A 203.0.113.10
  Rec-->>Stub: A 203.0.113.10 (TTL 300)

Every step caches the answer for the TTL, so the next query for any *.example.com host skips most of the walk.

DNS is the most-cached protocol on the internet. Understanding its layers explains both why your service is fast (cache hits) and why occasionally something breaks for 24 hours (negative TTLs).

Record types#

Record	Purpose
`A`	IPv4 address
`AAAA`	IPv6 address
`CNAME`	Alias to another name
`MX`	Mail exchanger
`TXT`	Free-form text (SPF, DKIM, verifications)
`NS`	Name server for a zone
`SOA`	Start of authority; zone metadata
`PTR`	Reverse lookup
`SRV`	Service location with port
`CAA`	Authorized CAs for issuance
`HTTPS` / `SVCB`	Modern service binding (HTTP/3 hints)

Recursive vs iterative#

flowchart TB
  Stub[Stub resolver<br/>libc, glibc] -->|recursive query| Rec[Recursive resolver<br/>8.8.8.8, 1.1.1.1]
  Rec -->|iterative| Root[Root servers]
  Rec -->|iterative| TLD[TLD servers]
  Rec -->|iterative| Auth[Authoritative servers]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;

Stub: in your OS; asks one upstream for a final answer.
Recursive: walks the tree on the client's behalf.
Iterative: each server returns "ask this next one"; the recursive resolver follows.
Authoritative: holds the zone's records; never recurses.

Caching and TTLs#

Every layer caches:

flowchart LR
  App -->|gethostbyname| Stub
  Stub -.cache.-> Rec
  Rec -.cache.-> Auth

    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    class Stub,Rec cache;

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;

TTL	Effect
60s	Quick failover; high resolver QPS
300s	Common for production records
3600s	Stable infrastructure; common for nameservers
86400s	DNS for never-changing services

Negative caching (NXDOMAIN) is governed by the SOA minimum field. A typo'd record can be cached as missing for hours.

DNS-based load balancing#

api.example.com  A  203.0.113.10
                 A  203.0.113.11
                 A  203.0.113.12

Round-robin DNS: server returns multiple A records, client picks one. Simple but blunt; doesn't react to backend health. Used by:

GeoDNS: return different answers by client location.
Latency-based (Route 53): direct to lowest-latency region.
Weighted: gradual rollout, 1% to new region.
Failover: health check primary; return secondary on failure.

DNSSEC#

Adds signatures to DNS records, proving they weren't tampered with in transit:

flowchart LR
  Zone --> RRSIG[RRSIG record:<br/>signature of RRset]
  Zone --> DNSKEY[DNSKEY record:<br/>zone's public key]
  Parent --> DS[DS record:<br/>hash of child DNSKEY]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;

DNSSEC chains trust from the root down. Adoption is uneven; major CDNs sign but resolver validation is patchy.

DoH / DoT / DoQ#

Standard DNS runs over UDP/53 in cleartext. Modern protocols encrypt:

Protocol	Transport
DoT (DNS over TLS)	TCP/853 with TLS
DoH (DNS over HTTPS)	HTTPS/443 (looks like web traffic)
DoQ (DNS over QUIC)	UDP/853 with QUIC

Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9 all support DoH/DoT.

Common failure modes#

Symptom	Cause
Long resolve time for new domain	Cold caches walking the full tree
Site works for some users only	Stale resolver cache or DNS-based LB anomaly
Took 24h after DNS change	High TTL on previous record
Sporadic NXDOMAIN	Authoritative server flakiness; resolver retries
`EAI_AGAIN` errors	Resolver timeout; usually network

Operational tips#

Pre-warm caches before deploys with shorter TTLs (drop to 60s an hour ahead).
Have at least two NS records on different infra.
Health-check ALL authoritative nameservers, not just one.
Use ALIAS / ANAME at the apex if your DNS provider supports it (CNAME at apex is illegal).
Monitor authoritative QPS - DDoS amplification targets DNS.

Where DNS connects#

flowchart TB
  DNS((DNS<br/>resolution))
  NET[Network basics<br/>protocol stack]
  CDN[CDN<br/>geo steering via DNS]
  ANY[BGP + anycast<br/>how DNS roots are hosted]
  DNSSYS[DNS system<br/>full-system design]
  NET --> DNS
  DNS --> CDN
  ANY --> DNS
  DNS --> DNSSYS

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class DNS service;
    class NET,CDN,ANY,DNSSYS datastore;

Glossary & fundamentals#

Tag	Concept	What it is	Page
`HLD`	Network basics	the protocol stack	network-basics
`HLD`	DNS system	full-system design problem	dns-system
`HLD`	CDN	DNS-based geo steering pairs with CDN	cdn
`HLD`	BGP anycast	how root and CDN DNS is hosted	bgp-anycast

Quick reference#

Path#

Stub → Recursive resolver → Root → TLD → Authoritative → answer

Records#

A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA, HTTPS/SVCB.

TTL guidance#

TTL	Use
60s	Imminent change
300s	Production default
3600s	Stable NS records
86400s	Rarely-changing infra

DNS-based LB#

Round-robin
GeoDNS
Latency-based (Route 53)
Weighted (canary)
Failover with health check

Encrypted DNS#

DoT - TLS/853
DoH - HTTPS/443
DoQ - QUIC/853

DNSSEC#

RRSIG + DNSKEY + DS chain to root. Spotty validation in practice.

Failure modes#

Stale cache → 24h delay after change
Cold cache → slow first hit
NXDOMAIN cached → typo persists
Resolver flap → EAI_AGAIN

Ops checklist#

Drop TTL an hour before changes
2+ NS on different infra
Monitor each authoritative
ALIAS/ANAME at apex (no CNAME)
Watch for amplification attacks

Refs#

RFC 1034/1035
RFC 8484 (DoH)
Cloudflare DNS learning center

FAQ#

How does DNS resolution work?#

A recursive resolver walks the DNS tree from the root to the TLD then to the authoritative server, caching each answer. Subsequent queries skip most of the walk.

What is the difference between an A record and a CNAME?#

An A record maps a hostname directly to an IPv4 address. A CNAME makes one hostname an alias of another, so resolvers chase the alias to find the final A record.

What does the TTL on a DNS record mean?#

TTL is how long a resolver may cache the answer before re-querying. Short TTLs allow quick failover; long TTLs reduce traffic but slow propagation of changes.

Why are DNS changes slow to propagate?#

Caches at the OS, recursive resolver, and ISP each honour their copy until TTL expires. Lower TTLs in advance of a change shortens propagation but raises traffic.

What is DNSSEC?#

DNSSEC signs DNS answers so resolvers can verify they were not tampered with in transit. It prevents poisoning attacks but does not encrypt the query itself.

DNS System: the full design problem this page underlies
BGP and Anycast: how root and CDN DNS servers are anycast-hosted
CDN: DNS-based geo steering routes users to the right edge

Video walkthrough

Everything You Need to Know About DNS : via ByteByteGo

DNS Resolution#

Record types#

Recursive vs iterative#

Caching and TTLs#

DNS-based load balancing#

DNSSEC#

DoH / DoT / DoQ#

Common failure modes#

Operational tips#

Where DNS connects#

Glossary & fundamentals#

Quick reference#

Path#

Records#

TTL guidance#

DNS-based LB#

Encrypted DNS#

DNSSEC#

Failure modes#

Ops checklist#

Refs#

FAQ#

How does DNS resolution work?#

What is the difference between an A record and a CNAME?#

What does the TTL on a DNS record mean?#

Why are DNS changes slow to propagate?#

What is DNSSEC?#

Related Topics#

Further reading#

Video walkthrough