DNS & Domains

What is DNS?

The Domain Name System, or DNS, is the internet’s phone book. Machines address each other by IP address, but people remember names. DNS translates example.com into the address the network needs, and it does so through a distributed hierarchy of servers with a caching layer on top.

Every time you visit a site, send an email or call an API, a DNS lookup happens first. When DNS is slow or misconfigured, everything feels broken even though the servers are fine.

The domain hierarchy

Domain names are read right to left, from the most general to the most specific.

• The root is the invisible dot at the end.
• The TLD is .com, .org, .dev and so on.
• The registrable domain is example.com, the part you buy from a registrar.
• Subdomains like blog or api are yours to create freely.

You register the second-level domain, then manage its records through a DNS host.

Record types

A handful of record types cover almost every setup.

A and AAAA point at addresses. CNAME points at another name, which is ideal for CDNs and platform hostnames because their addresses change. TXT records verify ownership for services and carry email policies like SPF and DMARC.

How resolution works

When you look up a name, a recursive resolver does the walking:

1. The resolver checks its cache. A hit returns immediately.
2. Otherwise it asks a root server, which points to the TLD.
3. It asks the TLD server, which points to your authoritative nameservers.
4. It asks your authoritative nameserver, which returns the record.
5. The resolver caches the answer for its TTL and returns it.

Because every step is cached, most lookups never reach the root. That is what makes DNS fast at global scale.

TTL and caching

Every record has a TTL (time to live) in seconds: how long resolvers may cache the answer.

• Short TTLs (300s) mean changes take effect quickly but cause more lookups.
• Long TTLs (86400s) reduce lookup traffic but slow down changes.

The practical rule: lower the TTL before a migration so caches expire quickly, make the change, then raise it again once things are stable.

Registrars and nameservers

A registrar is where you buy and renew a domain. A DNS host provides the nameservers that store your records; these can be the same company or different.

You point your domain at a set of nameservers by setting NS records at the registrar. Those authoritative servers are the source of truth for everything else. Many registrars, cloud providers and CDNs offer DNS hosting, and managed providers add fast global anycast networks and features like health checks.

Security

DNS was designed without security, so several extensions exist:

• DNSSEC signs records so resolvers can verify they were not forged.
• DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt lookups so they cannot be read or manipulated in transit.
• CAA records restrict which certificate authorities may issue certificates for your domain.

Enable DNSSEC where your provider supports it, and use encrypted DNS on clients and servers.

Common setups

• Apex vs www. Redirect one to the other so there is a single canonical host.
• CDN. Point a subdomain at the CDN’s hostname with a CNAME, or use an ALIAS/ANAME record at the apex.
• Email. Add MX records for delivery and TXT records for SPF, DKIM and DMARC to prevent spoofing.
• Verification. Add the TXT record a service asks for to prove you own the domain.
• Environments. Use subdomains like staging.example.com for separate deployments.

Troubleshooting

• Use dig or nslookup to query records directly and compare against what you expect.
• Check the TTL and remember that old values linger in caches until it expires.
• Confirm your nameservers at the registrar match your DNS host.
• Look for typos in hostnames and missing trailing dots in zone files.
• For email issues, check MX plus SPF, DKIM and DMARC records together.

Best practices

• Keep DNS at a reputable provider with a fast anycast network.
• Lower TTLs before planned migrations and raise them afterwards.
• Use CNAMEs for hosts you do not control and A/AAAA for ones you do.
• Enable DNSSEC and add CAA records.
• Set up SPF, DKIM and DMARC for any domain that sends email.
• Monitor certificate expiry and DNS changes.

Common mistakes

• Forgetting that caches ignore changes until the TTL expires.
• Putting a CNAME at the zone apex on providers that do not support it.
• Pointing a domain at an IP you no longer control.
• Missing email records and having mail marked as spam.
• Leaving the default TTL high during a migration.
• Assuming DNS is encrypted by default when it is not.

Where to go next

DNS is the first step of every request. Follow it with the HTTP guide, understand the network underneath in How the Internet Works, and see what the browser does next in Browsers & Rendering. Then run dig on your own domain and read the answers.