How DNS Works: The Step-by-Step Path of a DNS Lookup
A DNS server turns a website name into an IP address in a few steps and caches the answer. See who responds to your lookup, and in what order.
A DNS server works like a directory service: you give it a website's name, and it returns the numeric address of the server where the site lives. If it doesn't already have the answer, it works through a chain of other servers, remembers the result, and hands it back to you. We cover DNS in general in our main article explaining DNS in plain English. Here we'll look at what happens inside a single lookup.
Who is involved in a DNS lookup?
An ordinary lookup involves four roles. They don't have to run on separate machines, but they are logically separate jobs.
| Participant | What it does | Simple analogy |
|---|---|---|
| Resolver (recursive server) | Takes your query and sees it through to an answer | A receptionist who makes all the calls for you |
| Root server | Points to who handles .com, .org and other zones | The sign in the lobby: "Third floor, please" |
| TLD server | Knows where the records for a specific domain are kept | The floor manager |
| Authoritative server for the domain | Holds the actual records and returns the final IP | The person who has the document you need |
The resolver is usually run by your internet provider, but you can switch to a public one. We'll cover how to choose in a separate article.
What happens step by step when you type a web address?
Say you open example.com for the first time today.
- The browser checks its own cache. If you visited the site recently, the address is already known and no network request is needed.
- The operating system checks its cache and the hosts file. This is the second line of defense, and no outside server has been contacted yet.
- The query goes to the resolver. It checks its own cache first. For popular sites it almost always has an answer, because thousands of people have asked before you.
- The resolver contacts a root server. The root server doesn't know the site's address, but it tells the resolver which servers handle the
.comzone. - The resolver asks the TLD server. That server says which servers hold the records for
example.comspecifically. - The resolver asks the domain's authoritative server. Only this server provides the final IP address.
- The answer comes back to you and is cached on the resolver, in your system, and in your browser.
There are officially 13 root server names, A through M, but each one is backed by hundreds of physical machines around the world that answer from the nearest location. That's why the root level doesn't become a bottleneck.
What kinds of records does a DNS server store?
DNS returns more than an IP address. A domain has a set of records of different types, and they show how a service is put together.
The most common ones are A and AAAA (the site's IPv4 and IPv6 addresses), CNAME (an alias), MX (mail servers), and TXT (service labels such as domain ownership verification). This is why a mistake in the MX record can leave a website loading fine while email to the domain never arrives: they are separate records in the same zone.
What are DNS cache and TTL, and why is the second lookup faster?
Every record has a TTL (time to live), measured in seconds. As long as it hasn't expired, the resolver answers from memory and doesn't go through the chain again. Typical values range from five minutes to a day.
There is a downside. When a site owner moves to a different host and changes the IP, some users keep landing on the old address for a while, because their resolvers hold the old record until the TTL runs out. Administrators lower the TTL ahead of a migration for exactly this reason.
How can I see a DNS response myself?
You don't need to install anything: nslookup comes with Windows, macOS, and Linux.
```
nslookup example.com
```
The output has two blocks. The top one shows which server answered you, which is your resolver. The bottom one shows the IP address it found. If you run the command a second time, the answer comes back noticeably faster and is labeled "Non-authoritative answer". That means it came from a cache rather than from the domain's own server.
For a more detailed view on macOS and Linux, use dig example.com. It also shows the remaining TTL and the query time in milliseconds.
What does a DNS server know about me?
The resolver sees which domains you look up, and by default it sees them in plain text, because classic DNS is not encrypted. It can't see the content of the pages, but it can see the list of sites you visit. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) protect against this by encrypting the query itself, so on a network you don't control, such as public Wi-Fi, it's harder to read or tamper with.
The opposite situation happens too: a secure connection is switched on, but DNS queries still go to your provider's server. To learn how to check for this, see our article on IP and DNS leaks.
Quick recap
- A DNS server returns an IP address for a site name and remembers the answer.
- The root → TLD → domain chain is only needed when the answer isn't already cached.
- Repeat lookups are faster thanks to the cache, and the TTL decides how long a record counts as fresh.
- Classic DNS is not encrypted, and DoH and DoT close that gap.
- You can check who is actually answering your queries with the
nslookupcommand.
Subscription terms and plan lengths for a secure connection on all your devices are listed on the pricing page.