DNS: How Names Become IP Addresses

DNS (the Domain Name System) maps human-readable domain names, like routelearn.net, to the IP addresses computers actually use to send traffic. Without it, you'd have to memorise an IP address for every website instead of typing a name. People often call it “the phonebook of the internet”, but it does more than a phonebook. Different record types hold different kinds of information, not just addresses.

The addresses in this lesson (203.0.113.10, 198.51.100.53 and so on) are documentation examples, chosen so the steps are easy to follow. Look up the real addresses yourself with the DNS Lookup tool.

Why DNS is needed

Computers find each other with numbers. A packet on the internet carries a source and destination IP address, never a name. People, on the other hand, remember names much better than numbers. DNS sits in between and solves several problems at once:

No single computer could hold every name on the internet, so DNS is a distributed database. The data is split across millions of servers, and each one is responsible for a small part of the namespace.

💡 In simple terms: a lookup is like asking a librarian (the resolver) to find a book. The librarian doesn't know every book in the world, so they check a directory (the root server). The directory points them to the right section (the TLD server), and the section points them to the exact shelf (the authoritative server) that has the book.

Where DNS sits in the network

DNS is an application-layer protocol, like HTTP. It is a helper service. Before your browser can open a TCP connection to a website, it needs the website's IP address, and DNS provides it. Your computer learns which DNS server to ask from DHCP (DHCP option 6) or from a manually entered setting.

Notice that the laptop only talks to one server: its recursive resolver. All the other queries go between the resolver and the servers on the internet.

Domain names and their parts

A domain name is a list of labels separated by dots. Each label is one level in a tree, and a name is read from right to left. The top of the tree is the root, written as a single dot. You almost never type it, but it is always there: the full name is really www.routelearn.net. with a dot at the end.

DNS names are not case-sensitive: RouteLearn.NET and routelearn.net are the same name.

The main components

A lookup involves several types of DNS server and software. Each one has a single job:

Stub resolver and recursive resolver

The stub resolver on your computer sends a recursive query, which means “please give me the final answer”. The recursive resolver accepts that job. To complete it, it sends iterative queries to other servers. Each server either answers or replies “I don't know, but ask this server next”. That reply is called a referral.

Which recursive resolver you use depends on the network. At home, it is usually your internet service provider's (ISP's) resolver, often reached through the home router, which passes queries on (it acts as a DNS forwarder). Companies usually run their own resolvers. Some people choose a public resolver such as 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google).

Root servers

There are 13 root server names, from a.root-servers.net to m.root-servers.net, run by 12 different organisations. Each name is served by many copies around the world using anycast: the same address is announced from many places, so a query reaches a nearby copy. In total, there are well over a thousand root server instances. Every recursive resolver comes with a list of the root server addresses, called the root hints, so it always knows where to start.

TLD and authoritative servers

TLD servers hold a list of name servers (NS records) for every domain under their TLD. When you register routelearn.net, the registrar tells the .net registry which name servers will answer for it. Those name servers are the authoritative servers. They hold the zone, with all the records for the domain.

Caching and TTL

Asking the root, TLD and authoritative servers for every single click would be slow and would overload those servers. So every DNS answer is cached (kept in memory) for a while, in several places:

1. The browser cache: browsers keep their own short-lived list of recent lookups.
2. The operating system cache: the stub resolver remembers answers for every program on the computer. The local hosts file is checked at this stage too.
3. The recursive resolver cache: shared by everyone who uses that resolver, so a popular name is almost always already there.

Every DNS record has a TTL (time to live): a number of seconds, set by the domain owner, that tells caches how long they may keep the answer before asking again. A TTL of 300 means five minutes; 86400 means one day. The resolver counts the TTL down, and when it reaches zero, the cached copy is removed.

This is a deliberate trade-off. A longer TTL means faster lookups and less load on authoritative servers, but a change to the record takes longer to reach everyone. “DNS propagation” isn't instant: it spreads gradually as each resolver's cached copy expires and is fetched again.

💡 Resolvers also cache the referrals. After one lookup, a resolver already knows the .net TLD servers, so its next lookup of any .net name skips the root. In practice, resolvers query the root servers quite rarely.

Step by step: looking up routelearn.net

Here's what happens in one complete lookup with a cold cache, meaning no cache along the way has the answer yet. Your laptop is 192.168.1.20 and its DNS server (from DHCP) is the ISP resolver at 198.51.100.53.

1. Browser cache. You type routelearn.net. The browser checks its own cache and finds nothing.
2. Operating system cache. The browser asks the operating system. The stub resolver checks the hosts file and its own cache, and finds nothing there either.
3. Query to the recursive resolver. The stub resolver sends a recursive query, "A record for routelearn.net?", in a UDP datagram to 198.51.100.53 port 53.
4. Resolver checks its cache. There is no copy, so it must find the answer itself.
5. Ask a root server. The root doesn't know routelearn.net, but replies with a referral: "ask the .net TLD servers", with their names and addresses.
6. Ask a .net TLD server. It replies with another referral: "routelearn.net is answered by these name servers".
7. Ask the authoritative server. It finally answers: routelearn.net A 203.0.113.10, TTL 300 seconds. This answer is marked authoritative.
8. Cache and reply. The resolver stores the answer (and the referrals) for their TTLs and sends the answer back to the laptop.
9. Laptop caches it too. The operating system and the browser both store 203.0.113.10. The browser can now open a TCP connection to 203.0.113.10 port 443 (HTTPS).

Here is the same lookup as a sequence of messages. Tap any arrow to see what is inside the packet.

The same chain in one line:

This whole chain usually completes in well under a second. Most of the time, steps are skipped completely because a cache already has the answer. A separate lesson follows a whole page load, from DNS to TCP to HTTPS.

Learn more: What Happens When You Open a Website?

What is inside a DNS packet

A DNS query is small, often under 100 bytes. It travels as data inside a UDP datagram, which is inside an IP packet, which is inside an Ethernet frame.

Learn more: Encapsulation and De-encapsulation

The resolver is on another network, so the frame is addressed to the default gateway's MAC address, found with ARP. On the way out, the home router's NAT also replaces the private source IP address with its own public address.

UDP 53 and TCP 53

DNS is registered on port 53 for both UDP and TCP:

A firewall that allows only UDP 53 will break the occasional large answer, so allow TCP 53 to your resolvers as well.

Learn more: Common Ports to Know · TCP vs. UDP Compared

Common record types

A zone holds resource records. Each record has a name, a TTL, a class (almost always IN, for internet), a type and a value. The type shows what kind of information the record holds:

It is normal for a domain to have only a few of these. Many domains have little more than A, NS and MX records, plus the SOA record that every zone has. A missing record type usually just means that feature isn't used, not that anything is broken.

Real-world scenario: moving a website to a new host

A company moves its website to a new hosting provider and updates its A record to point to the new server's IP address. Visitors whose resolvers cached the old record, for example with a 24-hour TTL, keep reaching the old server until that cached copy expires, even though the record itself changed instantly. That is why teams usually lower the TTL before a migration, so the switch-over is quick when it happens.

1. A few days before: lower the TTL from 86400 (one day) to 300 (five minutes). Wait at least one old TTL so every cache picks up the short one.
2. Moving day: change the A record to the new address. Within about five minutes, resolvers start using it.
3. Keep the old server running for a while, in case a cache somewhere ignored the TTL.
4. Afterwards: raise the TTL again to reduce the number of lookups.

What happens when DNS fails

When DNS breaks, the network itself usually still works. Packets to IP addresses still flow; only names stop working. That is why “the internet is down” so often really means “DNS is down”.

Troubleshooting DNS: useful commands

The first test is always the same: can you reach the site by IP address but not by name? If ping 203.0.113.10 works but ping routelearn.net says it could not find the host, the network is fine and DNS is the problem. Then use the tools below. A later lesson walks through a full fault-finding example.

Learn more: DNS Problems

nslookup (Windows, Linux and macOS)

C:\> nslookup routelearn.net
Server:  router.home
Address:  192.168.1.1

Non-authoritative answer:
Name:    routelearn.net
Address:  203.0.113.10

C:\> nslookup routelearn.net 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    routelearn.net
Address:  203.0.113.10

C:\> nslookup routlearn.net
Server:  router.home
Address:  192.168.1.1

*** router.home can't find routlearn.net: Non-existent domain

dig (Linux and macOS)

$ dig routelearn.net
; <<>> DiG 9.18.28 <<>> routelearn.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41872
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;routelearn.net.                IN      A

;; ANSWER SECTION:
routelearn.net.         300     IN      A       203.0.113.10

;; Query time: 24 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Mon Oct 05 10:15:02 UTC 2026
;; MSG SIZE  rcvd: 59

Looking at and clearing the local cache

ipconfig /all on Windows, or cat /etc/resolv.conf on Linux, shows which DNS server the computer is using. If that address is wrong, check your DHCP settings.

Common mistakes

• Blaming the network for a DNS problem, or the other way round. Test with an IP address first; it tells you which half of the problem to look at.
• Expecting DNS changes to appear instantly. Old answers stay in caches until their TTL runs out. Lower the TTL before a planned change.
• Forgetting the local caches. After a fix, the browser and operating system may still hold the old answer. Flush the OS cache and restart the browser.
• Forgetting an old entry in the hosts file. It overrides DNS on that computer, so nslookup (which asks the DNS server directly) and the browser can give different answers.
• Allowing only UDP 53 through a firewall. Large answers fall back to TCP 53, so those lookups fail.
• Pointing a CNAME at an IP address. A CNAME must point to another name. Use an A or AAAA record for an address.
• Thinking “Non-authoritative answer” is an error. It is normal; it only means the answer came through a resolver.

Check yourself

Related lessons

DNS builds on several earlier lessons. Names are looked up over UDP on a well-known port, and your DNS server address is usually provided by DHCP. To see DNS as one step in the bigger picture, read What happens when you open a website? When names stop working, go to DNS problems.