How a name becomes an address

A name is resolved before any connection is made, and the resolution itself is a distributed database query across several servers.

The hierarchy

.                      root
 └── com               top level domain
      └── example      authoritative for example.com
           └── www

Read right to left. There are 13 logical root server addresses, served by hundreds of physical machines using anycast, which means the same address is announced from many locations and the routing takes you to the nearest.

A full resolution

browser -> resolver:  where is www.example.com?
resolver -> root:     ask the .com servers, here they are
resolver -> .com:     ask example.com's servers, here they are
resolver -> example:  93.184.216.34
resolver -> browser:  93.184.216.34

The browser asks once and the resolver does the walking, which is a recursive query. Each server the resolver asks answers only with what it knows and a referral, which is an iterative query. The distinction is a standard exam question and the answer is that both happen in one lookup.

Caching is what makes it work

Every answer carries a TTL in seconds, and results are cached at every level: the browser, the operating system, the resolver.

The root servers would be unusable otherwise. In practice they are consulted rarely, because the referral for .com is cached for days.

TTL is the knob that matters operationally. Long TTLs mean fast resolution and slow changes; short ones mean the reverse. Before moving a service, the TTL is lowered well in advance so that the change propagates quickly when it happens, and raised again afterwards.

Record types

A CNAME cannot coexist with other records at the same name, which is why the root of a domain usually cannot be a CNAME and providers offer non standard workarounds.

Why it is a weak point

DNS traditionally travels in plain text over UDP, so it is readable and forgeable by anyone on the path. Two separate fixes address separate problems:

DNSSEC signs records so a forged answer can be detected. It does not encrypt.

DNS over HTTPS or TLS encrypts the query so it cannot be read or modified in transit. It does not authenticate the data.

And DNS resolution failing looks like the entire internet is down, because every connection starts with it. A surprising share of large outages are DNS.