What is DNS?

9 November 2026

The Domain Name System (DNS) is a distributed database that turns names such as example.com into the IP addresses devices need. Your device asks a server called a recursive resolver, which follows the chain from the root servers down to the server responsible for the domain. It then returns the answer and keeps it for a period the domain owner sets.

The parts of the system

RFC 1034, published in 1987, laid the foundations and split the system into three parts:

• The name space and resource records. A tree of names, where each name has records holding its data, such as its address or its mail server.
• Name servers. Each server is authoritative for part of the tree, called a zone, and answers for it from its own data.
• Resolvers. Programs that extract information from name servers in response to requests from applications.

RFC 9499, on DNS terminology, separates two kinds of resolver. The stub resolver on your device cannot complete a lookup on its own. It passes the question to a recursive resolver, which does the whole search and caches the answers.

The name tree

The levels start at the end of the name. In www.example.com the root comes first and is not written, then the top-level domain com, then example, then www. Each level delegates the one below it to other servers.

RFC 1035 sets the limits: each label between dots is at most 63 octets, and the whole name at most 255.

What happens when you type a site name

1. The browser, then the operating system, checks its cache. A valid answer there is used straight away.
2. The stub resolver sends the question to the recursive resolver configured on your device or router, originally over UDP port 53.
3. If the recursive resolver has no cached answer, it asks a root server. The root does not know the address but refers it to the com servers.
4. It asks the com servers, which refer it to the name servers responsible for example.com.
5. It asks the domain's authoritative server, which replies with the requested record, such as an IPv4 or IPv6 address.
6. The recursive resolver caches the answer for its time to live (TTL) and returns it to your device, which connects to the address.

The standard defines the TTL as the maximum time a record may stay in a cache, and the zone's owner sets it. That is why a change of address does not reach everyone at the same moment. If an answer is too large for UDP, the reply is marked as truncated. The resolver then repeats the question over TCP on the same port.

Common record types

Reverse lookups

You can also ask the question the other way round: which name belongs to this address? A separate tree serves this purpose. An IPv4 address is written in reverse under in-addr.arpa, and an IPv6 address under ip6.arpa.

A question about 192.0.2.10 becomes a question about the PTR record for 10.2.0.192.in-addr.arpa. The holder of the address block sets these records, not the owner of the site that uses the address.

Mail providers use reverse lookups to check sending servers. Many operators also put city codes in their router names, which helps anyone estimating where addresses are.

dig -x 9.9.9.9 +short

Who sees your queries

Classic DNS queries are not encrypted. Anyone on the path to the resolver can see the names you ask about, including the local network operator and your internet provider.

• The recursive resolver sees every question and the address of the device that sent it. Through DNS, it knows more about your browsing than any other party.
• The authoritative server sees the resolver's address, not yours. Some resolvers also pass along part of your network address so the server can pick the copy of the site closest to you.
• Your network provider sees unencrypted queries even when you use a resolver other than its own.

Encryption closes the path between your device and the resolver. The two standard methods are DNS over TLS and DNS over HTTPS. DNSSEC, by contrast, proves an answer is genuine with signatures and does not hide the question.

The resolver changes what you see

Many large sites give a different answer depending on where the question comes from, steering you to a nearby server. The resolver's location therefore affects a site's speed and sometimes which version of it you get.

When you use a VPN or proxy, DNS questions should travel through the tunnel too. If they go to your local provider's resolver, the provider sees the names. The site also sees that your address and your resolver are in different places. This is called a DNS leak.

Where your resolver comes from

When your device joins a network, the router gives it an address along with a resolver address, usually over DHCP. A home router typically forwards the questions to the provider's resolver.

You can change the resolver on the router, which covers every device, or in the operating system, which covers one device. Some browsers have their own encrypted DNS setting, which overrides the system's when it is on.

VPN apps also set the resolver while the tunnel is up. One device can therefore use three different resolvers, depending on the program and the connection state.

How to check DNS yourself

Ask for a specific record with dig on Linux and macOS, or nslookup on Windows:

dig example.com A +noall +answer
dig @9.9.9.9 example.com AAAA +short
nslookup example.com

The first command prints the answer line in this shape; the address here is only an illustration. The second field is the remaining time to live in seconds:

example.com.    3600    IN    A    192.0.2.10

To see which resolver your device uses:

resolvectl status         # Linux with systemd-resolved
ipconfig /all             # Windows: "DNS Servers"
scutil --dns              # macOS

Choosing a resolver and protecting your queries

• Read the resolver's policy. The resolver sees the list of sites you visit, so pick an operator whose logging and retention you know.
• Encrypt queries on public networks. Most modern browsers and operating systems support encrypted DNS.
• Keep DNS inside the tunnel. With any VPN, make sure the resolver in use is the service's own or one in the exit country.
• Flush the cache after changing settings. On Windows run ipconfig /flushdns, or old answers stay until they expire.

DNS with syriaproxy

With syriaproxy, site names are resolved inside Syria by Syriatel's resolvers rather than by a resolver in your country. You therefore get the same answers as a phone on Syriatel's network inside Syria.

FAQ

Check which resolver your connection uses with the free DNS leak test.