Domain Name System (DNS): What It Is and How It Functions

The Internet Addressing System

In the world of the internet, every device (node) connected to the network needs a unique identifier to communicate. This identifier is known as an IP Address. You can think of it like the GPS Coordinates of your House.

1. IPv4 (Internet Protocol version 4)

This is the legacy format we are most familiar with. It looks like 192.168.0.1.

• Format: It consists of four octets separated by dots. Each octet is a decimal value between 0 and 255.

• Capacity: IPv4 uses 32 bits. Total Addresses = 2³² = 4,294,967,296 (~4.3 billion)

As the internet has evolved, our devices have become smarter. We now have internet connected Air Conditioners, Washing Machines, Cars, and countless IoT devices. With billions of humans and tens of billions of devices, the 4.3 billion IPv4 addresses have essentially been exhausted.

2. IPv6 (Internet Protocol version 6)

To solve the exhaustion problem, IPv6 was introduced. It looks like 2001:0db8:85a3:0000:0000:8a2e:0370:7334.

• Format: It uses hexadecimal format.

• Capacity: IPv6 uses 128 bits. Total\ Addresses = 2¹²⁸ = 340,282,366,920,938,463,463,374,607,431,768,211,456.

That is 340 undecillion addresses. We will not run out of IP anytime soon.

The Human Brain

Let’s understand how the human brain works. Our brains are wired to love strings, words, names, and stories. Not long, random numbers.

Imagine a friend comes to you and says:

"I have two houses. The first is located at GPS Coordinates 28.6139° N, 77.2090° E, and the second is at 19.0760° N, 72.8777° E."

You simply won’t remember that. However, it is instantly clear and memorable if they say:

"11, Elite Bunglows, New Delhi, India" or "15, Chai Bunglows, Mumbai, India."

The internet works the same way. When you want to visit a website, you shouldn’t have to memorize a server’s IP address. You need a memorable name. This is where Domains come in.

Domain

A domain is a unique, human-readable name that identifies a resource on the Internet and maps to one or more IP addresses using the Domain Name System.

Have you heard of ICANN?

ICANN (Internet Corporation for Assigned Names and Numbers) is the global organization responsible for coordinating the allocation of domain names and IP address spaces to ensure uniqueness across the Internet.

You can think of ICANN as the global registry and policy authority that oversees:

• Domain name uniqueness

• Top-level domains like .com, .org, .in

• IP address distribution through regional registries

Because of ICANN’s coordination, when you type google.com, it resolves to Google’s servers and not to any other organization. No two entities can own the same domain name in the global DNS system.

So now, you understand what a domain is.

Question Time: When you type google.com into your browser, how exactly is that IP address found?

You might be wondering:

• Does my Chrome browser memorize every IP on the internet? (Sorry Brave fans.)

• Does my laptop know where Google is hosted?

• Or is there some mysterious third-party service doing the work?

The answer is a big No.

No single device knows everything. The internet is too big (remember, millions of websites). Instead, it works like a Detective Investigation. And the system that does the investigation is known as the Domain Name System.

DNS

DNS translates Domain names to IP addresses.

DNS services include:

• Host to IP address.
  
  E.g. google.com to 142.251.220.14

• Host aliasing
  
  Allows multiple domain names to map to the same canonical domain using CNAME records.

• Email routing
  
  Allow a domain to specify which mail servers are responsible for receiving the email.

• IP address to Host
  
  E.g. 142.251.220.14 to google.com

• Load Balancing

DNS Resolution: The Hierarchy of "Whom to Meet Next?"

When you type google.com, your browser doesn't get the IP address in one magical shot. It is a hierarchical, recursive process.

Think of it like looking for a person living in a massive office building. You don't know where they live, so you ask for directions. Each person you ask doesn't give you the final answer, they just answer the question: "Whom should I meet next?"

Let's trace the journey of google.com:

Step 1: Browser Cache

Before doing anything, your browser (Chrome, Firefox, Safari) checks its own temporary memory.

• The Question: "Have I visited google.com in the last few minutes?"

• If Yes: It uses the saved IP immediately. No network request is made.

• If No: It proceeds to Step 2.

Step 2: OS Cache

The browser asks your Operating System (Windows, macOS, Linux). The OS maintains its own cache and also checks a special text file called the "hosts file".

• The Question: "Hey Windows, do you have a record for google.com?"

• If Yes: The OS gives the IP to the browser.

• If No: The OS realizes it doesn't know the answer locally. It needs outside help.

Step 3: The DNS Resolver (The Assistant)

Browser is the Boss. The Boss is busy rendering pages and chats of ChatGPT, it doesn't have time to run around the internet asking for directions. So, when the cache comes up empty, the Browser delegates the task to its assistant.

This is the moment your request actually leaves your computer. The query travels to the Resolver, which is usually provided by your ISP (Internet Service Provider) or a public DNS service like Google (8.8.8.8) or Cloudflare (1.1.1.1).

• The Question: "I need the IP for google.com. Go find it for me."

• The Resolver's Job: It is now the Resolver's responsibility to hunt down the answer. It starts the "Whom to meet next?" journey across the internet.

• It’s check inside it’s cache. Because the resolver caches this result for a time period called TTL (Time To Live) so that future requests can be answered faster without repeating the entire process.

• If No: It goes to Root DNS Server.

Step 4: The Root DNS Server (.)

The Resolver asks the Root Server.

• Answer: "I don't know the IP, but google.com ends in “.com”. Go ask the “.com” TLD Server."

Step 5: The TLD DNS Server (.com)

The Resolver asks the “.com” TLD Server.

• Answer: "I don't know the IP, but I know google.com is managed by Google's Name Servers. Go ask the Authoritative Server."

Step 6: The Authoritative Name Server

The Resolver asks Google's Authoritative Server.

• Answer: "Yes, I am the authority. The IP address is 142.251.220.14."

The Finish Line: The Resolver brings this IP back to your Browser and finally, the website loads.

Tea Break ☕ :)

Question Time: How does it know when to stop?

It checks the Answer Type:

• "Go Ask Someone Else" (NS Record): The Resolver knows to keep going to the next server.

• "Here is the IP" (A Record or AAAA record for IPv6): The Resolver knows the search is finished.

We’ve seen how the detective works in theory. Now, let’s hand you the badge and let you do the investigation yourself. Meet our friend DIG, a command-line utility.

DIG

DIG stands for Domain Information Groper. As the name suggests, we can use this utility to perform DNS queries.

Let’s try using dig for google.com in the terminal, or try it online:(https://toolbox.googleapps.com/apps/dig).

dig google.com

You will get a lot of output, but don't panic. You only need to look at the "ANSWER SECTION":

Domain         TTL       Internet       Type        IP Address
----------------------------------------------------------------
google.com.    120         IN            A        172.217.25.78

Now you understand how to query DNS using DIG. But what is TTL?

TTL

TTL stands for Time To Live. It is the amount of time a DNS record can be cached before it must be re-queried. This is why, when we update a DNS record, it takes time for the change to be seen everywhere.

Imagine a resolver asks for Google’s IP and gets the answer. The resolver stores it in its cache and sets a timer (TTL) for 1 hour.

Now, imagine 5 minutes later, Google’s admin changes the IP address on the authoritative DNS server.

But, The resolver doesn't know. If your browser asks the resolver again, the resolver will not go back to the server. The resolver will just look at their cache, see the valid timer, and give you the old (now wrong) IP address.

This is why we say the update "takes time to propagate." Propagation is not the time it takes for data to travel across the internet, it is the time we spend waiting for everyone's timers to run out.

DIG commands

Quick Check: You just want the IP address.

dig google.com +short

Full Investigation:

dig google.com +trace

Return the log containing:

1. Block 1 (The Root): You asked the Root Server. It said: "I don't know, go ask the .com servers."

2. Block 2 (The TLD): You asked the .com Server. It said: "I don't know, go ask Google's Name servers."

3. Block 3 (The Authority): You asked Google's Name Server. It said: "Here is the IP: 172.217.26.206."

Get Authoritative Name Server:

dig google.com NS

Check with Google or Cloudflare Resolver:

dig @8.8.8.8 google.com #Google DNS resovler
#OR
dig @1.1.1.1 google.com #CloudFlare DNS resolver

Reverse Lookup

dig -x 142.251.220.14

This uses PTR records under the in-addr.arpa domain.

Summary

The Domain Name System (DNS) is a critical component of the internet that translates human-readable domain names into machine-readable IP addresses. It allows users to access websites without needing to remember complex numerical addresses, ensuring efficient and seamless communication across the digital landscape. Understanding DNS processes and tools can help optimize internet interactions.

"The best technology is the kind that works so well you don't even notice it."

— Anonymous