DNS Resolution with Dig Command

Have you ever wondered, when you type google.com in the browser search bar what actually happens? How does the browser actually get the website data from its server?

In this article we will dive into the world of DNS and what actually happens when you type google.com.

Understanding Domain Name Structure

Every website that is present on the internet has a unique domain name. Each domain name is generally divided into two to three parts. For example, in cloud.google.com:

• "cloud" is called the SUBDOMAIN
• "google" is called the PARENT DOMAIN
• "com" is called the DOMAIN EXTENSION or TOP LEVEL DOMAIN

Each of these parts are separated by a dot.

The DNS Resolution Process

When you type google.com in the browser, the network's DNS provider executes multiple steps:

Step 1: DNS Recursor

The request goes to the DNS RECURSOR. It is a server that will continue to request a chain of servers until it receives the IP address.

Step 2: Root Server Query

The DNS RECURSOR will send a request to the ROOT SERVER which contains all the TLD SERVER (Top Level Domain Server). The root server will return the appropriate TLD SERVER to the DNS RECURSOR. In our case, the TLD server that maintains the .com.

Step 3: TLD Server Query

The DNS RECURSOR will send the request to the TLD server. This server contains all the domain names with the same domain extension. After getting the request, the TLD server will send the appropriate AUTHORITATIVE SERVER.

Step 4: Authoritative Server Query

The DNS RECURSOR will send the request to the AUTHORITATIVE SERVER. This server contains the IP of google.com which will be sent to the DNS RECURSOR.

Step 5: Final Resolution

Once the recursor gets the IP address, it will send it to the browser and the browser will load the website.

Note: Suppose the domain name has a subdomain. In that case, the AUTHORITATIVE SERVER will send another AUTHORITATIVE SERVER to the DNS RECURSOR. And that final server will return the IP if present, otherwise it will throw an error.

Practical DNS Resolution Using the dig Command

To actually see this process in action, we will use the dig command. DIG = Domain Information Groper.

It is a powerful and widely-used command-line tool for querying the Domain Name System. It retrieves information about DNS name servers.

DNS Resolution of google.com Using dig Command

STEP 1: Query Root Servers

The command dig . NS will fetch the 13 global root servers.

dig . NS

These root servers do not know what the IP of google.com is. They will only tell you which server handles the .com.

STEP 2: Query TLD Servers

The command dig com NS will fetch all the TOP LEVEL DOMAIN servers. They don't know what the IP of google.com is. They will only tell you which servers handle domains like google.com.

dig com NS

STEP 3: Query Authoritative Servers

The command dig google.com NS will fetch the actual DNS records.

dig google.com NS

STEP 4: Query google.com to Get the IP Address

The command dig google.com will get the final IP address.

dig google.com

Bonus: Complete DNS Trace

The command dig google.com +trace performs a complete, step-by-step DNS resolution for the domain google.com, tracing the query from the root name servers through the Top-Level Domain (TLD) servers to the authoritative name servers, and finally returning the IP address without using cached results.

dig google.com +trace