DEV Community

Shrijith Venkatramana
Shrijith Venkatramana

Posted on • Edited on

DNS: How It Works with Practical Examples

#webdev #beginners #programming #tutorial

Hello, I'm Shrijith. I'm building git-lrc, an AI code reviewer that runs on every commit. It is free, unlimited, and source-available on Github. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product.

DNS powers the internet by translating domain names into IP addresses. This article breaks down its mechanics with examples, codenippets, and visuals to help developers grasp it quickly.

DNS Basics: Turning Names into Addresses

DNS stands for Domain Name System. It acts as the internet's phonebook, mapping human-readable names like example.com to machine-readable IP addresses like 192.0.2.1.

Key point: Without DNS, you'd type IP addresses directly into your browser.

Consider a basic example: When you visit google.com, your device queries DNS servers to find Google's IP. This process involves multiple steps, but starts locally.

For a hands-on look, use the dig command in your terminal:

dig google.com
Enter fullscreen mode Exit fullscreen mode

This outputs details like the A record (IPv4 address). Run it to see real-time results.

Learn more about dig from its man page.

The DNS Namespace: A Tree Structure

DNS organizes domains in a hierarchical tree. At the top is the root domain (.), followed by top-level domains (TLDs) like .com, then second-level domains like example.com, and subdomains like www.example.com.

Key point: This hierarchy distributes management—ICANN handles root, registries manage TLDs, and registrars let you buy domains.

Visualize it like this:

  • Root (.)
    • TLD (.com, .org)
    • Second-level (example.com)
      • Subdomain (blog.example.com)

An example: amazon.com is under .com TLD, with subdomains like aws.amazon.com.

To query the hierarchy, try:

dig +trace amazon.com
Enter fullscreen mode Exit fullscreen mode

This shows the full path from root servers.

Essential DNS Record Types

DNS uses various record types to store information. Here's a table of common ones:

Record Type Purpose Example
A Maps domain to IPv4 address example.com → 192.0.2.1
AAAA Maps domain to IPv6 address example.com → 2001:db8::1
CNAME Aliases one domain to another www.example.com → example.com
MX Specifies mail servers example.com → mail.example.com (priority 10)
TXT Holds text data, often for verification example.com → "v=spf1 include:_spf.google.com ~all"
NS Delegates to name servers example.com → ns1.example.com

Key point: A records are for direct IP mapping; CNAME is for redirects without exposing IPs.

In practice, for a site like example.com, an A record points to the web server's IP, while MX handles email routing.

Check records with:

dig example.com MX
Enter fullscreen mode Exit fullscreen mode

This lists mail exchangers.

For details on record types, see RFC 1035.

Step-by-Step: How a DNS Query Works

A DNS query starts when your app (like a browser) needs an IP for a domain. It follows these steps:

  1. Check local cache.
  2. If not found, query the recursive resolver (often your ISP's DNS server).
  3. The resolver queries root servers for TLD info.
  4. Then queries TLD servers for domain NS records.
  5. Finally, queries authoritative servers for the record.

Key point: This is recursive resolution—your resolver handles the back-and-forth.

Example flow for github.com:

  • Resolver asks root: "Who handles .com?"
  • Root: "com servers at a.gtld-servers.net"
  • Asks .com: "Who handles github.com?"
  • .com: "NS at ns-1625.awsdns-11.co.uk"
  • Asks authoritative: "IP for github.com?"
  • Gets 140.82.114.3

Use dig +trace github.com to simulate this.

DNS Caching: Why Queries Get Faster

Caching stores DNS responses temporarily to avoid repeated queries. Levels include:

  • Browser/OS cache: Seconds to minutes.
  • Resolver cache: Based on TTL (Time To Live) in records.
  • Authoritative cache: Rare, but possible.

Key point: TTL dictates cache duration—high for static sites, low for dynamic.

Example: A record with TTL 300 (5 minutes) means resolvers cache it that long.

To see caching, query twice:

First:

dig microsoft.com
Enter fullscreen mode Exit fullscreen mode

Note the TTL decreasing on the second run.

Flush cache on Linux with systemd-resolve --flush-caches if testing.

Building a Simple DNS Resolver in Python

You can write a basic DNS resolver to understand queries. This code uses Python's dnspython library—install it via pip if needed, but assume it's available.

Here's a complete script to query an A record:

# Install dnspython if not present: pip install dnspython
import dns.resolver

def resolve_domain(domain):
    try:
        answers = dns.resolver.resolve(domain, 'A')
        for rdata in answers:
            print(f"IP: {rdata.address}")
    except Exception as e:
        print(f"Error: {e}")

# Example usage
resolve_domain('openai.com')

# Sample output (actual IPs may vary):
# IP: 104.18.3.207
# IP: 104.18.2.207
Enter fullscreen mode Exit fullscreen mode

Run this in your environment. It sends a query and prints IPs.

Key point: This uses a recursive resolver under the hood, but you could extend it for iterative queries.

For the dnspython docs, check its GitHub.

Debugging DNS Problems Like a Pro

Common issues include misconfigured records, propagation delays, or cache poisoning.

Steps to debug:

  1. Use dig or nslookup to query specific servers.
  2. Check TTL for propagation—can take up to 48 hours.
  3. Verify NS records match your provider.

Key point: For "no such domain" errors, ensure the domain is registered.

Example: If example.com doesn't resolve:

nslookup example.com 8.8.8.8
Enter fullscreen mode Exit fullscreen mode

This queries Google's DNS. If it fails, check registrar.

Tools like DNS Checker help verify global propagation.

DNS Security: Introducing DNSSEC

DNSSEC adds digital signatures to records, preventing man-in-the-middle attacks.

It works by signing zones with keys—root is signed, and chains down.

Key point:Enables validation; without it, DNS is vulnerable to spoofing.

To check if a domain uses DNSSEC:

dig +dnssec google.com
Enter fullscreen mode Exit fullscreen mode

Look for RRSIG records.

Adopting DNSSEC involves generating keys and updating your DNS provider.

Understanding DNS helps in building reliable apps, troubleshooting networks, and securing services. Experiment with tools like dig, set up local zones with tools like BIND, and monitor TTLs in production for optimal performance.

git-lrc
*AI agents write code fast. They also silently remove logic, change behavior, and introduce bugs -- without telling you. You often find out in production.

git-lrc fixes this. It hooks into git commit and reviews every diff before it lands. 60-second setup. Completely free.*

Any feedback or contributors are welcome! It's online, source-available, and ready for anyone to use.

⭐ Star it on GitHub:

GitHub logo HexmosTech / git-lrc

Free, Unlimited AI Code Reviews That Run on Commit

git-lrc logo

git-lrc

Free, Unlimited AI Code Reviews That Run on Commit


git-lrc - Free, unlimited AI code reviews that run on commit | Product Hunt

AI agents write code fast. They also silently remove logic, change behavior, and introduce bugs -- without telling you. You often find out in production.

git-lrc fixes this. It hooks into git commit and reviews every diff before it lands. 60-second setup. Completely free.

See It In Action

See git-lrc catch serious security issues such as leaked credentials, expensive cloud operations, and sensitive material in log statements

git-lrc-intro-60s.mp4

Why

  • 🤖 AI agents silently break things. Code removed. Logic changed. Edge cases gone. You won't notice until production.
  • 🔍 Catch it before it ships. AI-powered inline comments show you exactly what changed and what looks wrong.
  • 🔁 Build a habit, ship better code. Regular review → fewer bugs → more robust code → better results in your team.
  • 🔗 Why git? Git is universal. Every editor, every IDE, every AI…


View on GitHub


Top comments (0)