DEV Community

Shrijith Venkatramana
Shrijith Venkatramana

Posted on

DNS: How It Works with Practical Examples

#programming #webdev #beginners #tutorial

Hello, I'm Shrijith Venkatramana. I’m building LiveReview, a private AI code review tool that runs on your LLM key (OpenAI, Gemini, etc.) with highly competitive pricing -- built for small teams. Do check it out and give it a try!

DNS powers the internet by translating domain names into IP addresses. This article breaks down its mechanics with examples, code snippets, and visuals to help developers grasp it quickly.

DNS Basics: Turning Names into Addresses

DNS stands for Domain Name System. It acts as the internet's phonebook, mapping human-readable names like example.com to machine-readable IP addresses like 192.0.2.1.

Key point: Without DNS, you'd type IP addresses directly into your browser.

Consider a basic example: When you visit google.com, your device queries DNS servers to find Google's IP. This process involves multiple steps, but starts locally.

For a hands-on look, use the dig command in your terminal:

dig google.com
Enter fullscreen mode Exit fullscreen mode

This outputs details like the A record (IPv4 address). Run it to see real-time results.

Learn more about dig from its man page.

The DNS Namespace: A Tree Structure

DNS organizes domains in a hierarchical tree. At the top is the root domain (.), followed by top-level domains (TLDs) like .com, then second-level domains like example.com, and subdomains like www.example.com.

Key point: This hierarchy distributes management—ICANN handles root, registries manage TLDs, and registrars let you buy domains.

Visualize it like this:

  • Root (.)
    • TLD (.com, .org)
    • Second-level (example.com)
      • Subdomain (blog.example.com)

An example: amazon.com is under .com TLD, with subdomains like aws.amazon.com.

To query the hierarchy, try:

dig +trace amazon.com
Enter fullscreen mode Exit fullscreen mode

This shows the full path from root servers.

Essential DNS Record Types

DNS uses various record types to store information. Here's a table of common ones:

Record Type Purpose Example
A Maps domain to IPv4 address example.com → 192.0.2.1
AAAA Maps domain to IPv6 address example.com → 2001:db8::1
CNAME Aliases one domain to another www.example.com → example.com
MX Specifies mail servers example.com → mail.example.com (priority 10)
TXT Holds text data, often for verification example.com → "v=spf1 include:_spf.google.com ~all"
NS Delegates to name servers example.com → ns1.example.com

Key point: A records are for direct IP mapping; CNAME is for redirects without exposing IPs.

In practice, for a site like example.com, an A record points to the web server's IP, while MX handles email routing.

Check records with:

dig example.com MX
Enter fullscreen mode Exit fullscreen mode

This lists mail exchangers.

For details on record types, see RFC 1035.

Step-by-Step: How a DNS Query Works

A DNS query starts when your app (like a browser) needs an IP for a domain. It follows these steps:

  1. Check local cache.
  2. If not found, query the recursive resolver (often your ISP's DNS server).
  3. The resolver queries root servers for TLD info.
  4. Then queries TLD servers for domain NS records.
  5. Finally, queries authoritative servers for the record.

Key point: This is recursive resolution—your resolver handles the back-and-forth.

Example flow for github.com:

  • Resolver asks root: "Who handles .com?"
  • Root: "com servers at a.gtld-servers.net"
  • Asks .com: "Who handles github.com?"
  • .com: "NS at ns-1625.awsdns-11.co.uk"
  • Asks authoritative: "IP for github.com?"
  • Gets 140.82.114.3

Use dig +trace github.com to simulate this.

DNS Caching: Why Queries Get Faster

Caching stores DNS responses temporarily to avoid repeated queries. Levels include:

  • Browser/OS cache: Seconds to minutes.
  • Resolver cache: Based on TTL (Time To Live) in records.
  • Authoritative cache: Rare, but possible.

Key point: TTL dictates cache duration—high for static sites, low for dynamic.

Example: A record with TTL 300 (5 minutes) means resolvers cache it that long.

To see caching, query twice:

First:

dig microsoft.com
Enter fullscreen mode Exit fullscreen mode

Note the TTL decreasing on the second run.

Flush cache on Linux with systemd-resolve --flush-caches if testing.

Building a Simple DNS Resolver in Python

You can write a basic DNS resolver to understand queries. This code uses Python's dnspython library—install it via pip if needed, but assume it's available.

Here's a complete script to query an A record:

# Install dnspython if not present: pip install dnspython
import dns.resolver

def resolve_domain(domain):
    try:
        answers = dns.resolver.resolve(domain, 'A')
        for rdata in answers:
            print(f"IP: {rdata.address}")
    except Exception as e:
        print(f"Error: {e}")

# Example usage
resolve_domain('openai.com')

# Sample output (actual IPs may vary):
# IP: 104.18.3.207
# IP: 104.18.2.207
Enter fullscreen mode Exit fullscreen mode

Run this in your environment. It sends a query and prints IPs.

Key point: This uses a recursive resolver under the hood, but you could extend it for iterative queries.

For the dnspython docs, check its GitHub.

Debugging DNS Problems Like a Pro

Common issues include misconfigured records, propagation delays, or cache poisoning.

Steps to debug:

  1. Use dig or nslookup to query specific servers.
  2. Check TTL for propagation—can take up to 48 hours.
  3. Verify NS records match your provider.

Key point: For "no such domain" errors, ensure the domain is registered.

Example: If example.com doesn't resolve:

nslookup example.com 8.8.8.8
Enter fullscreen mode Exit fullscreen mode

This queries Google's DNS. If it fails, check registrar.

Tools like DNS Checker help verify global propagation.

DNS Security: Introducing DNSSEC

DNSSEC adds digital signatures to records, preventing man-in-the-middle attacks.

It works by signing zones with keys—root is signed, and chains down.

Key point: Enables validation; without it, DNS is vulnerable to spoofing.

To check if a domain uses DNSSEC:

dig +dnssec google.com
Enter fullscreen mode Exit fullscreen mode

Look for RRSIG records.

Adopting DNSSEC involves generating keys and updating your DNS provider.

Understanding DNS helps in building reliable apps, troubleshooting networks, and securing services. Experiment with tools like dig, set up local zones with tools like BIND, and monitor TTLs in production for optimal performance.

Top comments (0)