What Is the Domain Name System?
The Domain Name System (DNS) is often described as the phonebook of the internet, and for good reason. Every time you type a website address into your browser, DNS translates that human-readable domain name (like air-proltd.com) into the machine-routable IP address (like 192.0.2.1 or 2001:db8::1) that computers use to communicate. Without DNS, we would all need to memorize strings of numbers to access websites, send emails, or use any internet-connected application.
The DNS Hierarchy
DNS operates as a hierarchical, distributed database:
- Root Servers: At the top of the hierarchy sit 13 root server clusters (labeled A through M), operated by 12 independent organizations including Verisign, ICANN, NASA, and the University of Maryland. These servers do not resolve domain names directly—they simply point queries to the appropriate Top-Level Domain (TLD) servers. The global anycast deployment of root servers ensures they can handle billions of queries daily with sub-millisecond latency worldwide.
- TLD Nameservers: Each top-level domain (.com, .org, .ca, .uk, etc.) has its own set of authoritative nameservers. Verisign operates .com and .net; the Canadian Internet Registration Authority (CIRA) has operated .ca from Ottawa since December 2000. CIRA manages over 3 million .ca domain names as of 2024.
- Authoritative Nameservers: These hold the actual DNS records for individual domains. When you register a domain and configure DNS, you are pointing to these nameservers. Organizations typically use their domain registrar DNS, a managed DNS service (Cloudflare, AWS Route 53, Azure DNS), or self-hosted nameservers using BIND or PowerDNS.
- Recursive Resolvers: The workhorses of DNS—these are the servers that do the heavy lifting on behalf of clients. When your computer needs to resolve a domain, it asks a recursive resolver (typically provided by your ISP or a public DNS service like Google 8.8.8.8 or Cloudflare 1.1.1.1), which walks the DNS hierarchy from root to authoritative server to find the answer, caching results along the way.
Essential DNS Record Types
- A Record: Maps a domain to an IPv4 address.
- AAAA Record: Maps a domain to an IPv6 address.
- CNAME (Canonical Name): Creates an alias from one domain to another. For example, www.example.com could be a CNAME to example.com.
- MX (Mail Exchange): Specifies mail servers responsible for accepting email for the domain, with priority values.
- TXT: Stores arbitrary text data, most commonly used for SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC records for email authentication.
- NS (Nameserver): Delegates a DNS zone to specific authoritative nameservers.
- SOA (Start of Authority): Contains administrative information about the zone, including serial number, refresh intervals, and retry timers.
DNS Security: DNSSEC, DoH, and DoT
Traditional DNS queries are sent in plaintext over UDP port 53, making them vulnerable to spoofing, cache poisoning, and eavesdropping. Three technologies address these weaknesses: DNSSEC cryptographically signs DNS records to ensure integrity; DNS over HTTPS (DoH) encrypts DNS queries within HTTPS traffic on port 443; and DNS over TLS (DoT) encrypts DNS queries on a dedicated port 853. Modern enterprise DNS deployments should implement at minimum DoT or DoH for client-to-resolver encryption and DNSSEC for authoritative zone signing.
