How DNS Resolution Works
How a name becomes an IP: stub and recursive resolvers, root, TLD and authoritative servers, a DNS message built byte by byte in Python, and TTL caching cutting 300 upstream lookups to 12.
DNS resolution turns a name into an IP address. The stub resolver asks a recursive resolver, which on a cache miss asks a root server, then the TLD server, then the domain's authoritative server, and caches the answer for its TTL. Interviewers expect the distinction: the stub makes a recursive query, while the resolver makes iterative queries down the tree.
DNS turns names into addresses through a hierarchy: a recursive resolver asks the root servers, then the TLD servers, then the domain's authoritative servers, and caches answers for their TTL. A query for www.example.com is 33 bytes. In a simple cache model with a 300-second TTL, 100 queries caused only 12 upstream lookups, not 300.
- A cold DNS lookup costs three upstream round trips, to a root server, a TLD server and the authoritative server, while a warm lookup answered from cache costs none.
- A DNS query for www.example.com is 33 bytes: a 12-byte header, the name as length-prefixed labels 3www7example3com0, and the record type and class.
- In a model with a 300-second TTL and one query every 10 seconds for 1,000 seconds, only 4 of 100 queries missed the cache, causing 12 upstream lookups instead of 300.
- DNS normally travels over UDP port 53 and falls back to TCP for large responses and zone transfers.
- A CNAME record cannot coexist with other records at the same name, so it cannot be placed at the zone apex such as example.com, where NS and SOA records exist.
- DNSSEC adds digital signatures so resolvers can detect forged answers, while DNS over HTTPS and DNS over TLS encrypt the connection between client and resolver.
01Names to numbers
Computers route by IP address, people use names. DNS is the global database that maps one to the other. It is distributed: no single server knows everything, and it is hierarchical, with the name read from right to left. In www.example.com, the root of the tree is an implied dot at the end, then com is the top-level domain (TLD), example is a domain registered under it, and www is a host inside that domain.
Responsibility is delegated down the tree. The root servers know who runs each TLD. The TLD servers know which name servers are authoritative for each domain under them. The domain's own authoritative servers hold the actual records.
02Who asks whom
Your application calls the operating system's stub resolver, which sends the question to a configured recursive resolver (your ISP's, your company's, or a public one). The recursive resolver does the work:
- Check the cache. If it has a fresh answer, return it immediately.
- Otherwise ask a root server for
www.example.com. The root replies with a referral to thecomname servers. - Ask a
comserver. It replies with a referral to the name servers forexample.com. - Ask an
example.comauthoritative server, which returns the record. - Cache the answer and return it to the stub.
The stub makes a recursive request ("get me the answer"), while the resolver makes iterative requests down the tree ("tell me who to ask next"). A cold lookup costs three upstream round trips (root, TLD, authoritative); a warm one costs none.
03A DNS message, byte by byte
import struct
def qname(n):
return b''.join(bytes([len(p)]) + p.encode() for p in n.split('.')) + b'\0'
header = struct.pack('>HHHHHH', 0x1234, 0x0100, 1, 0, 0, 0)
question = qname('www.example.com') + struct.pack('>HH', 1, 1) # type A, class IN
query = header + question
print(len(query)) # 33The 12-byte header holds a 16-bit id (to match replies to questions), flags (0x0100 sets the recursion-desired bit), and counts of questions, answers, authority and additional records. The name is encoded as length-prefixed labels: 3www7example3com0. Then comes the record type (1 for an A record, an IPv4 address) and class (1 for the internet). In query.hex(), the name bytes are 03777777 076578616d706c65 03636f6d 00 is exactly that name.
A response repeats the question and appends answer records. To save space, the answer's name is a two-byte pointer 0xC00C back to byte 12, where the name already appeared. I built a response by hand with a documentation address as the answer and decoded it with a small parser, which returned the name, a TTL of 300 and the address. This was a hand-built message, not a live lookup. DNS normally travels over UDP port 53, and falls back to TCP for large responses.
04Common record types
A maps a name to an IPv4 address and AAAA to an IPv6 address. CNAME makes one name an alias of another. MX lists the mail servers for a domain. NS names the authoritative servers for a zone. TXT holds free text and is widely used for ownership checks and email policies such as SPF. PTR maps an address back to a name (reverse lookup).
A CNAME cannot coexist with other records at the same name, which is why you cannot put one at the bare domain example.com (the zone apex), where NS and SOA records already exist. Some providers offer an "ALIAS" or "flattening" feature to work around this.
05Caching and TTL
Each record has a time-to-live in seconds. Resolvers and browsers keep the answer for that long. Caching is what makes DNS fast and keeps the root servers from being overwhelmed.
A simple model: one client asks for the same name every 10 seconds for 1,000 seconds (100 queries), with a 300-second TTL and a cold lookup costing 3 upstream queries. Only 4 queries miss the cache (at seconds 0, 300, 600 and 900), so 12 upstream lookups happen instead of 300, and 96 of the 100 client queries are answered from cache. The model ignores everything except the TTL, but it shows the effect.
The cost of caching is slow change. If you move a site to a new IP, resolvers keep serving the old address until the TTL runs out. Teams lower the TTL (to 60 seconds, say) a day before a planned migration and raise it again after.
06Security and privacy
A classic DNS reply is not signed, so an attacker who can inject a forged reply (cache poisoning) can send users to a wrong address. Randomised ports and ids make this harder, and DNSSEC adds digital signatures to records so a validating resolver can verify them. DNSSEC proves authenticity but does not hide the question.
Queries are visible to anyone on the path. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the connection between the client and the resolver. The resolver itself still sees your queries, so choose it with care.
07Common interview questions
Q: Walk through resolving www.example.com.
A: Stub resolver asks the recursive resolver. On a cache miss it asks a root server, then the .com TLD server, then the example.com authoritative server, caches the result and answers.
Q: Recursive versus iterative query?
A: In a recursive query the server does all the work and returns the final answer. In an iterative query it returns the best referral and the asker continues.
Q: What is a TTL and what are its trade-offs?
A: How long an answer may be cached. Long TTLs reduce load and latency. Short TTLs allow faster changes.
Q: What does a CNAME do?
A: Aliases one name to another. It cannot sit at the zone apex alongside other records.
Q: Which transport does DNS use?
A: UDP port 53 mostly, TCP for large responses and zone transfers.
Q: What attack does DNSSEC address?
A: Forged answers (cache poisoning), by letting resolvers validate signatures.