DNS explained in plain words: how a domain finds its website

DNS (Domain Name System) is the internet's address book. Computers find each other by numbers (IP addresses), but people remember names. DNS translates a name such as example.com into the number of the server where the site lives. Every time someone opens your website or sends you email, DNS is working in the background.

How a lookup works

1. You type example.com into the browser.
2. The browser asks a resolver, usually run by your internet provider or a public service, for the address.
3. If the resolver does not know it, it asks the root servers, then the servers of the top-level domain (such as .com), and finally the authoritative name server that holds the records of your domain.
4. The answer, for example 203.0.113.10, comes back and is kept in a cache for a while.
5. The browser connects to that address and loads the page.

This takes a few milliseconds. Caching is why changes to DNS records sometimes take hours to show everywhere.

Who runs the servers

• Your provider's DNS: used by default, but not always the fastest or most private.
• Public DNS: services from large companies that many people use instead. Some offer faster answers and extra filtering.
• Top-level servers: know which name servers belong to each domain.
• Your domain's name servers: hold the actual records. You manage them at your registrar, hosting provider or a DNS service.

The main record types

• A: points a name to an IPv4 address. This connects example.com to your server.
• AAAA: the same for the newer IPv6 addresses.
• CNAME: an alias. For example, www can point to example.com.
• MX: tells the world which servers receive email for your domain. A wrong MX record means lost email.
• TXT: free text used for verification and email protection (SPF, DKIM, DMARC).
• NS: shows which name servers manage the domain.

Why it matters to a business

• Your site and email depend on it. One wrong record can take your website or your inbox offline.
• Moving hosting is mostly a matter of changing DNS records, so lower the "TTL" (cache time) a day before and you will switch faster.
• Email delivery relies on correct SPF, DKIM and DMARC records.
• Security: DNS can be attacked or hijacked, so protect the account where it is managed with a strong password and two-factor login.

Security and privacy

• Ordinary DNS questions are not encrypted, so a provider or network can see which sites you visit. Encrypted DNS (DNS over HTTPS or TLS) reduces this.
• DNSSEC signs the answers so they cannot be forged.
• Keep a copy of all your DNS records somewhere safe. If a mistake or a provider problem wipes them, you can restore your site and email within minutes.

A handy check

If a site does not open for you but works for others, try another network or another DNS service. For a quick test of what a name points to, use a DNS lookup tool. The local hosts file on a computer can override DNS and is often used by developers to test a new server before changing the real records.

DNS is invisible when it works and a disaster when it breaks. Know where your records are managed, and who has access.