Video: How a DNS Server (Domain Name System) works — PowerCert Animated Videos. Embedded from YouTube in privacy-enhanced mode; all rights belong to the creator.
Computers talk to each other using IP addresses, but humans remember names. The Domain Name System (DNS) is the internet's distributed phone book that translates tech.tools into an address like 203.0.113.10. It's queried before almost every connection your devices make, usually in a few milliseconds — and when it breaks, it looks like “the internet is down”.
The journey of a lookup
- Local caches. Your browser and operating system first check whether they resolved the name recently.
- Recursive resolver. If not, the query goes to a resolver — usually your ISP's, or a public one like 1.1.1.1, 8.8.8.8 or 9.9.9.9.
- Root servers. The resolver asks a root server, which replies with the servers responsible for the top-level domain (
.tools,.com…). - TLD servers. These point to the domain's authoritative name servers (the NS records set at your registrar).
- Authoritative server. Returns the actual record — an A record with an IPv4 address, for example.
- Caching. The resolver caches the answer for its TTL and hands it back to you.
Record types you need to know
| Type | What it does | Example value |
|---|---|---|
| A | Maps a name to an IPv4 address | 185.199.108.153 |
| AAAA | Maps a name to an IPv6 address | 2606:50c0:8000::153 |
| CNAME | Alias to another hostname | www → username.github.io |
| MX | Mail servers with priorities | 10 mx1.mailhost.com |
| TXT | Free text: SPF, DKIM, DMARC, verification | v=spf1 include:_spf.google.com ~all |
| NS | Delegates a zone to name servers | ns1.provider.net |
| CAA | Restricts which CAs may issue certificates | 0 issue "letsencrypt.org" |
TTL and “propagation”
Each record carries a time-to-live in seconds. Resolvers worldwide may serve the cached old value until it expires — that's what people mean by “waiting for DNS to propagate”. The professional trick: lower the TTL to 300 seconds a day before a migration, make the change, then raise it again afterwards.
Debugging checklist
- Check the record with our DNS lookup tool or
dig example.com A. - Confirm the domain's NS records point to the provider where you're editing records — editing the wrong zone is the most common mistake.
- A CNAME can't coexist with other records at the same name, and can't sit at the zone apex (use ALIAS/ANAME or A records there).
- For email issues, verify MX, SPF (TXT), DKIM (TXT on a selector) and DMARC (TXT on
_dmarc). - Still stuck? Flush your local cache (
ipconfig /flushdnson Windows).
DNS privacy and security
Traditional DNS travels unencrypted, so networks can see and tamper with lookups. DNS-over-HTTPS (DoH) and DNS-over-TLS encrypt queries; DNSSEC adds signatures so answers can't be forged. Modern browsers can enable DoH in their settings.
Try the tools
DNS Lookup
Query A, AAAA, MX, TXT, NS, CNAME, CAA and more records.
What Is My IP Address
See your public IP, ISP, location and time zone.