DNS · explained simply

How DNS finds an address

You type github.com and press Enter. Your laptop asks one resolver, which asks three servers in turn, hands back 20.217.135.5 and keeps a copy for 60 seconds.

browser cache→ resolver :53→ root .→ com. TLD→ authoritative→ TTL 60

Your laptop checks its own notes first

Before anything goes out, your laptop looks for a copy it already has. The browser checks its notes. Then it asks the operating system, which checks its notes too.

The browser keeps a small DNS cache. On a miss, it hands the name to the OS stub resolver. The stub reads the /etc/hosts file and its own cache. A hit here needs no network at all.

your notes = browser + OS cache pinned note = /etc/hosts

It asks one librarian and waits

Your laptop does not search the internet itself. It hands one question to a librarian and waits for a finished answer.

The stub sends one UDP packet to port 53 on a recursive resolver. Your network tells the laptop which one to use, or you set one, such as 1.1.1.1. The query asks for the A record of github.com. It sets the RD (Recursion Desired) bit: please do the whole search for me.

librarian = recursive resolver "find it for me" = RD bit

Each sign points one level down

The librarian reads the name from right to left. It starts at the root, the main sign by the door. The root does not know GitHub. It only points to the com. wing. The com. sign only points to GitHub's own cabinet.

These answers are referrals: NS records that name the next zone's servers, often with their addresses. Resolver software ships with the root servers' addresses built in.

$ dig +trace @1.1.1.1 github.com   # trimmed
com.        172800 IN NS l.gtld-servers.net.
;; from c.root-servers.net in 65 ms
github.com. 172800 IN NS dns4.p08.nsone.net.
;; from j.gtld-servers.net in 60 ms
github.com. 60     IN A  20.217.135.5
;; from dns4.p08.nsone.net in 71 ms

main sign = root server wing sign = TLD server pointer = referral (NS)

Only the last server knows the address. The rest just point.

GitHub's own cabinet hands over the real card

GitHub's name server holds the real card for github.com. Every card carries a date stamp: how long a copy may be trusted. This one says 60 seconds.

The authoritative server answers from its own zone and sets the AA (Authoritative Answer) bit. The card is a resource record: a name, a type, a TTL in seconds and the data.

Type	The card holds
`A`	an IPv4 address, such as `20.217.135.5`
`AAAA`	an IPv6 address
`CNAME`	another name to look up instead
`NS`	the name servers of a zone

cabinet = authoritative server card = resource record date stamp = TTL

The librarian keeps copies until the stamp runs out

The librarian copies every card and every pointer it gets. The next person who asks gets the copy at once. When the stamp runs out, the copy goes in the bin, and the next question walks again.

A resolver caches each record and counts its TTL down. One query to 1.1.1.1 came back with TTL 46: a copy, 14 seconds old. The com. referral lives for 172800 seconds (2 days), so later walks for any .com name skip the root.

First asker

Three more hops: root, com., GitHub.
About 200 ms here (65 + 60 + 71).

Next asker

The librarian reads the copy.
7 ms here, one round trip.

desk copies = resolver cache bin = dropped at TTL 0

A copy costs one round trip. A full walk costs four.

Before you rely on it

catchA changed record does not spread by itself. Each resolver serves its old copy until the TTL runs out. Before a move, lower the TTL, then wait out the old one.
ask nextWhat if GitHub's name server is down? github.com lists eight name servers at two providers, so the resolver tries another. If none answer, your laptop gets SERVFAIL.
ask nextWhy does a brand-new name fail for a while? If someone asked before it existed, resolvers cached the "no" (NXDOMAIN). The "no" lives for the negative TTL from the zone's SOA record. For github.com, that is 3600 seconds.
ask nextCan someone fake the answer? Plain DNS is unsigned UDP, so a forged reply can slip in. DNSSEC signs records. DNS over HTTPS or TLS encrypts the hop from your laptop.
simplifiedEach server drawn is a group: 13 root names on hundreds of machines, 13 com. servers, 8 for GitHub. CNAME chains, IPv6, DNSSEC and query name minimisation are left out.
sourcesRFCs 1034, 1035, 2308 (negative caching), 9156 (minimisation), 9499 (terms) and the IANA root server list. Addresses, TTLs and times measured with dig on 1 Nov 2026. Yours will differ.
not verifiedHow long the browser and the OS keep their copies, and the order they check. It varies by browser and OS.