DNS Resolution

You type www.example.com and press Enter. Within milliseconds, a web page begins to load. What you never see is the Domain Name System (DNS) at work — a global, distributed phone book that translates human-friendly names into the numerical IP addresses machines actually use.

DNS was designed by Paul Mockapetris in 1983 (formalized in RFC 1034 and RFC 1035) and has not changed in its fundamentals since. The key insight was hierarchical delegation: no single server needs to know every name. Instead, authority is split along the dots in a domain name, from right to left — the root, the top-level domain (TLD), and the authoritative zone for the name itself.

A recursive resolver — typically operated by your ISP or a public service like 8.8.8.8 — does the hard work on your behalf. It contacts each level of the hierarchy in turn, collecting one referral per hop, until an authoritative answer arrives. Then it caches that answer so the next request costs nothing. The result is a system that scales to billions of names with no central bottleneck.

Pick a domain name and watch the resolver walk the hierarchy from root to authoritative server. Each hop shows the question asked, the server that answers, and what it returns. After the first lookup, click Resolve again to see the cached answer skip all the intermediate steps.

<!-- {{c_html_intro}} -->
<div class="controls">
  <label for="domain-select">{{label_domain}}</label>
  <select id="domain-select">
    <option value="www.example.com">www.example.com</option>
    <option value="mail.google.com">mail.google.com</option>
    <option value="api.github.com">api.github.com</option>
    <option value="blog.mozilla.org">blog.mozilla.org</option>
  </select>
  <button id="btn-resolve" type="button">{{btn_resolve}}</button>
  <button id="btn-clear-cache" type="button" class="ghost">{{btn_clear_cache}}</button>
</div>
<div id="cache-indicator" class="cache-indicator" aria-live="polite"></div>
<ol id="hop-list" class="hop-list" aria-live="polite"></ol>
<div id="result-box" class="result-box" aria-live="polite"></div>

/* {{c_css_intro}} */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.controls { display: flex; flex-wrap: wrap; align-items: center; gap: .5rem; margin-bottom: .8rem; }
label { font-size: .9rem; font-weight: 600; color: #444; }
select { font: 15px system-ui, sans-serif; padding: .35rem .6rem; border: 1px solid #b0b8c1;
         border-radius: 6px; background: #f5f7fa; color: #222; }
button { font: 600 14px system-ui, sans-serif; padding: .4rem .85rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 7px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
/* {{c_css_hops}} */
.hop-list { list-style: none; margin: .4rem 0; padding: 0; display: flex; flex-direction: column; gap: 6px; }
.hop { display: flex; align-items: flex-start; gap: .6rem; padding: .5rem .7rem;
       border-radius: 8px; font-size: .85rem; line-height: 1.45; animation: fadein .25s ease; }
@keyframes fadein { from { opacity: 0; transform: translateY(-4px); } to { opacity: 1; transform: none; } }
.hop .badge { flex-shrink: 0; padding: .18rem .5rem; border-radius: 5px; font: 700 11px monospace;
              color: #fff; white-space: nowrap; }
.hop.resolver .badge  { background: #5a7088; }
.hop.root     .badge  { background: #e07b22; }
.hop.tld      .badge  { background: #2a7a4a; }
.hop.auth     .badge  { background: #9b2d8e; }
.hop.cache    .badge  { background: #0a7d9b; }
.hop.resolver { background: #eef1f5; }
.hop.root     { background: #fff5eb; }
.hop.tld      { background: #edfaf2; }
.hop.auth     { background: #f9eef8; }
.hop.cache    { background: #e8f7fb; }
.hop .text b  { font-weight: 700; }
/* {{c_css_result}} */
.result-box { margin-top: .5rem; padding: .55rem .8rem; border-radius: 8px;
              font: 600 15px system-ui, sans-serif; min-height: 2em; }
.result-box.ok  { background: #d4edda; color: #0a5226; }
.result-box.bad { background: #fde8e8; color: #8b1c1c; }
.cache-indicator { font-size: .82rem; color: #5a7088; min-height: 1.2em; margin-bottom: .2rem; }

// Code not found

Notice the asymmetry: the first lookup takes three or more round trips across the hierarchy; the cached lookup costs nothing extra. That is why TTL (time-to-live) is the key tuning knob in DNS — too short and every request re-queries the whole chain; too long and stale records persist after an IP address changes.

The demo simplifies slightly. Here is what the full picture looks like:

• Two lookup styles. A recursive query tells a resolver "give me the final answer, whatever it takes." An iterative query says "give me your best referral and I'll ask the next server myself." Resolvers speak recursive to clients and iterative to the rest of the hierarchy.
• Three tiers. A cold resolver contacts a root server (there are 13 root server names, each backed by hundreds of anycast machines), which replies with the authoritative name servers for the TLD (.com, .org, etc.). The TLD server replies with the name servers for the specific domain. Only then does the authoritative server for that domain answer with the actual IP address.
• TTL arithmetic. Each response carries a TTL in seconds. The resolver caches the answer and serves it from memory until the TTL expires — typically between 300 s and 86 400 s. Negative answers (NXDOMAIN: "this name does not exist") are also cached, preventing storms of repeated queries for mistyped names.
• DNSSEC. Because the hierarchy is built on trust, a rogue answer can redirect users silently. DNSSEC adds cryptographic signatures to each delegation so resolvers can verify authenticity. Adoption is growing but still incomplete — many zones remain unsigned.
• Failure modes. A misconfigured NS record or a lame delegation (a name server that is listed but not actually authoritative) can make an entire domain unreachable even though every other server is healthy.

Understanding DNS end-to-end connects directly to topics like graph algorithms (the delegation tree is a directed acyclic graph) and caching (TTL expiry is a time-bounded invalidation strategy).

DNS is invisible until it breaks, at which point everything stops:

• Web browsing: every HTTPS connection starts with a DNS lookup. A resolver cache miss adds perceptible latency; a resolver failure makes the site unreachable even if the web server is healthy.
• Email delivery: mail servers find each other via MX records, a special DNS record type that lists mail exchangers ranked by priority. A missing or wrong MX record silently drops email.
• CDN and load balancing: content delivery networks use DNS to steer users to the nearest edge node. Short TTLs let them shift traffic in seconds; long TTLs keep stale entries pointing at decommissioned servers.
• Certificate issuance (ACME/Let's Encrypt): the DNS-01 challenge proves domain ownership by asking you to publish a TXT record at a specific name. The certificate authority then queries DNS to verify it.
• Microservice discovery: in Kubernetes and similar systems, every service gets a DNS name inside the cluster. Pods find each other by name rather than by hard-coded IP addresses, so replicas can scale up and down without reconfiguration.

Every one of these use cases lives or dies on the correctness and freshness of DNS records. The hierarchy that Mockapetris designed in 1983 is, remarkably, still the backbone of all of them.

DNS resolution is a masterclass in hierarchical delegation: no single authority knows everything, yet any name in the world can be resolved in three hops. The recursive resolver acts as your agent, the cache acts as your memory, and the TTL acts as a freshness contract between publishers and consumers.

The design has survived forty years and trillions of queries because it separates concerns cleanly — write authority stays with the domain owner, read caching happens everywhere, and the root of trust is replicated across hundreds of anycast servers on every continent. Next time a browser tab loads in under a second, remember that before the first byte of HTML arrived, this entire hierarchy was already consulted and answered — silently, completely, in milliseconds.