Domain Name System (DNS)
The system that translates human-readable domain names into IP addresses.
What is DNS?
DNS is often described as the phone book of the internet. When you type example.com, DNS resolvers look up which IP address (or CDN endpoint) should receive your request.
How a lookup works (simplified)
- Browser checks local cache
- Query goes to a recursive resolver (often your ISP or 1.1.1.1 / 8.8.8.8)
- Resolver walks the hierarchy: root →
.comTLD → authoritative nameserver forexample.com - Returns an A record (IPv4), AAAA (IPv6), or CNAME (alias)
Common record types
| Record | Purpose |
|---|---|
| A / AAAA | Points name to IP address |
| CNAME | Alias to another hostname |
| MX | Mail server routing |
| TXT | Verification, SPF, DKIM |
| NS | Delegates zone to nameservers |
DNS in cloud architecture
- Route 53, Cloud DNS, and Azure DNS host zones and health-checked routing
- TTL (time to live) controls how long resolvers cache answers — lower TTL speeds up failover changes
- Geo routing sends users to regional endpoints
Security note
DNS is unauthenticated by default. DNSSEC adds cryptographic signatures. Cloud teams also monitor for hijacking and use short TTLs during migrations.
What people get wrong
- High TTLs before a migration. A 24-hour TTL means a day of traffic split between old and new servers; drop TTLs to 60s days before the cutover, raise them after.
- Forgetting DNS is cached everywhere. Your change propagating “instantly” in your terminal says nothing about a resolver in another country still holding the old answer.
- Dangling records. CNAMEs pointing at deleted cloud resources are a subdomain-takeover vulnerability, not just clutter — audit records when tearing infrastructure down.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.