What Is DNS? How the Domain Name System Works

April 15, 2026·2 min read·274 words

DNS (Domain Name System) translates human-readable domain names (google.com) into IP addresses (142.250.185.46). Without DNS, nothing works on the Internet. It uses a global hierarchical architecture, millions of servers, and cached responses for performance. DNS is essential and frequently targeted by attacks.

DNS Hierarchy

Root servers (13 globally): . (the root)
TLD servers: .com, .fr, .org, etc.
Authoritative servers: for each domain
Resolvers (recursive): perform lookups on behalf of the client
Clients: operating systems or browsers with a local resolver

Record Types

A: name → IPv4
AAAA: name → IPv6
CNAME: alias pointing to another name
MX: email server
NS: authoritative nameserver
TXT: free-form text (SPF, DKIM, DMARC)
PTR: reverse lookup (IP → name)
SRV: service location (LDAP, Kerberos)
CAA: Certificate Authority Authorization

DNS Resolution Chain

For www.google.com from your PC:

1. The PC queries the configured resolver (e.g., 8.8.8.8)
2. The resolver queries a root server (.)
3. The root server returns the .com TLD servers
4. The resolver queries .com
5. .com returns the google.com nameservers
6. The resolver queries ns1.google.com
7. Response: A record www.google.com = 142.250.185.46
8. Cached for ~1 day (TTL)

Public Resolvers

Google: 8.8.8.8 / 8.8.4.4
Cloudflare: 1.1.1.1 / 1.0.0.1
Quad9: 9.9.9.9 (built-in malware blocking)
OpenDNS: 208.67.222.222
FDN (France): 80.67.169.12

DNSSEC

DNS Security Extensions: cryptographic signatures for records to prevent cache poisoning:

RRSIG, DNSKEY, DS, NSEC records
.fr signed since 2010, .com since 2011
Actual adoption: ~30%

DoT / DoH

DoT (DNS over TLS): port 853
DoH (DNS over HTTPS): port 443
Benefit: encrypted DNS resolution
Enterprise challenge: bypassing local filters

Order from OPTINOC

Enterprise DNS architecture using BIND/Windows DNS/Infoblox. DNSSEC, DoT, and SASE integration. Quotes within 48h.