What Is DNS? How the Domain Name System Works

DNS (Domain Name System) translates human-readable domain names (google.com) into IP addresses (142.250.185.46). Without DNS, nothing works on the Internet. It uses a global hierarchical architecture, millions of servers, and cached responses for performance. DNS is essential and frequently targeted by attacks.

DNS Hierarchy

• Root servers (13 globally): . (the root)
• TLD servers: .com, .fr, .org, etc.
• Authoritative servers: for each domain
• Resolvers (recursive): perform lookups on behalf of the client
• Clients: operating systems or browsers with a local resolver

Record Types

• A: name → IPv4
• AAAA: name → IPv6
• CNAME: alias pointing to another name
• MX: email server
• NS: authoritative nameserver
• TXT: free-form text (SPF, DKIM, DMARC)
• PTR: reverse lookup (IP → name)
• SRV: service location (LDAP, Kerberos)
• CAA: Certificate Authority Authorization

DNS Resolution Chain

For www.google.com from your PC:

• 1. The PC queries the configured resolver (e.g., 8.8.8.8)
• 2. The resolver queries a root server (.)
• 3. The root server returns the .com TLD servers
• 4. The resolver queries .com
• 5. .com returns the google.com nameservers
• 6. The resolver queries ns1.google.com
• 7. Response: A record www.google.com = 142.250.185.46
• 8. Cached for ~1 day (TTL)

Public Resolvers

• Google: 8.8.8.8 / 8.8.4.4
• Cloudflare: 1.1.1.1 / 1.0.0.1
• Quad9: 9.9.9.9 (built-in malware blocking)
• OpenDNS: 208.67.222.222
• FDN (France): 80.67.169.12

DNSSEC

DNS Security Extensions: cryptographic signatures for records to prevent cache poisoning:

• RRSIG, DNSKEY, DS, NSEC records
• .fr signed since 2010, .com since 2011
• Actual adoption: ~30%

DoT / DoH

• DoT (DNS over TLS): port 853
• DoH (DNS over HTTPS): port 443
• Benefit: encrypted DNS resolution
• Enterprise challenge: bypassing local filters

Order from OPTINOC

Enterprise DNS architecture using BIND/Windows DNS/Infoblox. DNSSEC, DoT, and SASE integration. Quotes within 48h.