Protocol ExplorerGuidePricing

DNS Explained: How It Works and What to Look For

The Domain Name System translates names into resource records used by applications.

Published by Protocol Explorer · Reviewed

How DNS works

A resolver asks for a name and record type. Depending on its cache and configuration it may contact authoritative servers, then return an answer, referral or error.

What to look for in an exchange

Read the transaction ID, question name and type, response code, answer records and TTL. A DNS response can contain more than an IP address.

DNS resolution step by step

  1. An application asks a resolver for a name and record type, such as an A or AAAA record.
  2. The resolver checks its cache. If needed, it follows delegations from root servers through the appropriate top-level domain to an authoritative server.
  3. The authoritative server responds with the requested record, a referral, or a negative answer. The resolver returns the result to the application.
  4. The resolver may cache the answer according to its TTL and its own policy. DNS resolution does not itself open the application connection.

Common DNS record types

  • A and AAAA: IPv4 and IPv6 addresses respectively.
  • CNAME: an alias pointing to another domain name.
  • MX: mail-exchange hosts for a domain.
  • NS: authoritative name servers for a zone.

DNS, DNSSEC and encrypted DNS

DNSSEC lets a validating resolver check signatures on signed DNS data. DNS over HTTPS protects the message between the client and its chosen resolver; it does not by itself validate signed records or hide queries from that resolver. See DNSSEC and DNS over HTTPS.

Follow an example step by step

  1. Write down the queried domain name and record type, then find the matching response.
  2. Read the response code and answer records; distinguish an empty answer from an error.
  3. Check the TTL and consider whether an intermediate resolver may be serving a cached answer.

Common interpretation mistake

A successful DNS answer does not prove that a later TCP connection or application request will succeed.

Key point to remember

DNSSEC authenticates signed DNS data; DNS over HTTPS protects the client-to-resolver transport.

Explore the protocol

The DNS overview is free without an account. Its full interactive lesson is included in Protocol Explorer Pro, a one-time $4.99 purchase; an account is required to buy Pro and restore the licence across devices.

Open Protocol Explorer · Compare Free and Pro

Specification

Read the primary specification for DNS for the authoritative protocol details. The interactive scenario is a simplified teaching model, not a capture of your network.

Continue learning

How to read a packet · TCP · UDP · HTTPS