What is DNS?

The Internet's Phone Book

DNS (Domain Name System) translates human-readable domain names into IP addresses that computers use to communicate.

•*DNS stands for Domain Name System.** It's a hierarchical, distributed naming system that converts human-friendly domain names like "google.com" into machine-readable IP addresses like "142.250.80.46".

•*Why DNS matters:**
Without DNS, you would need to memorize the IP address of every website you want to visit. DNS makes the internet user-friendly by letting us use memorable names instead of numbers.

•*How it works at a high level:**
When you type a URL in your browser, a DNS query is sent to resolve the domain name. This process happens in milliseconds, usually without you noticing. The system is distributed across millions of servers worldwide, making it both fast and resilient.

•*Key DNS concepts:**
•Domain names: Human-readable addresses (example.com)
•IP addresses: Numeric addresses computers use (192.0.2.1)
•DNS servers: Computers that store DNS records and answer queries
•DNS records: Database entries mapping names to values

How DNS Resolution Works

The DNS Lookup Process

Follow the journey of a DNS query from your browser through multiple servers to get the IP address.

•*The DNS resolution process involves several steps:**

•*1. Browser Cache Check**
Your browser first checks its local cache for a recent DNS record. If found, no network request is needed.

•*2. Operating System Cache**
If not in the browser cache, the query goes to your OS's DNS resolver cache.

•*3. Recursive Resolver Query**
Your ISP's DNS resolver (or a public DNS like Cloudflare 1.1.1.1 or Google 8.8.8.8) receives the query if not cached locally.

•*4. Root Name Servers**
The resolver queries one of the 13 root server clusters, which direct it to the appropriate TLD (Top-Level Domain) server.

•*5. TLD Name Servers**
The .com, .org, .net, or country-code TLD server points to the authoritative name server for the specific domain.

•*6. Authoritative Name Server**
This server has the actual DNS records for the domain and returns the IP address.

•*7. Response Caching**
The IP address flows back through the chain. Each server caches the result based on the TTL (Time To Live) value.

•*Typical DNS lookup time:** 20-120 milliseconds for uncached queries, <1ms for cached.

DNS over HTTPS (DoH)

Encrypted DNS for Privacy

DNS over HTTPS encrypts your DNS queries, preventing eavesdropping and manipulation of your browsing activity.

•*What is DNS over HTTPS?**
DNS over HTTPS (DoH) encrypts DNS queries using the HTTPS protocol (port 443). This prevents anyone on your network from seeing which websites you're trying to visit.

•*Why DoH matters:**
Traditional DNS queries are sent in plain text, meaning your ISP, network administrator, or attackers can see every website you visit. DoH encrypts this traffic.

•*Benefits of DoH:**
•Privacy: ISPs and networks can't see your DNS queries
•Security: Prevents DNS spoofing and man-in-the-middle attacks
•Censorship resistance: Harder to block specific websites
•Integrity: Ensures DNS responses haven't been tampered with

•*How to enable DoH:**

•*In browsers:**
•Chrome: Settings → Privacy → Use secure DNS
•Firefox: Settings → Privacy → Enable DNS over HTTPS
•Edge: Settings → Privacy → Use secure DNS

•*System-wide:**
•Windows 11: Settings → Network → DNS → Encrypted DNS
•macOS: Use a DoH-compatible DNS app
•Android 9+: Settings → Private DNS

•*Popular DoH providers:**
•Cloudflare: https://cloudflare-dns.com/dns-query
•Google: https://dns.google/dns-query
•Quad9: https://dns.quad9.net/dns-query

•*Related: DNS over TLS (DoT)** uses TLS encryption on port 853, offering similar privacy benefits with a dedicated port.

What is Private DNS?

Secure DNS on Mobile Devices

Private DNS is Android's feature for encrypted DNS, protecting your queries from network surveillance.

•*Private DNS explained:**
Private DNS is the Android operating system's term for DNS over TLS (DoT). When enabled, your DNS queries are encrypted, preventing your mobile carrier or Wi-Fi network from monitoring which websites you access.

•*How Private DNS differs from regular DNS:**
•Regular DNS: Queries sent in plain text, visible to networks
•Private DNS: Queries encrypted with TLS, hidden from networks

•*Setting up Private DNS on Android:**
1. Go to Settings → Network & Internet → Private DNS
2. Select "Private DNS provider hostname"
3. Enter a provider (e.g., dns.google, 1dot1dot1dot1.cloudflare-dns.com)
4. Save and your DNS is now encrypted

•*Popular Private DNS providers:**
•Cloudflare: 1dot1dot1dot1.cloudflare-dns.com (fast, privacy-focused)
•Google: dns.google (reliable, widely used)
•Quad9: dns.quad9.net (security-focused, blocks malware)
•AdGuard: dns.adguard.com (blocks ads and trackers)

•*On iOS:**
iOS doesn't have a built-in Private DNS toggle, but you can:
•Use the 1.1.1.1 app from Cloudflare
•Install a DNS profile from your preferred provider
•Use a VPN with DNS protection

•*Benefits:**
•Prevents ISP DNS logging
•Protects against DNS hijacking on public Wi-Fi
•Can block malware and ads (with providers like AdGuard)

DNS Record Types

Understanding Different Records

Different record types serve different purposes - from basic address mapping to email routing and security.

•*Common DNS Records:**

•*Address Records:**
•A Record: Maps a domain to an IPv4 address (e.g., 192.0.2.1)
•AAAA Record: Maps a domain to an IPv6 address (e.g., 2001:db8::1)

•*Alias Records:**
•CNAME Record: Creates an alias pointing to another domain name

•*Email Records:**
•MX Record: Specifies mail servers and priority for the domain
•TXT Record: Stores text data for SPF, DKIM, domain verification

•*Infrastructure Records:**
•NS Record: Identifies authoritative name servers for the zone
•SOA Record: Contains zone administration info (serial, refresh, retry)

•*Security Records:**
•CAA Record: Specifies which CAs can issue SSL certificates
•DNSKEY/DS: DNSSEC records for cryptographic validation

•*Service Records:**
•SRV Record: Defines location of services (port, priority, weight)
•PTR Record: Used for reverse DNS (IP to hostname) lookups

View all record types →

DNS Propagation

Why Changes Take Time

When you update DNS records, changes don't appear instantly everywhere. Here's why and how to check.

•*What is DNS propagation?**
When you update DNS records, the changes need to spread across DNS servers worldwide. This process is called propagation.

•*Why propagation takes time:**
•DNS servers cache records based on TTL (Time To Live)
•Different servers refresh their caches at different times
•Some ISPs cache DNS longer than the TTL specifies
•There are millions of DNS servers globally

•*Typical propagation times:**
•Most changes: 15 minutes to 4 hours
•Worst case: Up to 24-48 hours
•With low TTL: As fast as 5 minutes

•*Tips for faster propagation:**
1. Lower TTL before changes: Set TTL to 300 (5 min) 24-48 hours before making changes
2. Verify at authoritative servers first: Changes should appear immediately there
3. Clear local cache: Flush your DNS cache for testing
4. Use propagation checker: Monitor rollout across global servers
5. Raise TTL after propagation: Increase back to 3600+ for performance

Check propagation status →

DNS Security

Protecting Your Domain

Learn about DNSSEC, DNS spoofing, and how to secure your domain's DNS configuration.

•*DNS Security Best Practices:**

•*DNSSEC (DNS Security Extensions)**
Cryptographically signs DNS records to prevent spoofing and cache poisoning. Adds DS and DNSKEY records to verify authenticity.

•*CAA Records**
Specify which Certificate Authorities can issue SSL certificates for your domain, preventing unauthorized certificate issuance.

•*Common DNS Attacks:**
•DNS Spoofing/Cache Poisoning: Injecting false DNS records
•DNS Amplification DDoS: Using DNS for volumetric attacks
•DNS Tunneling: Exfiltrating data through DNS queries
•Domain Hijacking: Unauthorized changes to DNS settings

•*Secure DNS Providers:**
Use providers that support:
•DNS over HTTPS (DoH)
•DNS over TLS (DoT)
•DNSSEC validation
•DDoS protection

•*Recommendations:**
•Enable DNSSEC if your registrar supports it
•Add CAA records to control certificate issuance
•Use strong authentication on DNS provider accounts
•Monitor for unauthorized DNS changes
•Consider DNS monitoring services for critical domains

DNS for Email

MX, SPF, DKIM & DMARC

Configure essential email DNS records for reliable delivery and spam prevention.

•*Essential Email DNS Records:**

•*MX Records (Mail Exchanger)**
Direct email to your mail servers. Priority values determine failover order.
Example: 10 mail.example.com

•*SPF (Sender Policy Framework)**
TXT record specifying which servers can send email for your domain.
Example: v=spf1 include:_spf.google.com ~all

•*Important**: SPF has a 10 DNS lookup limit. Exceeding this causes SPF failures.

•*DKIM (DomainKeys Identified Mail)**
Cryptographic signature added to emails, verified via DNS TXT record.
Published at: selector._domainkey.example.com

•*DMARC (Domain-based Message Authentication)**
Policy telling receivers how to handle emails failing SPF/DKIM.
Example: v=DMARC1; p=reject; rua=mailto:[email protected]

•*Why these matter:**
Without proper email DNS records:
•Emails go to spam or get rejected
•Your domain can be spoofed for phishing
•Deliverability decreases over time
•Major providers may block you entirely

Check email configuration →

Understanding TTL

Time To Live Explained

TTL controls how long DNS records are cached. Balance performance with flexibility.

•*What is TTL?**
TTL (Time To Live) specifies how long, in seconds, DNS resolvers should cache a record before requesting a fresh copy.

•*Common TTL Values:**
•300 (5 minutes): Dynamic records, before migrations
•3600 (1 hour): Standard for most records
•86400 (24 hours): Stable records that rarely change
•604800 (1 week): Very stable records (NS, root hints)

•*When to use low TTL (300-900):**
•Before making DNS changes
•Load balancing with health checks
•Failover configurations
•Records that change frequently

•*When to use high TTL (3600-86400):**
•Stable records (NS, MX for established services)
•Reducing DNS query load
•Improving resolution speed
•Lowering DNS costs (fewer queries)

•*Best Practice for DNS Changes:**
1. Check current TTL (may need to wait for it to expire)
2. Lower TTL to 300-600 seconds
3. Wait for old TTL to expire (24-48 hours if it was high)
4. Make your DNS changes
5. Verify changes have propagated
6. Raise TTL back to normal values

DNS Ports & Protocols

Technical Reference

DNS uses specific ports and protocols. Here's what you need to know for firewall configuration.

•*Standard DNS Ports:**

•*Port 53 (UDP/TCP)**
•Traditional DNS uses UDP port 53 for queries
•TCP port 53 for zone transfers and large responses
•Must be open for DNS to function

•*Port 853 (TCP)**
•DNS over TLS (DoT)
•Encrypted DNS queries
•Requires TLS handshake

•*Port 443 (TCP)**
•DNS over HTTPS (DoH)
•Uses standard HTTPS port
•Harder to block than DoT

•*Firewall Configuration:**
For standard DNS resolution, allow:
•Outbound UDP 53 to your DNS servers
•Outbound TCP 53 (for large responses)

For encrypted DNS:
•Outbound TCP 853 (DoT)
•Outbound TCP 443 (DoH) - usually already open

•*Why DNS uses UDP:**
•Faster (no connection setup)
•Lower overhead
•Most queries fit in single packet (<512 bytes)
•TCP used for responses >512 bytes or zone transfers

•*Troubleshooting firewall issues:**
If DNS isn't working, check if port 53 is blocked. Corporate networks sometimes block external DNS to enforce using internal servers.

DNS Troubleshooting

Common Issues & Fixes

Diagnose and fix common DNS problems with these troubleshooting steps.

•*Common DNS Issues:**

•*DNS Not Resolving**
•Check if domain is registered and not expired
•Verify NS records point to correct name servers
•Ensure records exist at authoritative server
•Try different DNS resolvers to isolate issue

•*Slow DNS Resolution**
•Check DNS server performance/latency
•Use faster public DNS (1.1.1.1, 8.8.8.8)
•Reduce CNAME chain length
•Check for DNS lookup loops

•*Email Not Working**
•Verify MX records point to valid mail servers
•Check SPF record includes all sending servers
•Validate DKIM key is correctly published
•Review DMARC policy and reports

•*SSL Certificate Issues**
•Check CAA records if issuance fails
•Verify DNS validation TXT records
•Wait for propagation before retrying

•*Debugging Commands:**
•nslookup domain.com - Basic DNS query
•dig domain.com ANY - Detailed query (Linux/Mac)
•dig @8.8.8.8 domain.com - Query specific server
•ipconfig /flushdns - Flush Windows DNS cache

View error guide →

What is DNS & How Does It Work?

Table of Contents