Skip to content
← DNS: the internet’s address book

Lesson 1 of 4 · 6 min

What DNS does

Why computers need a name-to-number lookup for every website you visit, and who actually answers that lookup.

The TCP/IP course covers how computers address each other by number. Nobody wants to memorize numbers to read the news or send an email, so the internet has a name-to-number lookup running behind almost everything you do online: the Domain Name System, or DNS. Cloudflare’s Learning Center calls it, simply, “the phonebook of the Internet.”

A tree, not a single list

DNS was designed, per RFC 1034, around “a consistent name space which will be used for referring to resources”, organized as “a tree structure” where “each node and leaf on the tree corresponds to a resource set.” In practice that tree has layers, each one responsible for a smaller slice of names:

  • The root, at the top of the tree, does not know any website’s address, but it knows which servers are responsible for each top-level domain (.com, .org, and so on).
  • A top-level domain (TLD) server does not know your specific website either, but it knows which authoritative server is responsible for that domain.
  • An authoritative server holds the actual answer for a specific domain: which IP address example.org currently points to.
  • A resolver (or recursor) is the server your device actually asks. It does the work of walking down the tree on your behalf, then caches the answer for a while so it does not have to repeat the whole walk for every request.

Cloudflare’s Learning Center uses a library analogy for the same idea: “the recursor can be thought of as a librarian who is asked to go find a particular book somewhere in a library”, while “the root server is the first step in translating (resolving) human readable host names into IP addresses… it serves as a reference to other more specific locations.”

Following one lookup

  1. Your Mac asks its configured resolver, often run by your ISP, your Wi-Fi router, or a public service, for the address behind a name.
  2. If the resolver does not already have the answer cached, it asks a root server which TLD server to try.
  3. It asks that TLD server which authoritative server to try.
  4. It asks the authoritative server for the actual answer, then returns that answer to your device and keeps a cached copy for other requests.

RFC 1035 defines the exact message format for these queries and answers, and notes they typically travel over UDP or TCP on port 53. Nothing about that lookup is secret by default; the next lesson covers who can see it and why that matters.

A DNS lookup from the command line
dig example.com

;; ANSWER SECTION:
example.com.		233	IN	A	104.20.23.154
example.com.		233	IN	A	172.66.147.243

That single command is the whole process from this lesson happening in about a tenth of a second: your resolver walked the tree (or served a cached answer), and handed back the numeric address behind the name.

Key takeaways

  • DNS translates human-readable names into the numeric IP addresses computers actually use to connect.
  • RFC 1034 organizes DNS as a tree: root, then top-level domain servers, then authoritative servers for each domain.
  • A resolver (recursor) does the walk down that tree on your device’s behalf and caches the answer.
  • RFC 1035 defines the query/response format; lookups typically travel over UDP or TCP on port 53.
  • A DNS lookup is not secret by default; it is plain, readable traffic unless it is specifically encrypted.

Check yourself

  1. 1. What is the main job of DNS?

    • Encrypting web traffic
    • Translating domain names into the IP addresses computers use to connect — Right.
    • Assigning private IP addresses to home devices
    • Managing which port an app uses

    Cloudflare describes DNS as "the phonebook of the Internet": it translates domain names to IP addresses.

  2. 2. In the DNS tree described by RFC 1034, what does a root server actually know?

    • The IP address of every website
    • Which servers are responsible for each top-level domain, not individual website addresses — Right.
    • Nothing; it is only decorative
    • Only addresses ending in .com

    Cloudflare’s analogy: the root server "serves as a reference to other more specific locations", pointing toward TLD servers rather than answering directly.

  3. 3. What does a DNS resolver (recursor) do?

    • It stores every website’s files
    • It walks the DNS tree on your device’s behalf and caches the answer it finds — Right.
    • It only handles email
    • It replaces the need for IP addresses entirely

    Cloudflare compares the recursor to a librarian who goes and finds the answer, then the resolver caches it so future lookups are faster.

  4. 4. Is a typical DNS lookup encrypted by default?

    • Yes, always
    • No, it is plain, readable traffic unless specifically encrypted — Right.
    • Only for .com domains
    • Only on Wi-Fi

    RFC 1035 defines the DNS message format without built-in encryption; encrypting DNS requires a separate mechanism, covered in a later lesson.

Do it with FireAI

Put this lesson into practice on your own Mac.

Sources

Put it into practice on your Mac

Try every feature free for 17 days, no card needed.

Download for Mac Docs