Cold lookup · 141 ms illustrative
The browser and then the operating system look for a cached answer for www.example.com and find none.
The stub resolver sends one recursive query (RD=1, recursion desired) over UDP port 53 to its configured recursive resolver.
The resolver has nothing cached for this name or for .com, so it starts at the root, using the root server list it primed from its built-in hints.
The resolver sends an iterative query (RD=0) to a root server, here a.root-servers.net at 198.41.0.4, reaching its nearest anycast instance.
The root does not know the answer, so it returns a referral: the .com nameservers in the authority section and their addresses as glue, without the AA flag.
The resolver repeats the question to a .com TLD server, a.gtld-servers.net at 192.5.6.30.
The .com server returns another referral: the NS record for example.com plus a glue A record. ns1.example.com sits inside example.com itself, so without it the resolver could not find the server's address without asking that same server.
The resolver asks ns1.example.com at 192.0.2.53, the server that holds the example.com zone.
The authoritative server answers with the A record and sets AA=1, meaning the answer comes from the zone owner itself.
The resolver caches each record set it learned for its own TTL: two days for the delegations, one hour for the address.
The resolver returns the address to the stub with RA=1 (recursion available); AA is clear because the resolver is not the zone owner.
The OS caches the answer for up to its TTL and the browser opens a connection to 203.0.113.10; DNS is finished.
Look up again · 600 s later · 21 ms
A second device has nothing cached for www.example.com, so it must ask the resolver.
The stub sends the same recursive query (RD=1) over UDP port 53.
The resolver still holds the A record from 600 seconds ago, so it asks no root, TLD or authoritative server.
The resolver answers at once with the TTL counted down to 3000 seconds, the time the record has left in cache.
The browser connects to 203.0.113.10 after one round trip in total, instead of the four the cold lookup needed.
The message, dig-style
;; step 1 · local-cache · cache · local ;; at the stub resolver ;; QUESTION SECTION: ;www.example.com. IN A
Real referrals carry all 13 .com nameservers (a–m.gtld-servers.net) and their glue; one of each is shown. DNS falls back to TCP port 53 when a response is too large for UDP (TC=1).