How a DNS lookup works
Before your browser can load www.example.com it needs an IP address. Follow one name from your computer through a recursive resolver, a root server, the .com server and the domain's own name server, then watch the cache answer the next lookup in a fraction of the time.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Your laptop sends its DNS question to which server first?
The stub resolver on your computer asks one recursive resolver (your ISP's or a public one) and lets it do the legwork.
02What does the root server send back when asked for www.example.com?
Root servers only know who runs each top-level domain. They answer with a referral, and the AA flag is not set.
03Which flag tells you an answer came from the zone owner itself?
AA means Authoritative Answer. RD asks for recursion, RA says recursion is available, TC says the message was truncated.
04Why was the second lookup so much faster?
The resolver cached the A record for its TTL (3600 s). Ten minutes later it still had 3000 s left, so no server was asked.
05Why does the .com server include a glue A record for ns1.example.com?
Without glue the resolver would need to ask ns1.example.com for its own address: a loop. Glue breaks it.
Glossary
- Stub resolver
- The small DNS client in your operating system. It asks one recursive resolver and waits for the final answer.
- Recursive resolver
- A server that chases the answer for you by asking root, TLD and authoritative servers in turn, and caches what it learns.
- Root server
- One of 13 named identities (a to m.root-servers.net), each served by many anycast copies. Knows only who runs each TLD.
- TLD server
- Runs a top-level domain such as .com, and knows which name servers each domain under it delegated to.
- Authoritative server
- Holds a domain's zone and gives the final answer, marked AA.
- Referral
- An answer that says 'not me, ask these servers', carried in the authority section.
- Glue
- Address records sent with a referral so the resolver can reach a name server whose name is inside the zone it serves.
- TTL
- Time to live: how many seconds a record may be cached before it must be asked for again.
Notes and sources
- Shown with the full question at every hop (RFC 1034). Resolvers using QNAME minimisation (RFC 9156) send only "com." to the root and "example.com." to the .com server, revealing less of the name.
- Real referrals carry all 13 .com nameservers (a–m.gtld-servers.net) and their glue; one of each is shown.
- DNS falls back to TCP port 53 when a response is too large for UDP (TC=1).
- a.root-servers.net 198.41.0.4 and a.gtld-servers.net 192.5.6.30 are real; ns1.example.com 192.0.2.53 and 203.0.113.10 are RFC 5737 documentation addresses. Latencies are illustrative one-way times, not measurements.
Quiz Unlocks after the last step.