How DNS resolution works, step by step

Names are read from right to left

A domain name is a list of labels: www.example.com has the labels www, example and com, plus an invisible empty label for the root. RFC 1035 limits each label to 63 octets and the whole name to 255 octets.

The tree is managed from the top. The root zone knows who runs com; the com zone knows who runs example.com; the example.com zone holds the actual records for www.example.com. A server that holds a zone's records and answers from its own data is authoritative for that zone.

The four servers in a full lookup

Cloudflare's guide lists four kinds of server involved in loading a web page:

• The recursive resolver: usually run by your ISP or a public DNS service. It takes the question from your device and does the legwork.
• A root name server: answers with a referral to the right top-level domain servers.
• A TLD name server: for com, net, org and so on. It answers with a referral to the domain's own name servers.
• The authoritative name server: holds the records and gives the final answer.

Worked example: www.example.com with an empty cache

Assume nothing is cached anywhere, and that the domain's records point to documentation addresses. The lookup takes eight messages:

• 1. Your device asks the recursive resolver: A record for www.example.com? (recursion desired).
• 2. The resolver asks a root server the same question.
• 3. The root server doesn't know, but refers it to the com servers and gives their names and addresses.
• 4. The resolver asks a com server.
• 5. The com server refers it to example.com's name servers, for example ns1.example.com and ns2.example.com.
• 6. The resolver asks ns1.example.com.
• 7. ns1.example.com answers: www.example.com A 192.0.2.10, TTL 3600.
• 8. The resolver passes 192.0.2.10 to your device and keeps a copy for 3,600 seconds.

Caching skips most of the steps

Every record carries a TTL. RFC 1035 defines it as the time in seconds the record may be cached before the source should be consulted again, and a TTL of 0 means use it for this transaction only. Caches exist in the browser, in the operating system and in the resolver.

In practice the full walk is rare. Cloudflare's guide describes the shortcuts: a resolver that already has the NS records for example.com skips the root and com servers and goes straight to step 6, and one that has only the com servers cached skips the root. If the A record itself is cached, the resolver answers at once. That is why the second lookup of a name is usually much faster than the first, and why changes to a record are not seen everywhere at the same moment.

Where things go wrong

Most DNS failures map to one step. NXDOMAIN, meaning the name does not exist, comes from the authoritative server, often because of a typo or a missing record. A SERVFAIL means the resolver could not get a usable answer, often because the domain's name servers don't respond properly. A correct record that only some people see is a caching matter, covered in the TTL lesson.

Asking a second resolver separates the cases. If two resolvers agree, the problem is in the domain's own records. If they disagree, one of them has a cached or filtered answer.