DNS: The Internet's Phonebook

Computers route to numbers — IP addresses like 93.184.216.34. Humans remember names like example.com. The Domain Name System (DNS) is the massive, distributed directory that translates between the two. It's often called the internet's phonebook, though "phonebook the size of the planet, updated constantly, with no central copy" is closer.

Domain names are read right to left as a hierarchy. In mail.google.com. the trailing dot is the root; com is the top-level domain (TLD); google is the second-level domain; and mail is a subdomain. This hierarchy is exactly what lets DNS be distributed — no single machine holds every name; responsibility is delegated down the tree.

At the top sit the root servers: 13 named identities (A through M) that, thanks to a technique called anycast, are actually served by hundreds of physical instances scattered worldwide. They don't know where google.com is — they just know who runs .com, and point you further down.

Two very different kinds of DNS server do the work, and telling them apart is essential.

An authoritative server holds the real, official records for a zone. The authoritative server for example.com is the source of truth for that domain's addresses. It answers only for zones it's responsible for.

A recursive resolver (like the one your ISP runs, or public ones such as 8.8.8.8 and 1.1.1.1) does the legwork on your behalf. When you ask it for www.example.com, and it hasn't cached the answer, it walks the hierarchy:

1. Ask a root server → "I don't know, but here's the authoritative server for .com."
2. Ask the .com TLD server → "Here's the authoritative server for example.com."
3. Ask example.com's authoritative server → "It's 93.184.216.34."

The resolver hands you the answer and caches it. Your device only ever spoke to the recursive resolver; it did the recursion so you didn't have to.

A DNS zone isn't just names-to-IPs. It's a set of resource records, each a type with a purpose:

TXT records quietly run email security: SPF lists who may send mail for your domain, DKIM publishes a signing key, and DMARC tells receivers what to do when SPF/DKIM fail. Misconfigure them and either your legitimate mail lands in spam, or spoofers send mail as you.

Every DNS record carries a TTL (time to live) in seconds — how long a resolver may cache it before asking again. A short TTL (say 300s) means changes propagate fast but generates more queries; a long TTL (say 86400s) means efficient caching but slow propagation. This is why you plan a TTL down before migrating a server: lower it hours ahead so the cutover propagates quickly.

Caching happens at every level — your browser, your OS, your recursive resolver — which is what makes DNS fast at planetary scale. It also means a wrong or malicious cached record can stick around until its TTL expires.

Classic DNS is sent in cleartext over UDP port 53: anyone on the path can see (and tamper with) your lookups. Two encryptions fix the privacy problem:

• DoT — DNS over TLS (port 853): wraps DNS in a dedicated TLS connection.
• DoH — DNS over HTTPS (port 443): tunnels DNS inside normal HTTPS, making it indistinguishable from web traffic.

Because DNS is trusted, unauthenticated by default, and sits in front of everything, it's a favorite target. The major attack families:

• Cache poisoning: tricking a recursive resolver into caching a forged record, so users are silently sent to the attacker's server. The 2008 Kaminsky attack showed how weak query randomization made this frighteningly easy, prompting emergency patching across the industry.
• Domain hijacking: taking control of a domain's registration or its NS records — often via a compromised registrar account — to redirect the entire domain.
• DNS-based DDoS: two flavors — flooding a DNS provider to knock names offline, and DNS amplification, where spoofed small queries trigger huge responses aimed at a victim.
• DGA (Domain Generation Algorithms): malware that algorithmically generates thousands of pseudo-random domain names to find its command-and-control server, making takedown a whack-a-mole.

The defensive counterweight is DNSSEC, which cryptographically signs records so resolvers can verify they weren't forged. It defeats poisoning but is unevenly deployed and doesn't provide confidentiality — that's DoT/DoH's job.