Domain Name System

The Domain Name System, known as DNS, is the system that translates easy-to-remember website addresses, called domain names, such as example.com, into the numerical IP addresses that computers actually use to locate one another on the internet. Without DNS, anyone wanting to visit a website would need to memorize and type a string of numbers for every single site they wanted to reach, so DNS is often described as the internet’s phone book, matching human-friendly names to the machine-readable addresses hidden behind them.

How a Lookup Happens

When a device needs to find the IP address behind a domain name, it sends a request to a DNS resolver, typically operated by an internet service provider or a dedicated public DNS service, which attempts to answer the request either from its own cached memory of previous lookups or by querying other DNS servers. The DNS system as a whole is organized hierarchically, starting with a small set of root servers at the very top, which direct queries down to servers responsible for a specific top-level domain, such as .com or .org, which in turn direct queries to the specific authoritative server responsible for the exact domain being requested, such as example.com, which finally returns the correct IP address.

This hierarchical design, combined with extensive caching at every level, including inside individual devices, home routers, and internet service provider servers, allows DNS to handle an enormous global volume of lookups quickly, since a popular domain’s address is often already cached somewhere nearby rather than requiring a full round trip through the entire hierarchy every single time. Each cached answer carries a time-to-live value specifying how long it should be trusted before being looked up again, which balances the speed benefit of caching against the need to pick up changes if a domain’s address is ever updated.

Records, Registries, and Security

DNS stores more than just the basic address mapping. Different types of DNS records serve different purposes: an A record maps a domain to an IPv4 address, an MX record identifies which server should handle email for a domain, and a CNAME record lets one domain name point to another, among several other record types that together let a single domain coordinate web hosting, email delivery, and other services, sometimes across entirely different providers. Domain names themselves are managed through a global registration system, with organizations called registries overseeing each top-level domain and accredited registrars selling individual domain names to businesses and individuals who then configure DNS records to point their domain wherever they choose.

Because DNS was originally designed without built-in protection against tampering, it has historically been vulnerable to attacks that redirect users to malicious servers by providing a false answer to a DNS lookup, among other exploits. DNS Security Extensions, known as DNSSEC, address this by letting DNS responses be cryptographically signed, so a resolver can verify that an answer genuinely came from the correct authoritative source and was not altered in transit, and adoption of DNSSEC and related security measures has grown steadily as awareness of DNS-based attacks has increased across the industry.

From a Simple Text File to Global Infrastructure

Before DNS existed, the small number of computers connected to the early internet’s predecessor network relied on a single shared text file listing every known computer name and its corresponding address, manually updated and distributed to every machine on the network. That approach worked while the network stayed small, but it could not realistically scale as more computers joined, which led researchers to design DNS in the early 1980s as a distributed system where responsibility for different parts of the naming system could be delegated outward instead of managed from one central file.

That original design has scaled remarkably well, handling the DNS lookups behind billions of devices and an enormous number of registered domain names worldwide, still built on the same basic hierarchy of root, top-level domain, and authoritative servers established decades ago. Ongoing work on the system continues to focus on improving security against tampering and denial-of-service attacks, supporting newer top-level domains beyond the original handful, such as country-specific and more recently introduced generic domains, and improving performance through wider deployment of caching servers positioned closer to where lookups actually originate around the world.

Frequently Asked Questions

What happens when a website appears to be down but is actually just a DNS problem? If a DNS lookup fails or returns an outdated address, a browser may be unable to find the correct server even though the website itself is running normally, which is why clearing a device’s DNS cache or trying a different DNS resolver is a common troubleshooting step when a specific site will not load while others work fine.

Why is DNS described as hierarchical? Responsibility for answering DNS queries is spread across multiple levels, from root servers at the top down to top-level domain servers and finally the specific authoritative server for an individual domain, with each level directing a query one step closer to the correct final answer rather than any single server needing to know every domain on the internet.

What is DNSSEC and why does it matter? DNSSEC adds cryptographic signatures to DNS responses so a resolver can verify an answer actually came from the legitimate authoritative source and was not tampered with along the way, protecting users against certain attacks that would otherwise redirect them to a fraudulent server without their knowledge.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 2, 2026Researched and drafted with AI assistanceReport an issue