Info & Theory
The Domain Name System (DNS) is the internet's phone
book: it maps human-readable names like
www.example.com to IP addresses such as
93.184.216.34. No single server holds every name —
the database is distributed in a hierarchy.
A recursive lookup
- Your device's stub resolver asks a recursive resolver (often your ISP or 1.1.1.1).
-
The resolver asks a root server, which points to the
.comTLD server. -
The TLD server points to the authoritative server for
example.com, which returns the IP.
Caching with TTL
Each answer carries a Time To Live (TTL). The resolver caches it, so repeat queries are answered instantly without walking the hierarchy again. When the TTL expires the entry is removed and the next query is a full lookup.
Why it matters
Caching is what keeps DNS fast and the root servers from being overwhelmed. A short TTL lets records change quickly (useful for failover); a long TTL maximises cache hits and reduces load.
Record types & iterative vs recursive
DNS carries many record types — A,
AAAA, MX, CNAME,
TXT. The resolver does iterative queries to
each server, while it gives your device a single
recursive answer.
Frequently asked questions
What is DNS?
DNS, the Domain Name System, is the internet's directory. It translates human-readable domain names like www.example.com into the numeric IP addresses computers use to connect.
What is a recursive DNS lookup?
A recursive lookup is when a resolver does all the work on your behalf: it queries the root, TLD and authoritative servers in turn and returns a single final answer to your device.
What is the order of DNS servers queried?
A stub resolver asks a recursive resolver, which asks a root server, then the relevant TLD server, then the authoritative server for the domain, which returns the IP address.
What is DNS caching?
Caching stores recent answers so repeat queries can be answered instantly without walking the server hierarchy again. It makes DNS fast and reduces load on upstream servers.
What is a TTL in DNS?
TTL, or Time To Live, is how long a cached record stays valid. After it expires the entry is removed and the next query triggers a fresh full lookup.
Why does the first lookup take longer?
The first lookup is a cache miss, so the resolver must contact the root, TLD and authoritative servers. Once cached, repeat queries for the same name are near-instant cache hits.
What is a root DNS server?
A root server sits at the top of the hierarchy. It does not know individual addresses but points the resolver to the correct top-level-domain server, such as the one for .com.
What is an authoritative DNS server?
An authoritative server holds the actual records for a domain. It is the final source of truth that returns the IP address for a name like example.com.
Should I use a short or long TTL?
A short TTL lets records change quickly, which helps failover but increases query load. A long TTL maximises cache hits and reduces load but makes changes propagate slowly.
What record types does DNS use?
Common types include A and AAAA for IPv4 and IPv6 addresses, MX for mail, CNAME for aliases and TXT for arbitrary text such as verification records.
About DNS Resolution — Recursive Lookup & Caching
This simulation models the Domain Name System (DNS), the distributed protocol that translates human-readable domain names such as www.example.com into numeric IP addresses. A full recursive lookup travels through four server tiers — stub resolver, recursive resolver, root server, TLD server, and authoritative server — and the simulation animates each message hop so you can watch exactly how an answer is found. You can also observe how a TTL-based cache short-circuits repeat queries, turning a multi-hop lookup into an instant cache hit.
DNS was designed in 1983 by Paul Mockapetris to replace a single centrally maintained HOSTS.TXT file that was growing too large to distribute reliably; today it handles trillions of queries per day and underpins every internet service from web browsing to email and VoIP.
Frequently Asked Questions
What is DNS and why does the internet need it?
DNS is the Domain Name System — the internet's phone book. Computers communicate using numeric IP addresses, but humans remember names, so DNS provides an automatic mapping between the two. Without it, every user would need to know the IP address of every site they wanted to visit, which is impractical as addresses change over time.
How do I use this simulation?
Type any domain name into the input field on the left, then click Lookup to watch a full animated recursive resolution play out on the canvas. Use Step to advance one message at a time so you can study each hop. After resolution the domain is cached; click Lookup again to see a fast cache hit. Use Flush cache to clear it and force a fresh full lookup. Adjust the TTL slider to control how long cached entries live, and the Speed slider to slow the animation down.
What is the difference between a cache hit and a cache miss?
A cache miss occurs when the recursive resolver has no stored answer for the queried name; it must contact the root, TLD, and authoritative servers before returning the IP, which typically adds 40–150 ms of round-trip latency. A cache hit occurs when a valid (non-expired) answer is already stored locally; the resolver returns it in just 2–5 ms without touching any upstream server. The simulation tracks both counts so you can see the speedup that caching provides.
How does the DNS hierarchy work technically?
The hierarchy has three levels below the recursive resolver. Root servers (there are 13 logical root server addresses, operated by organisations such as ICANN and Verisign, replicated to over 1,500 physical nodes via anycast) know nothing about individual domain names but point to the authoritative TLD servers. TLD servers (for .com, .uk, .org, etc.) hold NS records pointing to the authoritative name servers for each second-level domain. Authoritative servers hold the actual A, AAAA, MX, CNAME, and TXT records that resolve a name to a final value. The resolver performs iterative queries to each tier and collects referrals until it receives an authoritative answer.
Where is DNS used in real-world internet infrastructure?
Every internet action that uses a hostname triggers DNS. When you open a browser, send email, join a video call, or stream media, DNS runs silently in the background. CDN providers such as Cloudflare and Akamai use DNS to route users to the nearest edge node. Load balancers use DNS round-robin or weighted records to distribute traffic across servers. Cloud services use wildcard and CNAME records to map tenant subdomains dynamically. DNS is also exploited for email authentication (SPF, DKIM, DMARC all rely on TXT records) and for certificate validation (DNS-01 challenge in ACME/Let's Encrypt).
Does DNS expose my browsing to my ISP or anyone else?
Classic DNS queries travel in plaintext UDP over port 53, meaning your ISP, network operators, and anyone on the path can see every hostname you look up, even if the subsequent HTTPS connection is encrypted. This is a common misconception — many people assume HTTPS protects their DNS. Modern alternatives such as DNS over HTTPS (DoH, RFC 8484) and DNS over TLS (DoT, RFC 7858) encrypt the DNS conversation, preventing passive surveillance. Browsers like Firefox and Chrome use DoH by default to a trusted resolver when enabled.
Who invented DNS and when?
Paul Mockapetris designed DNS and published it in RFCs 882 and 883 in November 1983 while working at the USC Information Sciences Institute. The driving problem was the ARPANET's centrally maintained HOSTS.TXT file, which had to be manually downloaded by every host and was becoming unmanageable as the network grew past a few hundred nodes. DNS replaced it with a decentralised, hierarchical, automatically delegated system. The first operational root servers went live in 1984, and DNS has remained the internet's naming backbone ever since.
What other network simulations are related to DNS?
DNS sits within a broader networking and cryptography landscape. Hash functions underpin DNSSEC, the DNS security extension that digitally signs records to prevent cache poisoning — the SHA Hashing simulation on this site shows how those one-way functions work. Merkle Trees are used inside DNSSEC for authenticated denial-of-existence (NSEC3). BGP routing determines which physical path your DNS query travels across the internet, and packet routing simulations show how UDP datagrams are forwarded between routers before reaching a root server.
How is DNS used in modern cloud and DevOps engineering?
DevOps teams treat DNS as a first-class infrastructure concern. Short TTLs (30–60 s) are set before planned IP changes or failover events so that re-pointed records propagate quickly. Services such as AWS Route 53 and Cloudflare provide health-check-based failover that automatically removes unhealthy endpoints from DNS answers within seconds. Kubernetes uses CoreDNS as an in-cluster resolver so that service names like my-service.default.svc.cluster.local resolve to cluster-internal ClusterIP addresses without leaving the node. Split-horizon DNS lets internal and external clients receive different answers for the same name, enabling private network access.
What are the current frontier challenges in DNS research?
Active research areas include encrypted DNS at scale: deploying DoH and DoT universally while preserving operators' ability to apply security policies and parental controls. DNSSEC adoption remains low (around 20% of domains are signed) partly because key-rollover complexity and NSEC zone-enumeration risks deter operators. Oblivious DNS over HTTPS (ODoH) and DNS over QUIC (DoQ, RFC 9250) aim to further reduce latency and improve privacy. Researchers are also studying how AI-based classifiers can detect DNS tunnelling and data exfiltration hidden inside TXT or NULL record payloads, which are increasingly used by malware for command-and-control communication.