NetFlow Lab/Protocol Labs/DNS
Simulated
Mission

Turn www.example.com into an address, starting from a resolver that knows nothing.

cache ladder, then the tree walk · the resolver returns to the middle every time0 of 3 servers asked
① FIRST — does anybody here already know this name?checked in order · the first HIT ends the whole lookupyou type www.example.comBROWSER CACHEinside Chromenothing has left the machine1OS CACHE + hostson the machinestill nothing on the wire2ROUTER (forwarder)192.168.1.1small cache — cannot walk3RESOLVER CACHE1.1.1.1big cache — and it can walk4② NOBODY KNEW — so the resolver walks the tree3 × ITERATIVE · RD=0 — every reply is only a pointerRECURSIVE RESOLVER1.1.1.1:53 · udpthe only box that walksCACHE— empty —ROOT · "."198.41.0.4knows who owns .com1TLD · ".com"192.5.6.30knows who owns example.com2AUTHORITATIVE · example.com198.51.100.5owns the record itself3the question is identical at every stop — only who is being asked changes
dig www.example.com · +trace—
no query sent yet — press ask below
dns_message · the question never changes
question (qname)
www.example.com

Byte for byte the same in every query — the resolver never rewrites it.

type / class
A / IN

An IPv4 address record. AAAA would ask for IPv6, MX for mail.

flags
RD=1

AA=0: not authoritative — expect a referral, not an address.

answer count
0

Zero so far. A referral carries authority records, not answers.

ttl
—

How long any resolver may cache this answer. Set by the zone owner.

transport
udp / 53

One small datagram each way. Over 512 bytes and DNS retries over TCP.

resolver_state
Resolver cache
IDLE
Browser cache — MISS
OS cache + hosts — MISS
Router forwarder — MISS, forwards on
Resolver cache — MISS, must walk
Root refers it to .com
.com refers it to example.com
The owner answers with the address
Answer cached for its TTL
Sent back down — every stop caches it
Think first · step 1 of 9

Before any packet leaves, where is the closest place this name might already be stored?

what just happened

No single machine knows where www.example.com lives. The name is split into labels, and each level of the tree knows only one thing: who to ask next. Four questions turn a name into an address.

cache cold · the resolver knows nothing yet
the common mistake

The query does not travel root → TLD → authoritative like a relay. It returns to the resolver every single time. Root never talks to the TLD server; it just says go ask them.

Two query types in one lookup: PC-1 asks recursively (RD=1 — give me the final answer), and the resolver then asks iteratively (RD=0 — tell me what you know, I’ll do the walking). Only the resolver walks.