DNS
Domain Name SystemDNS is the internet’s directory. People type names; machines route to numbers — DNS translates a name like example.com into the IP address a packet can actually reach. It is a distributed, hierarchical database that answers billions of lookups a second, almost always over a single small UDP exchange.
DNS turns a name you can read into an address a packet can reach — then caches the answer so it needn’t ask again.
Open the DNS lab →
Turning a name into an address: four questions, three referrals, one answer—then a warm cache that asks nobody.
How it works
Each level hands back a referral until the authoritative server gives the record. Every answer carries a TTL, so the whole walk usually happens once and then is served from cache.
What DNS does, step by step
Your device sends one small UDP query to a recursive resolver — often your ISP’s or a public one.
On a miss the resolver asks root, then the TLD, then the authoritative server — each a referral downward.
The authoritative server answers with the record type asked for — an A or AAAA address, an MX, a CNAME.
Every layer stores the answer for its time-to-live, so repeat lookups skip the walk entirely.
In cybersecurity
DNS is early in almost every connection and was designed with no authentication, which makes it both a prime target and a favourite covert channel.
A forged reply slips a wrong address into a resolver’s cache, sending everyone to the attacker’s host.
Signs records with a chain of trust from the root, so a resolver can detect tampering.
DNS over HTTPS/TLS encrypts the query itself, hiding which sites you look up from the network.
A tiny spoofed query provokes a large reply aimed at the victim — open resolvers make it worse.
Malware hides data inside seemingly innocent lookups to smuggle it past a firewall.
Stolen registrar credentials repoint a whole domain; registry locks and MFA are the defence.