DNS

Every request in this section started after a name became an address. Type app.example.com into a browser and something has to turn that name into an IP the network can route to. The obvious design is a global phone book, one directory holding every name on the internet. The actual design is more interesting: the phone book is distributed, and no single server holds the whole thing.

The figure runs one lookup through the real chain. Your device does almost nothing: it asks its recursive resolver one question and waits. The resolver does the legwork, and the legwork is the lesson.

The resolver's cache starts empty, so it goes to a root server. Watch the reply carefully: it is not the answer. The root does not know app.example.com's address. It knows one thing, who handles .com, and replies with a referral: ask them. The .com TLD server does the same trick one level down: it does not know the address either, but it knows who runs example.com, and refers the resolver there. Only the third stop, example.com's authoritative server, actually knows, and it returns the answer: an IP, along with a TTL, a number of seconds the answer may be treated as fresh.

Count who knew the answer on that first run: four servers were asked, and exactly one knew. The other three each knew only the next link. That is the design. No global directory, just a hierarchy of delegation where every tier can point one level closer, so the system scales to the whole internet and each organization runs its own leaf.

Now run the lookup again and the whole apparatus disappears. The resolver cached the answer with its TTL, so the second run asks one server, the resolver itself, and comes back in two steps while root, TLD, and authoritative stay dark. This is why the internet is not crushed by name lookups: the busiest names resolve out of caches almost everywhere, and the hierarchy is only walked when a cache is cold. Now set the TTL slider low and wait. The countdown runs in real time, and once the entry ages out the next lookup walks the full chain again, identical to the first. TTL is the dial each domain owner sets between the two costs: a long TTL means fewer walks but slower propagation when the address changes; a short one means the opposite.

Honesty notes. This figure abbreviates on purpose. Real resolution has more caches in front of the resolver, your operating system and browser both keep their own; each tier is many redundant server instances rather than one box; names can chain through aliases before reaching an address; and A records, the name-to-IP kind shown here, are one of many record types. The chain itself, referral by referral down the hierarchy with the resolver doing the walking, is the standard model as specified in the DNS RFCs. The name is a reserved example domain and the IP is from a documentation range; neither points anywhere real.

Walking the resolver chain