Innomerc Choose your depth. Learn at your own pace.
Understand it
The Domain Name System connects names with information such as IP addresses. When you open example.com, your device usually asks a resolver to find an address. The browser then connects to the service at that address; DNS does not carry the webpage itself.
A resolver can remember an answer for a limited time. That cache often avoids a complete lookup. In the visual, compare a cold lookup with a cache hit and notice which systems no longer need to be contacted.
Under the hood
For an uncached name, a recursive resolver can follow referrals from a root server to the top-level domain and then an authoritative server. The authoritative answer may contain A or AAAA records, or a CNAME that leads to another name. This simplified example omits aliases and DNSSEC validation.
TTL tells caches how long they may reuse a record. Different caches can expire at different moments. Negative responses can also be cached. A DNS lookup and an HTTP connection are separate operations; the browser can reuse an existing connection without repeating both.
Practitioner perspective
Distinguish the recursive resolver’s logs from authoritative DNS logs. Neither alone tells the whole user journey. DNS telemetry can help identify suspicious destinations, but shared hosting, changing addresses and encrypted DNS complicate attribution.
DNSSEC authenticates DNS data when properly validated; it does not encrypt queries. DoH and DoT protect transport to a resolver, but do not independently prove that the returned DNS data is authoritative. Resolver trust, endpoint policy and validation remain separate decisions.
DNS
The Domain Name System connects names with information such as IP addresses. When you open example.com, your device usually asks a resolver to find an address. The browser then connects to the service at that address; DNS does not carry the webpage itself.
Illustrated analogy · Select the image to enlargeWatch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
A name becomes an address
Follow the resolver through referrals and watch a cached answer bypass the hierarchy.
This simplified recursive lookup starts without useful cached answers or referrals.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- Browser
The program you use to open websites.
Example: Your browser requests a web page and displays the response.
- Resolver
A DNS service that finds address information on behalf of your device.
Example: It checks its cache or asks DNS servers where to find a website.
- Root DNS
The top level of DNS that points a resolver toward the relevant top-level domain servers.
Example: For a .com name, it provides a referral toward .com DNS servers.
- TLD DNS
DNS servers for a top-level domain, such as .com, that provide referrals to authoritative servers.
Example: The resolver learns which servers handle the requested domain.
- Authoritative
The DNS server responsible for answering with records for a particular zone.
Example: It supplies the configured address record for a name in that zone.
Cold lookup
This simplified recursive lookup starts without useful cached answers or referrals.
- Browser Resolver: example.com?. The client asks its configured resolver.
- Resolver Root DNS: Where is .com?. The resolver asks the root for a referral.
- Root DNS Resolver: TLD referral. Root supplies referral information, not the final website address.
- Resolver TLD DNS: example.com?. The resolver asks the TLD server.
- TLD DNS Resolver: NS referral. The resolver learns the authoritative service.
- Resolver Authoritative: A / AAAA?. The resolver asks for the address record.
- Authoritative Resolver: Address + TTL. The answer can be retained for its TTL.
- Resolver Browser: Address. The browser can begin connecting to the destination.
Warm cache
A valid cached answer avoids another trip through the DNS hierarchy.
- Browser Resolver: example.com?. The client requests the same name.
- Resolver Browser: Cached address. The remaining TTL permits reuse.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Browser
The device needs an address for example.com.
Read every step without animation
Cold lookup
- Browser. The device needs an address for example.com.
- Resolver. The configured resolver has no usable cached answer.
- Root. A root server refers the resolver to the .com servers.
- .com TLD. A TLD server identifies the authoritative DNS servers.
- Authoritative DNS. The authoritative server returns the relevant record and TTL.
- Answer. The resolver returns and caches the address.
- Web server. The browser can now establish a connection to the destination.
DNS finds an address; a separate connection retrieves the page.
Cache hit
- Browser. The same name is requested before the cached record expires.
- Resolver cache. A still-valid cached answer is available.
- Answer. The resolver replies without walking the hierarchy.
- Web server. The client connects to the service.
A cache hit saves DNS work without changing what the name means.
Explore deeper: additional experiment
Follow a resolver decision
A still-valid cached answer avoids an authoritative lookup. A later change at the authority is not necessarily visible until this TTL expires.
A local teaching model with fictional inputs. It does not test a live system.
Attack view
A misleading DNS answer can point a client toward the wrong destination. HTTPS certificate validation remains an additional boundary; changing an address does not automatically produce a valid certificate for the requested name.
Defender view
- Use trusted resolvers and maintain correct authoritative records.
- Validate DNSSEC where appropriate and protect registrar and DNS administration accounts.
- Correlate suspicious DNS activity with endpoint and connection evidence.
Common mistakes
- A resolver cache hit does not contact every server in the hierarchy.
- DNSSEC and encrypted DNS solve different problems.
Check your understanding
Active recall: explain this idea in 30 seconds
The Domain Name System connects names with information such as IP addresses. When you open example.com, your device usually asks a resolver to find an address. The browser then connects to the service at that address; DNS does not carry the webpage itself.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.