Every time you type a website address into your browser, an invisible system springs into action before a single pixel loads. That system is the Domain Name System, or DNS. It translates a name like "mediachannel.com.au" into a numeric address that computers can actually route traffic to. Without it, you'd need to memorise a string of numbers for every site you visit. DNS is why you don't.
What DNS actually does
Computers communicate using IP addresses: sequences of numbers like 142.250.70.46. Those numbers identify a specific server somewhere on the internet. But humans don't remember numbers well. DNS acts as the translator between the name you type and the address the network needs.
The name "Domain Name System" is accurate, if a little dry. Think of it as a phone book, except it's distributed across thousands of servers worldwide and it responds in milliseconds. When you request a page, your device consults DNS, gets the matching IP address, and connects. The whole process typically takes under 50 milliseconds.
How a DNS lookup works, step by step
A lookup isn't a single question sent to a single server. It's a short chain of queries, each handled by a different layer of the system.
First, your device checks its own memory. Operating systems cache recent DNS responses so they don't have to repeat the same query every few seconds. If the address is already stored locally, the process stops right there.
If not, the query goes to a recursive resolver: usually a server run by your internet service provider, or a public resolver like Cloudflare's 1.1.1.1. The recursive resolver does the legwork on your behalf.
The resolver first contacts a root nameserver. There are 13 sets of root nameservers distributed globally. They don't know the IP address of your destination site, but they know which nameserver is responsible for the relevant top-level domain, like ".com" or ".com.au".
That top-level domain nameserver then points the resolver to the authoritative nameserver for the specific domain you requested. The authoritative nameserver holds the actual DNS records for that domain and returns the IP address. The resolver passes it back to your device, and your browser connects.
DNS record types worth knowing
A domain's DNS records aren't just one thing. They're a collection of different entries, each serving a distinct purpose.
- A record: maps a domain name to an IPv4 address. The most common record type.
- AAAA record: the same, but for IPv6 addresses, which are longer and increasingly common as the internet expands.
- MX record: directs email for a domain to the correct mail server.
- CNAME record: creates an alias, pointing one domain name to another rather than to an IP address directly.
- TXT record: stores arbitrary text, often used to verify domain ownership or configure email security settings.
Website owners and IT administrators interact with these records directly when setting up hosting, configuring email, or moving a site to a new provider.
Why DNS matters for security
DNS is powerful precisely because it's trusted by default. That trust creates real risks. DNS spoofing (also called DNS cache poisoning) is an attack where a malicious actor inserts a fake record into a resolver's cache. Your device asks for a legitimate site and gets directed to a fraudulent one instead, without any visible warning.
This is one of the techniques behind phishing attacks. If you're curious about how phishing exploits these kinds of redirections, our guide on phishing explains the mechanics and how to spot warning signs before you're caught out.
To counter DNS spoofing, a protocol called DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that a response is genuine. Adoption has been slow, but it's growing.
A separate concern is privacy. Standard DNS queries are sent as plain text, which means your internet provider (and anyone monitoring the connection) can see every domain you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt those queries. Both Cloudflare and Google's public DNS support encrypted DNS, and many modern browsers now use DoH by default.
The relationship between DNS privacy and broader data protection concepts is worth understanding. Encryption is the same underlying technology that secures your DNS queries when you use DoH or DoT, and it's what stops those queries from being read in transit.
What happens when DNS breaks
DNS outages are rare but dramatic when they occur. In October 2021, a configuration error at a major DNS provider called Dyn took down large portions of the internet for several hours, affecting Twitter, Spotify, and Amazon, among others. The outage made clear how centralised DNS infrastructure had become, despite the system's distributed design.
On a smaller scale, most Australians have experienced a DNS failure at home without knowing it. When a router loses contact with its configured DNS resolver, websites stop loading even though the underlying internet connection is fine. Switching to a public resolver like 1.1.1.1 or 8.8.8.8 (Google's) often fixes the problem immediately.
Choosing a DNS resolver
Your device's default DNS resolver is typically assigned automatically by your internet provider. That's convenient, but it means your ISP has a complete log of every domain you query. For users who want more privacy or faster performance, switching to a third-party resolver is straightforward.
Cloudflare's 1.1.1.1 consistently ranks as one of the fastest public resolvers globally. Google's 8.8.8.8 is another widely used option. Both support encrypted DNS. Some routers let you configure this at the network level, covering every device in your home automatically.
Changing your DNS resolver doesn't change what websites you can access. It changes only which server handles the translation step, and who can see that translation happening.
DNS and the broader internet
DNS sits beneath almost every internet interaction, from loading a news article to sending an email to pulling data through an API. It's infrastructure in the most literal sense: the part of the system you only notice when it fails.
Understanding DNS doesn't require a networking background. The core idea is straightforward. Names are for humans. Numbers are for machines. DNS is the system that converts one into the other, fast enough that you never have to think about it.