Art of Codeartofcode
Lesson 4 of 15

4. DNS

1
The picture to keep in your head
2
4.1 Why do we need names at all?
3
4.2 What are the parts of a domain name?
4
4.3 What happens, step by step, when a name is looked up?
5
4.4 What kinds of DNS records are there?
6
4.5 What is a TTL, and why does DNS cache so much?
7
4.6 How can DNS spread users across servers or send them to the nearest one?
8
4.7 Why do DNS changes "take time to propagate"?
9
4.8 What happens when DNS fails?
10
Memory card and where the analogy breaks
11
Practice: five levels
12
Interview questions
13
Solutions
14
Sources
15
Code lab
4. DNS

4.3 What happens, step by step, when a name is looked up?

3 min read+10 XP

In your phone's contacts: You check your own contacts first. Not there? You ask a helpful friend. Your friend doesn't know the number either, but knows where to start: a master directory says "for that kind of number, ask this directory"; that directory says "for that person, call their office"; and the office gives the real number. Your friend tells you, and both of you save it.

In the system:

one DNS lookup with an empty cache: laptop, resolver, root, TLD, authoritative.

Figure: your laptop asks one question. The resolver does the walking and remembers the answer for next time.

  1. Local caches first. The browser checks its own cache, then the operating system's (which also checks the hosts file). A hit here means no network at all.
  2. Ask the recursive resolver. Your device sends the question to a recursive resolver: usually your ISP's or your company's, or a public one like Google's 8.8.8.8 or Cloudflare's 1.1.1.1. It promises to come back with the final answer.
  3. The resolver asks a root server. "Where's shop.example.com?" The root replies with a referral: "I don't know, but here are the .com servers."
  4. The resolver asks a .com TLD server. Another referral: "here are the name servers for example.com" (for example ns1.example.com).
  5. The resolver asks the authoritative server. ns1.example.com owns the answer: "shop.example.com is 203.0.113.20, valid for 300 seconds."
  6. The answer comes back and is cached by the resolver, the operating system and the browser.

Two words interviewers use:

  • Recursive query: your device asks once and expects the full answer (steps 2 and 6).
  • Iterative queries: the resolver follows the referrals itself, one server at a time (steps 3 to 5).

Why it's usually fast: the resolver serves thousands of users, so popular answers (and the root and .com referrals) are almost always in its cache already. A full walk from scratch is the rare case.

DNS questions usually travel over UDP on port 53, because one small question and answer don't need a connection (Chapter 3, 3.7). Large answers switch to TCP, and encrypted options exist too (DNS over HTTPS and DNS over TLS).

Memory code: "Nobody knows everything; everyone knows who to ask next." Cache, resolver, root, TLD, owner.