DNS and how domain resolution works in HLD - Deep Dive

Overview - DNS and how domain resolution works

What is it?

DNS stands for Domain Name System. It is like the phonebook of the internet that translates easy-to-remember domain names like example.com into IP addresses that computers use to find each other. When you type a website name in your browser, DNS helps your device find the exact server to connect to. This process is called domain resolution.

Why it matters

Without DNS, we would have to remember long strings of numbers (IP addresses) for every website, which is hard and error-prone. DNS makes the internet user-friendly and scalable by allowing names instead of numbers. It also helps route traffic efficiently and supports services like email and security.

Where it fits

Before learning DNS, you should understand basic internet concepts like IP addresses and how computers communicate over networks. After DNS, you can explore related topics like load balancing, CDN (Content Delivery Networks), and security features like DNSSEC.

Mental Model

Core Idea

DNS is a global, distributed directory that translates human-friendly domain names into machine-friendly IP addresses to connect devices on the internet.

Think of it like...

DNS is like a phonebook where you look up a person's name to find their phone number before calling them.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ User's Device │──────▶│ DNS Resolver  │──────▶│ Root DNS Server│
└───────────────┘       └───────────────┘       └───────────────┘
                              │                        │
                              ▼                        ▼
                      ┌───────────────┐       ┌───────────────┐
                      │ TLD DNS Server│──────▶│ Authoritative │
                      └───────────────┘       │ DNS Server   │
                                              └───────────────┘

Build-Up - 7 Steps

1

Foundation

What is DNS and Why It Exists

Concept: Introduce DNS as the system that maps domain names to IP addresses.

Every device on the internet has an IP address, a unique number like 192.0.2.1. Humans find these numbers hard to remember, so DNS was created to translate easy names like 'example.com' into IP addresses. This makes browsing the internet simple and intuitive.

Result

You understand that DNS is essential for converting names to numbers so devices can communicate.

Understanding that DNS solves the problem of remembering IP addresses helps you see why it is fundamental to the internet's usability.

2

Foundation

Basic Components of DNS

Concept: Learn about the main parts involved in DNS resolution: domain names, DNS servers, and IP addresses.

DNS involves several key players: the user's device, DNS resolvers (usually provided by your ISP), root servers, top-level domain (TLD) servers (like .com or .org), and authoritative servers that hold the actual IP address for a domain. Each plays a role in finding the right IP.

Result

You can name and describe the roles of the main DNS components.

Knowing the roles of each DNS component prepares you to understand how they work together in the resolution process.

3

Intermediate

Step-by-Step Domain Resolution Process

🤔Before reading on: do you think your device asks the website server directly for its IP address or uses other servers first? Commit to your answer.

Concept: Explain the multi-step query process from the user's device to the authoritative DNS server.

When you enter a domain, your device asks a DNS resolver. If the resolver doesn't know the IP, it asks a root server, which points it to the TLD server. The TLD server then directs it to the authoritative server for the domain, which returns the IP address. The resolver sends this back to your device.

Result

You understand the chain of queries that happen behind the scenes to find an IP address.

Understanding the multi-step query process reveals why DNS is fast and scalable despite being distributed globally.

4

Intermediate

Caching in DNS Resolution

🤔Before reading on: do you think DNS servers ask the root server every time for the same domain? Commit to your answer.

Concept: Introduce caching to improve speed and reduce load on DNS servers.

DNS resolvers and devices store (cache) IP addresses for a time called TTL (Time To Live). This means if you visit a site again soon, your device or resolver can answer immediately without repeating the full lookup process. Caching reduces delays and traffic.

Result

You know how caching speeds up domain resolution and reduces network load.

Recognizing caching's role explains why DNS queries are usually very fast and efficient.

5

Intermediate

Types of DNS Records

🤔Before reading on: do you think DNS only stores IP addresses? Commit to your answer.

Concept: Learn about different DNS record types beyond just IP addresses.

DNS stores various records: A and AAAA for IPv4 and IPv6 addresses, CNAME for aliases, MX for mail servers, TXT for text info, and more. These records enable different internet services to work using domain names.

Result

You understand that DNS is a flexible system supporting many internet functions.

Knowing DNS record types helps you appreciate DNS as more than just a name-to-IP translator.

6

Advanced

DNS Security and DNSSEC

🤔Before reading on: do you think DNS responses can be trusted by default? Commit to your answer.

Concept: Explain how DNSSEC adds security to prevent fake or tampered DNS responses.

DNSSEC adds digital signatures to DNS records so resolvers can verify the data's authenticity. This prevents attackers from redirecting users to fake sites by spoofing DNS responses. DNSSEC is a critical security layer for trust on the internet.

Result

You understand how DNSSEC protects users from DNS attacks.

Understanding DNSSEC reveals the importance of securing DNS to maintain internet trust and safety.

7

Expert

Recursive vs Iterative Queries and Resolver Behavior

🤔Before reading on: do you think DNS resolvers always ask servers in the same way? Commit to your answer.

Concept: Distinguish between recursive and iterative queries and how resolvers optimize lookups.

In recursive queries, the resolver does all the work to find the IP and returns the final answer to the client. In iterative queries, servers respond with the best info they have, and the client continues querying. Resolvers use caching and parallel queries to speed up resolution and reduce load.

Result

You grasp how DNS resolvers manage queries efficiently and the difference between query types.

Knowing query types and resolver strategies explains how DNS balances speed, load, and reliability in real-world use.

Under the Hood

DNS works as a distributed database spread across many servers worldwide. When a query arrives, the resolver checks its cache first. If missing, it contacts root servers, which direct it to TLD servers, which then point to authoritative servers holding the domain's records. Each server responds with referrals or answers. Responses include TTL values for caching. DNS uses UDP mostly for speed but can use TCP for larger responses. DNSSEC adds cryptographic signatures to ensure data integrity.

Why designed this way?

DNS was designed as a hierarchical, distributed system to avoid a single point of failure and to scale globally. Early internet growth required a system that could handle millions of queries efficiently. Centralized directories would be slow and fragile. The hierarchy allows delegation of responsibility, and caching reduces repeated work. Security was added later (DNSSEC) as attacks increased.

┌───────────────┐
│ User Device   │
└──────┬────────┘
       │ Query
       ▼
┌───────────────┐
│ DNS Resolver  │
└──────┬────────┘
       │ Cache hit?
       ├─Yes──▶ Return IP
       └─No───▶ Query Root Server
               │
               ▼
       ┌───────────────┐
       │ Root Server   │
       └──────┬────────┘
              │ Referral to TLD Server
              ▼
       ┌───────────────┐
       │ TLD Server    │
       └──────┬────────┘
              │ Referral to Authoritative Server
              ▼
       ┌───────────────┐
       │ Authoritative │
       │ Server       │
       └──────┬────────┘
              │ IP Address
              ▼
       ┌───────────────┐
       │ DNS Resolver  │
       └──────┬────────┘
              │ Return IP
              ▼
       ┌───────────────┐
       │ User Device   │
       └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does DNS always return the same IP address for a domain? Commit to yes or no.

Common Belief: DNS always returns a single fixed IP address for a domain.

Reality: DNS can return different IP addresses for the same domain based on load balancing, geographic location, or failover setups.

Why it matters: Assuming a fixed IP can cause confusion when troubleshooting or designing systems that rely on DNS for traffic distribution.

Quick: Do you think DNS queries are always secure and cannot be tampered with? Commit to yes or no.

Common Belief: DNS responses are always trustworthy and cannot be altered by attackers.

Reality: DNS responses can be spoofed or intercepted unless DNSSEC or other protections are used.

Why it matters: Ignoring DNS security risks can lead to users being redirected to malicious sites, causing data theft or fraud.

Quick: Does your device always ask the root server directly for every domain lookup? Commit to yes or no.

Common Belief: Every DNS query starts fresh by asking the root server.

Reality: Most queries are answered from cache at the resolver or device level, reducing the need to contact root servers frequently.

Why it matters: Misunderstanding caching leads to overestimating DNS query times and network load.

Quick: Is DNS only about translating domain names to IP addresses? Commit to yes or no.

Common Belief: DNS only stores IP addresses for domain names.

Reality: DNS stores many types of records like MX for email, TXT for verification, and CNAME for aliases.

Why it matters: Thinking DNS is only for IP addresses limits understanding of its full role in internet services.

Expert Zone

1

DNS resolvers implement complex retry and timeout strategies to handle unreliable networks and improve user experience.

2

Some DNS servers use Anycast addressing to route queries to the nearest server instance, improving speed and resilience.

3

DNS responses can be manipulated by middleboxes or ISPs for content filtering or censorship, which complicates trust models.

When NOT to use

DNS is not suitable for real-time or highly dynamic service discovery where IPs change very frequently; alternatives like service registries or dedicated discovery protocols (e.g., Consul, etcd) are better.

Production Patterns

Large-scale systems use layered DNS caching, geo-DNS for directing users to nearest data centers, and DNS-based load balancing. DNS is also integrated with CDNs and cloud providers to optimize content delivery and failover.

Connections

Content Delivery Networks (CDN)

DNS is used by CDNs to direct users to the closest or best-performing server.

Understanding DNS helps grasp how CDNs optimize web content delivery by resolving domains to different IPs based on location.

Public Key Infrastructure (PKI)

DNSSEC uses cryptographic signatures similar to PKI to secure DNS data.

Knowing PKI concepts clarifies how DNSSEC ensures authenticity and integrity of DNS responses.

Telephone Directory Systems

DNS functions like a global phonebook, mapping names to numbers.

Recognizing this connection shows how hierarchical, distributed directories solve large-scale lookup problems in different fields.

Common Pitfalls

#1 Ignoring DNS caching and expecting every query to be slow.

Wrong approach:

Always querying root servers for every domain lookup without caching.

Correct approach:

Use caching at resolvers and clients to store DNS responses for the TTL duration.

Root cause:

Misunderstanding how DNS caching works leads to inefficient designs and poor performance.

#2 Assuming DNS responses are secure by default.

Wrong approach:

Not implementing DNSSEC or other protections in critical systems.

Correct approach:

Deploy DNSSEC to validate DNS responses and prevent spoofing.

Root cause:

Underestimating DNS security risks exposes systems to attacks like cache poisoning.

#3 Using DNS as the sole method for service discovery in dynamic environments.

Wrong approach:

Relying on DNS for rapidly changing IP addresses without additional mechanisms.

Correct approach:

Use dedicated service discovery tools designed for dynamic environments.

Root cause:

Not recognizing DNS's limitations in handling frequent IP changes causes reliability issues.

Key Takeaways

DNS is the internet's directory that translates human-friendly names into IP addresses so devices can connect.

The DNS system is hierarchical and distributed, involving root, TLD, and authoritative servers working together.

Caching is essential in DNS to speed up lookups and reduce network traffic.

DNS supports many record types beyond IP addresses, enabling diverse internet services.

Security extensions like DNSSEC are critical to protect users from fake or malicious DNS data.

Practice

1. What is the main purpose of DNS in internet communication?

easy

A. To translate domain names into IP addresses

B. To store website content

C. To encrypt internet traffic

D. To manage email delivery

Solution

1. Step 1: Understand DNS role

   DNS stands for Domain Name System and its main job is to convert human-friendly domain names into IP addresses computers use.

2. Step 2: Identify correct function

   Among the options, only translating domain names to IP addresses matches DNS's core function.

3. Final Answer:

   To translate domain names into IP addresses -> Option A

4. Quick Check:

   DNS = domain to IP translation [OK]

Hint: DNS converts names to IPs, not content or encryption [OK]

Common Mistakes:

• Confusing DNS with web hosting
• Thinking DNS encrypts data
• Mixing DNS with email servers

2. Which of the following is the correct order of DNS resolution steps when a user types a domain name?

easy

A. Root server -> TLD server -> Authoritative server

B. Authoritative server -> Root server -> TLD server

C. TLD server -> Root server -> Authoritative server

D. Local cache -> Authoritative server -> Root server

Solution

1. Step 1: Recall DNS resolution hierarchy

   DNS resolution starts at the root server, then goes to the TLD (Top-Level Domain) server, and finally to the authoritative server for the domain.

2. Step 2: Match the correct sequence

   Root server -> TLD server -> Authoritative server correctly lists the order: Root -> TLD -> Authoritative.

3. Final Answer:

   Root server -> TLD server -> Authoritative server -> Option A

4. Quick Check:

   Resolution order = Root, TLD, Authoritative [OK]

Hint: DNS starts at root, then TLD, then authoritative [OK]

Common Mistakes:

• Mixing up the order of servers
• Starting resolution at authoritative server
• Ignoring the root server step

3. Consider this simplified DNS resolution code snippet:

cache = {"example.com": "93.184.216.34"}

query = "example.com"

if query in cache:
    ip = cache[query]
else:
    ip = "198.51.100.1"  # IP from authoritative server

print(ip)

What will be the output when this code runs?

medium

A. 198.51.100.1

B. example.com

C. 93.184.216.34

D. KeyError

Solution

1. Step 1: Check if query is in cache

   The query is "example.com" which exists in the cache dictionary with IP "93.184.216.34".

2. Step 2: Determine printed IP

   Since the query is found in cache, the code assigns ip = cache[query] which is "93.184.216.34" and prints it.

3. Final Answer:

   93.184.216.34 -> Option C

4. Quick Check:

   Cache hit returns cached IP [OK]

Hint: If domain in cache, output cached IP [OK]

Common Mistakes:

• Assuming authoritative IP prints always
• Confusing key and value in dictionary
• Expecting error if key exists

4. A DNS resolver is not returning the correct IP address for a domain. Which of the following is the most likely cause?

medium

A. The domain name is misspelled in the URL

B. The root server is unreachable but TLD server works

C. The authoritative server is down but cache is fresh

D. The local DNS cache has outdated information

Solution

1. Step 1: Analyze DNS caching impact

   If the local DNS cache holds old IP data, the resolver returns outdated IP even if authoritative server changed.

2. Step 2: Evaluate other options

   Misspelled domain would cause failure, not wrong IP. Authoritative down with fresh cache returns correct IP. Root unreachable but TLD working is unlikely scenario causing wrong IP.

3. Final Answer:

   The local DNS cache has outdated information -> Option D

4. Quick Check:

   Outdated cache causes wrong IP [OK]

Hint: Old cache causes wrong IP, refresh fixes it [OK]

Common Mistakes:

• Ignoring cache as source of error
• Assuming authoritative server always reachable
• Confusing root and TLD server roles

5. You want to design a scalable DNS system for a global service. Which approach best improves DNS resolution speed and reduces load on authoritative servers?

hard

A. Use a single global authoritative server for all domains

B. Implement multiple caching layers including local resolver and CDN caches

C. Direct all DNS queries only to the authoritative servers

D. Disable caching to always get fresh IP addresses

Solution

1. Step 1: Understand scalability needs

   To handle many users globally, caching at multiple layers reduces repeated queries to authoritative servers and speeds up responses.

2. Step 2: Evaluate options for load and speed

   Direct queries to authoritative servers increase load and latency. Single global server is a bottleneck and risk. Disabling caching slows resolution and increases load.

3. Final Answer:

   Implement multiple caching layers including local resolver and CDN caches -> Option B

4. Quick Check:

   Multi-layer caching improves speed and scalability [OK]

Hint: Use caching layers to scale DNS efficiently [OK]

Common Mistakes:

• Ignoring caching benefits
• Centralizing authoritative servers causing bottlenecks
• Disabling caching for freshness without tradeoff