DNS
In plain English
Plain definition
DNS (Domain Name System) is the distributed, hierarchical naming service that resolves human-readable domain names into IP addresses and other resource records, underpinning almost all Internet and enterprise network service discovery.
Technical Definition
DNS is a distributed, hierarchical database standardised through the RFC Series published by the RFC Editor. It is organised into zones, each managed by one or more authoritative name servers responsible for a portion of the namespace. Clients issue queries, typically over UDP or TCP on port 53, which are handled by recursive resolvers. A resolver walks the hierarchy from root servers, to top-level-domain servers, to the authoritative servers for the target zone, caching results according to the time-to-live (TTL) value on each record. Common record types include A and AAAA (address mappings), CNAME (aliasing), MX (mail routing), NS (delegation), TXT (arbitrary text, often used for verification or policy) and SOA (zone authority metadata).
Operational Relevance
DNS availability and correctness are foundational to service reliability: an outage or misconfiguration at any layer of the resolution chain can make an otherwise healthy service unreachable. Operations teams rely on DNS for service discovery, traffic steering, failover and certificate validation. TTL values directly influence how quickly a change propagates, and low TTLs increase query load while high TTLs slow recovery from record changes.
Architecture Relationship
DNS sits alongside, not inside, the TCP/IP transport layers described elsewhere in this lexicon: it resolves names before a TCP or UDP connection is attempted. It interacts closely with load balancers, content delivery networks and container orchestration platforms, many of which use DNS-based service discovery internally. Transport security protocols such as TLS depend on DNS-resolved hostnames for certificate matching, making DNS an implicit trust input to higher-layer security decisions.
Example
A bounded, read-only way to observe DNS resolution in a non-production or isolated environment is to query a name server directly and inspect the response, without making any state change:
dig +short example.com A
93.184.216.34This shows the resolver returning a single A record. Repeating the query with the +trace option reveals the full chain from root to authoritative server, which is useful when diagnosing resolution failures.
Misunderstanding
A frequent misunderstanding is that DNS changes take effect immediately everywhere; in practice, cached records persist for their TTL duration at resolvers and clients, so propagation can take minutes to days depending on configuration. Another common error is treating DNS as inherently secure: standard DNS responses are not authenticated, and integrity depends on separate mechanisms such as DNSSEC, which are not enabled by default in every deployment.
Related Terms
- Resolver
- Authoritative name server
- Zone and SOA record
- DNSSEC
- TTL (time to live)
- CNAME record
Further Reading
The RFC Editor maintains the RFC Series, the authoritative publication channel for Internet technical specifications, including those defining DNS. Readers requiring exact protocol behaviour for a specific implementation should confirm the relevant current RFC text and the vendor documentation for their resolver or authoritative server software before making operational changes.