# How DNS Resolution Works ## Introduction When you type `google.com` on your browser and get results within a few seconds, you might think that the browser is directly connected to the Google server. If you do, then you are totally wrong. A lot can happen in those few seconds. Let me explain what happens then: You pick up your phone or laptop, type [`www.google.com`](http://www.google.com) and click enter. After that, the browser sends a request to the **DNS (Domain Name System)** to find the **IP (Internet Protocol)** address of Google. However, there is a lot going on between **DNS** and **IP**, such as **Recursive DNS Server, Root Server, TLD Server**, and **Authoritative Server**. Basically, DNS translates **domain names** (like [google.com](http://google.com)) into **IP addresses**. Here is an example, How many of us remember every phone number we save on our smartphones? Maybe two or three. It’s really hard to remember every number, so what do we do? We save them by the person’s name. We just search for the name on our phone and find it easily. DNS also works in a similar way. ## **What is DNS** The DNS stands for **Domain Name System.** It is the phonebook of the internet, just like we save numbers in our devices. So, people like us search for information simply by website names (example, [`google.com`](http://google.com), [`youtube.com`](http://youtube.com)), but you know that the name of a website is called a **domain name**. The job of DNS is to convert **Domain names** into **IP addresses**. But wait, do we know what **IP addresses** are? Let me explain, ### IP (Internet Protocol) Addresses An IP (Internet Protocol) address is the unique identifying number assigned to every device connected to the internet. Just like you need the address of your home to receive parcels, Internet-connected devices need an IP address to receive messages. When a computer sends a message to another computer, it must specify the recipient's IP address and also include its own IP address so that the second computer can reply. ## Why DNS name resolution exists? Because it is easy to remember names (like [`google.com`](http://google.com)) rather than computers using numerical IP addresses (like `142.250.190.46`) to locate resources. * Usability for humans: we use domain names rather than those long strings of numbers (IP addresses). * Computer communication: computers and networking devices can communicate using each other's IP addresses. * Scalability and flexibility: a domain name can be moved to a new server with new IP addresses, without worrying about users. ## What is the `dig` command and when it is used The `dig` command **(Domain Information Groper)** is a powerful command-line tool used to resolve DNS name servers. When you type URL in your browser, the DNS lookup happen in behind the scenes, so the `dig` command allows as to look up manually. **The usage of** `dig` **is:** * It gives us detailed information about how a domain name is converted into IP addresses. * When you change the IP address of your website or switch hosting, you can verify by using the `dig` command to check if the new record has reached the DNS server or not. * If your website is not loading, you can check if there is a problem in the domain’s DNS or in the web server. For Example: ```bash dig google.com ``` This command finds the address record of [`google.com`](http://google.com). Computers cannot communicate using domain names like [`google.com`](http://google.com), so they need numerical IP addresses to route to the server. Example: * Domain Name: google.com and Sub-Domain: www * IP Address: 142 . 250 . 190 . 46 ## DNS resolution happens in layers **Root → TLD → Authoritative servers:** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769160114535/966e4be4-3815-4d59-9c2c-9b97711c0240.png align="center") ## Understanding of DNS Hierarchy: When you type a URL (like `google.com`) into your browser, the "Resolution" start processing by following hierarchy: * **Recursive Resolver:** The job of the resolver is to do the legwork; it doesn’t know the answer but it knows who to ask. * **Root Nameserver:** The Resolver first hits the root name server. There are 13 root servers. They don’t store the IP addresses; they store the location of TLD name servers. So basically, TLD is in charge of `.com`, `.in`, etc. * **TLD Nameserver:** Now, the resolver heads to the TLD servers. It has the records for every registered `.com`. So the specific records for [`google.com`](http://google.com) are managed by a specific **Authoritative Nameserver** at this address. * **Authoritative Nameserver:** This is the "final stop" that actually holds the IP address record. It gives the resolver the IP, which is then passed back to your browser. ## The `dig . NS` and root name servers The **root servers** are the first stop in this hierarchical journey and the ( . ) represents the root. ```bash dig . NS ``` **OUTPUT:** * **Question section:** It confirms the Name Servers (NS) for the root ( . ). * **Answer Section:** It gives the list of 13 root servers. * **TTL (Time to Live)** -371660 seconds. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769153020655/4b102587-2ccc-4f1e-8c5c-3089a98d7acb.png align="center") * **Additional section:** It shows the IP addresses (IPv4 and IPv6) of 13 root servers. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769154074309/88aad045-c5f4-4276-b724-1df4b6385c44.png align="center") So when you run the `dig . NS` command, your computer asks the root servers where the server of [`google.com`](http://google.com) is. Then the root server replies, "I don't know where the server of `google` is, but here is the IP for the `.com` **Top-Level Domain (TLD)** server." ## The `dig com NS` and TLD name servers To find the records for `.com` are managed by a specific **Authoritative Nameserver** at this address. ```bash dig com NS ``` **OUTPUT:** * This is lists of name servers, Like `a . gtld-servers . net` * **gTLD** Stands for **Generic Top-Level Domain**. These servers handle like `.com`, `.net`, etc. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769154818973/fe286644-1d49-4282-bd1c-2f86a7f486be.png align="center") So these name servers do not know the IP address of the website; they only know the **Authoritative Name Servers**, for example, Cloudflare or GoDaddy. ## The `dig` [`google.com`](http://google.com) `NS` and Authoritative Name Servers To find the authoritative name servers for a domain. ```bash dig google.com NS ``` **OUTPUT:** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769156888212/fdfccba1-8c8e-47be-916e-ef33b7775dc6.png align="center") ## The `dig` [`google.com`](http://google.com) and the full DNS Resolution Flow This return the A record (the IPv4 addresses) for a domain. ```bash dig google.com ``` **OUTPUT:** * The DNS query was successfully resolved and the domain exists (Status: NOERROR). * It gives us the actual IP address of [`google.com`](http://google.com) (`142.250.195.46`). * A records were returned (the IPv4 address). * How much time it takes to resolve the query (13 milliseconds). * **The TTL (Time to Live)** -253 seconds. It tells your computer how long to remember (cache) this result before asking again. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769157452788/a79eee90-bf9e-4cb3-820d-c9838fd5048c.png align="center") ## The Role of Recursive Resolvers Think of a **Recursive Resolver** as the personal assistant of the internet. When you type a URL like [`google.com`](http://google.com) into your browser, your computer doesn't actually know where that website lives. It only knows how to talk to a resolver. * The recursive resolver’s job is to do the "legwork" of hunting down the correct IP address so your browser can load the page. * The resolver performs a multi-step search (Root → TLD → Authoritative). * It stores previously found IP addresses in its local memory to manage cache results. * This significantly reduces the time it takes to load popular websites for everyone using that resolver. ### **DNS resolution flow for** [`google.com`](http://google.com) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769166902079/8f726d48-3732-4ea4-b92f-fda5406d6a41.png align="center") ## What NS records represent and why they matter NS stands for Name Server. An NS record is a phonebook of the internet, so basically NS records tell the Internet where to go to find out a domain's IP addresses. **Why they matter,** You always need to have a minimum of two NS records to prevent your site from going offline. If one name server goes down, the second is always available to handle requests. It stores all DNS records for a domain, including A records, MX records, or CNAME records. ## Conclusion In conclusion, DNS (Domain Name System) is an essential component of the internet, acting as its phonebook by translating human-friendly domain names into numerical IP addresses that computers use to communicate. This process involves multiple layers, including **Recursive Resolvers, Root Servers, TLD Servers,** and **Authoritative Servers**, to efficiently resolve domain names. Tools like the `dig` command help in understanding and troubleshooting DNS queries, ensuring seamless internet navigation and connectivity.