How DNS finds a website
The internet's phone book, walked end to end: your own caches, the resolver that does the legwork, the root and dot com servers, and the countdown that decides how long the world remembers an answer.
Your laptop
Every website has a name you can remember and a number the network actually uses. Nothing on the internet routes by name, so before anything else your device has to turn one into the other.
Browser and system caches
The first stop is memory. Your browser keeps a small table of recent answers and the operating system keeps another beneath it. A name you looked up a minute ago never leaves your laptop at all.
Home router
If nothing local matches, the question goes to the router in your hallway, which usually forwards it straight to your internet provider's resolver. Plenty of people override that setting and point at a public resolver instead.
Recursive resolver
The recursive resolver does the real legwork. Your laptop asks one simple question and waits, while the resolver may make three or four separate journeys across the internet to find the answer, all in a few dozen milliseconds.
Resolver cache
First it checks its own cache, and this is where the whole system wins. A resolver serving a million people already knows every popular name, so the great majority of lookups never travel any further than this machine.
Root name server
For a genuinely unknown name it starts at the top. There are only thirteen root server addresses in the entire world, and every resolver has them written in from birth, because you have to begin somewhere you already trust.
One address, many machines
Thirteen addresses, but well over a thousand physical machines behind them. A routing trick called anycast lets many servers share one address, so your question lands at whichever copy is nearest, often in your own city.
Name server for dot com
The root does not know your website and never will. It answers with a referral: go and talk to the servers that handle dot com. That one sentence is essentially all a root server ever says.
The domain's own name server
The dot com servers refer you onward again, this time to the name servers the domain owner chose. Those machines are the only ones on Earth that hold the truth about that particular domain.
The zone file
Their zone file is the master list: the web address, the mail servers, the verification records. Change a single line here and you have changed where the entire world sends traffic for that name.
Address record and its TTL
Back comes the record you wanted, with a countdown attached called the time to live. Five minutes means fast changes but heavier traffic. Twenty four hours means a calm network but a slow, painful migration.
Cached on the way back
On the way home, every layer keeps a copy until that countdown expires. It is why a brand new domain can work for your friend and not yet for you, and why engineers lower the countdown days before moving a site.
DNSSEC signature check
There is a signed version of all this, the domain name system security extensions. Each answer carries a cryptographic signature chained upward to the root, so a resolver can prove nobody swapped the address while it was travelling back.
Encrypted DNS
An ordinary lookup travels as plain readable text, handing whoever runs the network a tidy list of every site you visit. An encrypted lookup wraps the question in the same protection a website uses, hiding even the question from the cafe wifi.
Your browser connects at last
Only now, with a number in hand, does your browser open the connection you actually asked for. The entire search usually finishes in under a tenth of a second, and you never had the faintest idea it happened.
Watch it explain itself
Every step above is narrated aloud. Play it, or open it in the editor and make it yours — no account needed.