What Is Domain Name System?

The Domain Name System (DNS) is a hierarchical, distributed naming protocol that translates human-readable domain names into the numerical IP addresses used by network infrastructure to route packets across the internet. It functions as the internet's primary directory service, resolving queries such as "example.com" into addresses like 93.184.216.34, enabling application software to locate servers without requiring users or programs to manage numeric addressing directly. DNS operates transparently beneath virtually every internet application, from web browsing and email delivery to content distribution and voice-over-IP services.

DNS was designed in the early 1980s to replace a centrally maintained host table (HOSTS.TXT) that had become unscalable as the internet grew beyond a few hundred nodes. The architecture that replaced it, formalized in RFC 1034 and RFC 1035 published by the IETF in 1987, introduced a distributed database model with delegated administrative authority that has remained the foundation of internet naming for four decades.

Namespace and Zone Hierarchy

The DNS namespace is organized as an inverted tree with the root at the top, followed by top-level domains (TLDs) such as .com, .org, and country-code TLDs, then second-level domains, and so on. Each node in the tree is called a label, and the full path from a leaf node to the root forms the fully qualified domain name (FQDN). Administrative control of subtrees is delegated through the zone mechanism: a zone is a contiguous portion of the namespace for which a particular organization holds authority, served by one or more authoritative name servers. The IETF's DNS technology overview describes how zone delegation enables the global DNS to scale to hundreds of millions of registered names without central coordination of individual records.

Resolution Process

DNS resolution proceeds through a chain of queries involving recursive resolvers, root name servers, TLD name servers, and authoritative name servers. A recursive resolver, typically operated by an ISP or a public DNS provider, accepts queries from client software and performs the full lookup on the client's behalf. When no cached answer exists, the resolver begins at a root server, which refers it to the appropriate TLD server, which refers it in turn to the authoritative server for the queried zone. Responses are cached by resolvers according to the time-to-live (TTL) value carried in each resource record, which reduces query latency and load on authoritative servers. The most common resource record types include A (IPv4 address), AAAA (IPv6 address), MX (mail exchanger), and CNAME (canonical name alias).

Security Extensions and Modern DNS

Standard DNS queries travel over UDP in cleartext, exposing them to several classes of attack. DNS cache poisoning, in which false records are injected into a resolver's cache, was demonstrated at scale by security researcher Dan Kaminsky in 2008. DNS Security Extensions (DNSSEC) address record authenticity by adding cryptographic signatures to DNS responses, allowing resolvers to verify that records were issued by an authorized zone operator. More recent protocols including DNS over TLS (DoT) and DNS over HTTPS (DoH), specified in RFC 7858 and RFC 8484 respectively, encrypt DNS traffic to protect query privacy from network-level observers. Adoption of these encrypted transport protocols has grown substantially among major browser vendors and public resolver operators since 2018, as documented in IETF working group publications.

Applications

The Domain Name System has applications across a wide range of networking and internet infrastructure disciplines, including:

• Web and application server discovery for HTTP and HTTPS clients
• Email routing via MX records in SMTP infrastructure
• Content delivery network (CDN) traffic steering using low-TTL A records
• Service discovery in microservice and container orchestration systems
• Anti-spam authentication through SPF, DKIM, and DMARC policy records