How DNS Resolution Works

Last updated:

Your machine almost never resolves names itself — it asks a recursive resolver (ISP, corporate, or 8.8.8.8/1.1.1.1) which does the legwork and caches the answers.

Two different question styles are in play:

• Recursive query (client → resolver): "get me the final answer."
• Iterative queries (resolver → root/TLD/auth): "tell me who to ask next."

Caching is the whole game

Every answer carries a TTL; resolvers, OSes, and browsers all cache. That's why DNS changes "propagate" slowly — nothing is pushed, old answers just have to expire.

dig +trace www.example.com   # watch the referral chain yourself
dig @1.1.1.1 www.example.com # ask a specific resolver

Negative caching

"That name doesn't exist" (NXDOMAIN) is also cached, governed by the SOA record's minimum TTL. Creating a record right after querying it can mean waiting out the negative TTL — a classic footgun during cutovers.