DNS Resolution Walk

Recursive query

"Give me the answer." The client asks once and waits; the resolver does all the work. This is what your machine sends.

Iterative query

"Tell me who to ask next." The server replies with a referral rather than an answer. This is what the resolver sends to root and TLD servers, and it is why those servers can serve the whole internet — they only ever refer.

Stub resolver

The trivial client in your operating system. It knows one resolver's address and nothing about the hierarchy.

Authoritative server

Holds the real records for a zone. Its answer is the answer, not a referral.

Protocol data unit

What the thing is called at each layer: segment at transport, packet at network, frame at link. Different names for the same bytes with different amounts of header wrapped round them.

Encapsulation

A layer treats everything it receives from above as opaque payload and prepends its own header. It never looks inside, which is precisely what makes layers replaceable.

Peer layers

A layer only ever meaningfully talks to the same layer at the other end. TCP at one end reads the header TCP at the other end wrote, and nothing in between touches it.

Propagation vs transmission delay

Propagation is how long a bit takes to travel the distance — set by physics. Transmission is how long it takes to push all the bits out — set by bandwidth. Only the second improves when you buy a faster link.

Round-trip time (RTT)

Send to reply. Every acknowledgement-based protocol is ultimately paced by this, which is why the interesting question is always how much you can send before one arrives.

1. 1The stub resolver asks the recursive resolver for www.example.com.
2. 2The resolver asks a root server, whose 13 addresses it knows from a built-in hints file. The root refers it to the .com servers.
3. 3It asks a .com TLD server, which refers it to example.com's nameservers.
4. 4It asks the authoritative server, which returns the A record.
5. 5The resolver caches everything it learned and returns the address.

Each server answers only for the zone it owns and delegates the rest. The root has never heard of example.com and never will.

Without caching the root servers would collapse instantly. Every record carries a TTL saying how long it may be kept, and resolvers cache both the final answer and the referrals gathered along the way — so the next lookup for anything in .com already skips two steps.

The TTL is a genuine trade. Short means changes propagate quickly at the cost of more queries; long means less traffic but a change can take a day to reach everyone. This is why administrators lower the TTL well *before* a planned migration, then raise it again afterwards.

DNS runs over UDP port 53 — queries and answers are small, and a lost one is simply retried, so TCP's handshake would double the latency of every lookup. It falls back to TCP for large responses and zone transfers.

The original protocol had no authentication at all, which makes cache poisoning possible: convince a resolver to cache a wrong answer and every user of it goes to the wrong place. DNSSEC adds signatures so answers can be verified; DNS over HTTPS and DNS over TLS encrypt the query for privacy. All are retrofits onto a protocol designed when the network was small and trusted.