How does DNS work?

What happens after you press Enter

Your device asks a recursive resolver, often operated by an internet provider or a public service. If the answer is not cached, the resolver follows referrals: root servers point it toward the top-level domain, the TLD servers identify the authoritative name servers, and those servers answer for the domain.

The commonly cited “13 root servers” are 13 named identities, A through M, not just 13 physical machines. Anycast places many instances around the world, so a lookup can reach a nearby copy while using the same logical root-server address.

A, AAAA and CNAME answer different questions

An A record returns an IPv4 address such as 192.0.2.10; AAAA returns an IPv6 address. CNAME makes one hostname an alias of another. MX tells mail systems where to deliver messages, while TXT is used for ownership checks and email controls such as SPF, DKIM and DMARC.

A frequent mistake is to change name servers when only an A record needed updating. Changing NS delegates the whole DNS zone to another provider. That can remove working mail records as well as the old website entry. Export or copy the complete zone before changing delegation.

TTL is a timer, not a global progress bar

A TTL of 3600 tells resolvers they may cache an answer for 3,600 seconds—one hour. If the old record had a TTL of 86,400, some caches may legitimately keep it for 24 hours after your change. Lowering TTL five minutes before a migration does not erase copies already cached under the old value.

A safer migration lowers TTL at least one old-TTL period in advance, changes the record, checks several resolvers and then raises TTL after the service is stable. This is why “DNS propagation takes 48 hours” is only a rough slogan, not a rule.

A small diagnostic sequence

First check which name servers are delegated. Next ask those authoritative servers directly for the relevant record. Finally compare the result with a recursive resolver. If the authority has the new answer but a resolver has the old one, caching is the likely cause. If the authority is wrong, waiting will not repair the configuration.

DNSSEC adds a chain of signatures

DNSSEC lets resolvers verify that signed DNS data has not been altered in transit. It does not encrypt queries or make a website secure by itself. A broken DS record can make a correctly hosted domain appear completely unreachable, so coordinate DNSSEC when changing DNS providers.