Domain Name System (DNS)

People use names such as www.example.com; IP needs addresses. The Domain Name System maps between them, and also tells mail systems where to deliver mail and gives aliases. It is a distributed, hierarchical database: no server holds all names. The namespace is a tree. Each zone, the part administered together excluding delegated child zones, is served by its authoritative name servers; resolvers walk the tree from the root downwards, caching what they learn so that most lookups never reach the root.

DNS is an application-layer protocol, normally carried over UDP port 53 in a single request and reply, which is why it adds little delay compared with a TCP connection. The calculations are the difference between recursive and iterative resolution, the number of messages and the delay of a lookup with and without cached data, record types, and the message format.

A domain name is a sequence of labels read from the most specific to the root: www.cs.example.edu. has labels www, cs, example, edu and the empty root label. Below the root are the top-level domains (generic such as com, org, edu, and country codes such as in), and below them the domains registered by organisations, which may create subdomains freely.

The root zone is served under 13 root server identities, lettered A to M, run by 12 independent operators (one operator runs two letters). Each identity is answered by many servers at many sites, so 13 counts names, not machines (root-servers.org, consulted 2026-11-11).

Each record is (name, TTL, class, type, value). Common types:

The TTL says how many seconds a resolver may cache the record.

A host's stub resolver usually sends a recursive query to its local resolver, which then resolves iteratively: root, then TLD, then authoritative.

Queries and replies share one format: a 12-byte header, then question, answer, authority and additional sections.

Names are encoded as length-prefixed labels ending in a zero byte: www.example.com becomes 3 www 7 example 3 com 0, 17 bytes. A repeated name can be replaced by a 2-byte pointer whose top two bits are 11 and whose other 14 bits give the offset of an earlier copy (message compression).

With empty caches and a three-level lookup (root, TLD, authoritative):

Here $r_0$ is the host-to-local-resolver RTT and $r_1, r_2, r_3$ the local resolver's RTTs to the root, TLD and authoritative servers; in the recursive chain $r_{12}$ is the root-to-TLD RTT and $r_{23}$ the TLD-to-authoritative RTT. In general, a lookup that reaches $k$ servers beyond the local resolver costs $2(k + 1)$ messages. Caching is what makes DNS scale: each referral (NS records) and answer is reused until its TTL expires.

A host's RTT to its local resolver is 2 ms; the resolver's RTT to each of the root, .com and example.com servers is 30 ms.

www.example.com has a CNAME record pointing to web1.example.net, which has an A record. A resolver asking for the A record of www.example.com gets the CNAME and must then resolve web1.example.net; if that name is in another zone, the lookup may need further referrals.

To send mail to [email protected], the sending server asks for the MX records of example.com, picks the one with the lowest preference number (for example 10 mx1.example.com before 20 mx2.example.com), then asks for that server's A record.

www.gate.example encodes as 03 77 77 77 04 67 61 74 65 07 65 78 61 6d 70 6c 65 00: $1 + 3 + 1 + 4 + 1 + 7 + 1 = 18$ bytes. A query for it is 12 (header) + 18 (name) + 2 (type) + 2 (class) = 34 bytes of DNS message, sent in one UDP datagram.

The name for address 203.0.113.7 is looked up as a PTR record for 7.113.0.203.in-addr.arpa: the bytes are reversed so that the most specific part comes first, as in every domain name.

Common misconceptions.