DNS (Domain Name System)

DNS (Domain Name System) is the system that translates human-readable domain names like example.com into machine-readable IP addresses.

Without DNS, users would need to remember numeric IP addresses instead of names like google.com or github.com.

A domain name is a human-friendly name used to identify a resource on the internet, such as example.com.

A hostname is a label used to identify a host, often part of a domain, such as web01.example.com.

An IP address is a numeric address used to identify a device on a network, such as 192.168.1.10 or 2001:db8::1.

DNS resolves names to addresses, such as converting example.com to 93.184.216.34.

A DNS resolver is a server or client component that resolves domain names by querying DNS servers.

A recursive query asks a DNS server to answer the full resolution on behalf of the client.

A recursive resolver is the server that resolves queries by consulting authoritative servers and caches.

An authoritative server is the source of truth for a given domain or zone.

A DNS zone is a portion of the DNS namespace managed by a specific authority.

A forward lookup resolves a domain name to an IP address.

A reverse lookup resolves an IP address to a domain name.

A PTR record maps an IP address back to a hostname in reverse DNS.

An A record maps a hostname to an IPv4 address.

An AAAA record maps a hostname to an IPv6 address.

A CNAME record creates an alias from one domain name to another.

An MX record tells mail servers where to deliver email for a domain.

A TXT record stores text data and is commonly used for verification and SPF/DKIM/DMARC.

A NS record declares which nameservers are authoritative for a zone.

A SOA record contains metadata for the zone, such as serial number and refresh interval.

The root domain is the top-level of the DNS hierarchy and is represented by a trailing dot (.).

A TLD (Top-Level Domain) is the highest level of a domain name such as .com, .org, or .net.

A second-level domain is the part directly under the TLD, such as example in example.com.

A subdomain is a domain that sits beneath another domain, such as blog.example.com.

An FQDN (Fully Qualified Domain Name) is a complete domain name with all labels, e.g. web.example.com.

A wildcard record matches multiple subdomains, such as *.example.com.

TTL (Time To Live) determines how long a DNS record can be cached before refresh.

Caching reduces query latency and lowers the load on authoritative servers.

A cache miss occurs when the resolver does not already know the answer and must query upstream servers.

A cache hit occurs when a resolver finds the answer in its cache.

A stub resolver is a lightweight client resolver used by operating systems and devices.

It is typically the local DNS server configured on the network that handles recursive lookups.

A nameserver is a server that serves DNS records and answers queries.

A forwarder is a DNS server that forwards queries to another server instead of resolving them independently.

DNS propagation is the time it takes for DNS changes across the internet to become visible.

DNS poisoning is the malicious corruption of DNS data to redirect traffic to the wrong place.

DNS hijacking alters DNS settings to redirect users or systems to malicious destinations.

Most users access websites by domain name, and DNS converts those names to IP addresses before the browser connects.

The browser asks the system resolver for the domain’s IP, then connects to the server over HTTP or HTTPS.

A domain registrar is an organization that sells and manages domain names.

The registry manages the top-level domain database, while the registrar sells domain names to customers.

A DNS lookup is the process of querying DNS to obtain information about a domain.

A root server is a server at the top of the DNS hierarchy that helps locate authoritative TLD servers.

There are multiple root name servers around the world, operated by various organizations.

The root zone is the top-level namespace from which all domain names are derived.

A TLD server knows the authoritative nameservers for domains under a top-level domain like .com or .org.

Glue records provide the IP addresses of nameservers in a delegated zone so resolvers can reach them.

A delegation is the transfer of authority from a parent zone to a child zone.

DNS is hierarchical: root -> TLD -> domain -> subdomain -> host.

A nameserver chain is the sequence of servers consulted while resolving a domain.

A negative cache stores the fact that a domain name does not exist to reduce repeated lookups.

NXDOMAIN means a domain name does not exist.

DNS response codes indicate success or failure conditions, such as NOERROR, NXDOMAIN, or SERVFAIL.

It means the name exists and the query was answered successfully.

A query type tells the server what kind of record is being requested, such as A, AAAA, MX, TXT.

DNS commonly uses UDP port 53 for quick queries and smaller responses.

TCP port 53 is used for larger DNS messages, zone transfers, and some queries that exceed UDP size limits.

A DNS packet is the message exchanged between clients and servers carrying query or response data.

A large DNS response may be truncated over UDP, requiring the client to retry over TCP.

Recursion is the process where a resolver continues querying on behalf of the client until it receives an answer.

Iterative resolution is when a server returns the best-known answer or referral instead of resolving the full name itself.

A referral is a response from a DNS server telling the client which server to query next.

A local DNS cache stores prior lookups to speed up repeated queries.

It is the local DNS client component used by the OS, such as systemd-resolved or nscd.

A resolver answers queries for clients and can query other servers. An authoritative server provides definitive answers for a domain.

Domain ownership is the administrative control over a registered domain name.

A zone transfer copies the complete DNS zone data from one authoritative nameserver to another.

AXFR is the full-zone transfer protocol used for transferring an entire DNS zone.

IXFR is an incremental zone transfer that only sends changes since the last version.

DNSSEC adds digital signatures to DNS records to authenticate the data and prevent tampering.

It helps protect against spoofing and cache poisoning by validating record authenticity.

A DNSSEC signature is a digital signature that verifies the authenticity of DNS data.

A DS record is used in parent zones to link to a child zone’s DNSSEC key.

A KSK (Key Signing Key) signs the DNSKEY RRset and is used in DNSSEC.

A ZSK (Zone Signing Key) signs zone data in DNSSEC.

A DNSKEY record contains the public key used to verify DNSSEC signatures.

An RRSIG record is the cryptographic signature for a DNS RRset.

A trust anchor is a trusted DNSSEC key used to validate signed DNS data.

DNS over HTTPS (DoH) sends DNS queries over HTTPS to hide them from local network observers.

DNS over TLS (DoT) encrypts DNS queries using TLS.

It increases privacy and prevents local interception of DNS traffic.

Split-horizon DNS returns different responses depending on the querying source or network location.

CDNs use DNS to route users to the closest or healthiest edge server.

Anycast DNS routes a single IP address to multiple servers in different locations, typically the nearest one.

Round-robin DNS rotates multiple A or AAAA records in response to queries for load distribution.

DNS can distribute traffic across multiple server IPs using responses like round-robin or health-aware routing.

Health checks can be used by DNS providers to remove unhealthy endpoints from responses.

Geolocation DNS routes users differently based on their geographic location.

Latency-based routing directs clients to the endpoint with the fastest or lowest-latency path.

An SRV record identifies the hostname and port of a service, such as SIP or XMPP.

A CAA record restricts which certificate authorities may issue certificates for a domain.

DMARC helps prevent email spoofing by specifying how receivers should handle email that fails SPF/DKIM checks.

SPF records list which mail servers are authorized to send email for a domain.

DKIM signs outgoing email so receivers can verify the sender’s identity.

A record set is a group of DNS records with the same name and type.

DNS servers may return records in different orders for load distribution or redundancy.

Resolvers store query results so repeated requests can be answered faster.

It means an attacker tricks a resolver into storing fake DNS data and sending users to malicious destinations.

A resolver stores the fact that a name does not exist, so it does not re-query repeatedly.

The hierarchy is root -> TLD -> authoritative -> resolver -> client.

It is the sequence of NS records establishing which server is authoritative for a subdomain.

Wildcard expansion allows a single DNS rule to match many names under a domain.

The domain apex is the bare domain without any subdomain, such as example.com.

A zone apex record is a DNS record at the top of a zone, such as example.com A/AAAA records.

An alias record is a DNS record that points to another record without changing the ownership of the domain name.

A domain suffix is the trailing part of a domain such as .com or .co.uk.

A root hint file tells recursive resolvers where the root servers are.

It is the cascade of queries that a resolver uses to eventually answer a client request.

Because it maps names to addresses like a phonebook maps names to phone numbers.

A query packet is a DNS message sent to ask for some record information.

A reply packet contains the answer or referral returned by a DNS server.

It is the time a server takes to answer a query.

A timeout occurs when a query takes too long and the client gives up or retries.

A resolver loop happens when name resolution repeats recursively without progress.

Recursion depth is how many levels a resolver goes through during a query chain.

EDNS adds extra data to DNS queries, such as larger payload support and client-subnet information.

EDNS0 is the standard DNS extension mechanism that allows larger packets and additional options.

When UDP responses are too large, the client retries over TCP.

Because some responses are too large to fit in UDP payloads, and zone transfers require TCP.

It is the process from client stub resolver to recursive server to authoritative nameservers.

It checks its cache, then issues iterative queries to upstream servers until the answer is known.

The resolver asks a nameserver for the next authoritative server rather than resolving the whole chain alone.

The root zone file contains the list of current root servers and their metadata.

It can return different A or AAAA records in different order, or use specialized DNS providers with health-based routing.

Split-brain DNS returns different answers to internal and external clients, often for security or testing.

A hidden master is an authoritative nameserver not exposed publicly but used internally for zone updates.

A slave nameserver receives transferred zone data from a master server.

One nameserver acts as the source of truth; others replicate the zone data from it.

A DNS provider manages nameservers and DNS records for domains.

Domain transfer is the transfer of domain ownership from one registrar to another.

Multiple nameservers improve resilience, performance, and availability.

A zone file is a text representation of DNS records for a zone.

The serial number helps secondary servers detect whether a zone has changed.

The refresh interval is how often secondary servers check whether the zone has changed.

The retry interval defines how long secondary servers wait before retrying after a failed refresh.

The expiry time is the maximum time a secondary server will continue to serve an outdated zone before giving up.

Minimum TTL is a value associated with the zone, often used in older DNS implementations.

Some records, such as MX, include a preference value indicating priority.

Some record types use weight to balance traffic among equal priority options.

Weighted load balancing sends more traffic to preferred endpoints by assigning them more weight.

Failover changes the answer to a healthy record when a primary endpoint is unavailable.

A dead server record is a compromised or unhealthy target removed or deprioritized by DNS logic.

A wildcard certificate protects multiple subdomains and requires DNS validation or domain ownership proof.

CAA records restrict which certificate authorities can issue certificates for a domain.

It is the chain that connects trust anchors to the signed zone data.

A trust store holds trusted certificates or keys used to validate signed DNS data.

Because the signatures ensure that records have not been modified in transit.

Validating resolvers check DNSSEC signatures before accepting records.

An unsigned zone is a zone that has not been signed with DNSSEC.

A signed zone includes DNSSEC metadata and signatures.

A DNSSEC rollover is the process of replacing or rotating signing keys in a secure way.

A stale cache contains expired data that may still be used until refreshed.

Negative cache TTL controls how long a resolver remembers a non-existent domain before retrying.

It measures how often a resolver answers from cache instead of querying upstream servers.

It indicates efficiency and helps show whether a resolver is doing enough local caching.

DoH increases privacy but can hide DNS traffic from local security controls.

If compromised, a recursive resolver can be used to redirect users, collect traffic patterns, or perform malicious resolution.

DNS rebinding attacks exploit the trust relationship between browsers and DNS to redirect internal services.

DNS tunneling hides data in DNS queries and responses, often as a covert channel.

DNS exfiltration sends sensitive data outside a network via DNS queries or responses.

Because DNS is often used as an illicit command and control or exfiltration channel.

Malware uses DNS to call back home or communicate with command and control infrastructure.

A sinkhole redirects malicious domain traffic to a safe server for containment or investigation.

A DNS firewall filters malicious or suspicious lookups for security enforcement.

A resolver policy defines rules about which records, domains, or clients are allowed.

A split resolver answers queries differently for internal and external clients.

A search domain allows users to omit part of a hostname when resolving locally.

A search list is the list of suffixes used when resolving short hostnames.

It may involve /etc/hosts, local multicast DNS, or local DNS cache before external servers.

A local hosts file that resolves names to addresses without DNS.

mDNS (multicast DNS) provides local name resolution in small networks without centralized DNS.

LLMNR is a local name resolution protocol that can cause confusion and security issues in some Windows networks.

Because it may leak or resolve names in insecure ways if not controlled.

DNS data cached on the client or resolver reduces repeated network traffic.

TTLs influence how quickly DNS changes propagate and how long stale answers are kept.

Slow DNS resolution can delay requests, especially during cold starts or failover.

A prefetcher resolves names before the user actually needs them, reducing perceived latency.

A DNS storm occurs when a massive number of clients query a single domain concurrently.

It includes caching, load balancing, resolver scaling, and low TTL strategy based on needs.

It is the need to resolve names very quickly for user-facing systems and edge services.

Some systems use DNS to route to API endpoints or compute healthy backends in real time.

It provides naming, discovery, and routing for services and endpoints across networks.

Service discovery is the process of finding the endpoints for services, often via DNS or service registries.

DNS can direct clients to a load balancer IP or across regional endpoints.

They can affect app startup, failover time, and even outage detection.

DNS churn is frequent record changes, often caused by autoscaling or frequent health changes.

Cloud workloads frequently scale up and down, and DNS provides dynamic service discovery and routing.

It is the process of publishing a service name and address into DNS or a dynamic registry.

Internal DNS is used within a private network for service discovery and internal application routing.

External DNS resolves names publicly on the internet.

Private DNS keeps internal service names isolated and avoids exposing internal topology.

Because internal and external resolution often need different answers for security and service access.

Typical workflow:

• update records in authoritative zone
• validate syntax
• publish
• allow propagation through TTL
• monitor queries

Monitoring includes resolver health, latency, propagation, errors, and suspicious or malicious lookups.

Check resolver path, configuration, TTL, zone records, propagation, firewall rules, and server health.

A DNS trace shows the resolution steps from client to nameserver to authoritative server.

It records queries, answers, cache hits, and upstream server behavior.

• stale cache
• misconfigured A/AAAA records
• expired TTL
• firewall blocked UDP/TCP 53
• zone not authoritative
• broken delegation
• failed DNSSEC validation

DNS is the naming and discovery layer of the internet; without it, the web, services, and applications would be nearly impossible to use reliably and securely.

DNSSEC validation ensures that DNS answers are authentic and unmodified by cryptographic verification.

It is the chain from the root zone down to the specific signed zone that validates all record sets.

It is the process of replacing old signing keys with new ones while maintaining trust continuity.

Improper key management can lead to outage or loss of trust if keys are rotated incorrectly.

It proves that a name does not exist using NSEC/NSEC3 records, rather than a plain NXDOMAIN.

NSEC proves the non-existence of a name by showing the next name in the zone.

NSEC3 hashes names for privacy and prevents simple enumeration of zone data.

DNS cookies help mitigate reflection and spoofing attacks against DNS servers.

It is where recursive resolvers verify DNSSEC signatures before returning data to clients.

A DNS amplification attack floods a target by sending small queries that trigger large responses.

Because attackers can spoof the source IP and force responses toward a victim.

It restricts how many queries or responses a server will process from a source to mitigate abuse.

Hardening includes limiting recursion, restricting zone transfers, enforcing DNSSEC, and monitoring anomalies.

It prevents a nameserver from answering recursive queries for unauthorized clients.

BIND is one of the most widely used DNS server implementations.

Unbound is a validating, recursive DNS resolver often used for security-focused deployments.

Knot DNS is a modern DNS server implementation known for performance and DNSSEC support.

CoreDNS is a flexible DNS server often used in Kubernetes and cloud-native systems.

Kubernetes often uses CoreDNS for service discovery and internal name resolution.

Cluster-local DNS resolves service names within a Kubernetes cluster.

A headless service exposes pod IPs directly for DNS-based discovery instead of a single service IP.

A service record maps a service name to its IP or pod endpoints.

It often includes multiple resolver layers, private zones, and centralized naming governance.

DNS can be used to restrict access, control internal service discovery, and feed security analytics.

DNS filtering blocks or redirects suspicious or unwanted domains before connections are attempted.

It redirects or denies domain queries based on policy or threat intelligence.

It can stop malware from reaching its command and control infrastructure or block dangerous lookups.

If a provider goes down or is misconfigured, domains may stop resolving globally.

It routes traffic to alternate IPs or regions when a primary service fails.

A DNS endpoint that only returns responses when it is healthy and available.

It includes multiple nameservers, geographic redundancy, and monitoring against outages.

DNS analytics inspects query patterns, anomalies, and volume to understand traffic and security events.

DNS query logging captures requests for troubleshooting, compliance, and security investigation.

It reduces leakage by sending only the minimum necessary part of a query to upstream authoritative servers.

It reduces privacy exposure by not revealing the full domain name to every server in the chain.

DNS privacy aims to hide the domain names users query from local network observers and unauthorized intermediaries.

Because traditional DNS queries are transmitted in plain text, which can be inspected or manipulated.

Encrypted Client Hello (ECH) is a protocol feature related to privacy in encrypted DNS and HTTPS environments.

DNS often resolves the address of the service that TLS will later connect to securely.

It spreads authority across multiple DNS zones and nameservers for scalability and governance.

Zone scoping limits how and where a DNS zone is served or delegated.

A stale delegation points to outdated nameservers that no longer serve valid data.

It occurs when parent NS records refer to nameservers that are not actually serving the child zone.

Because a domain can fail if all authoritative or recursive servers are misconfigured or unstable.

It directs clients to regionally nearest endpoints to improve user experience and reduce response times.

Geofencing routes or blocks clients based on region or policy.

DNS helps direct users to nearby services and supports mobile user movement and app connectivity.

CDNs often use DNS to detect health and direct traffic to alternative edge nodes or regions.

It is the process of making stale data expire or be refreshed quickly after a change.

TTL strategy decides how long records should live in caches to balance freshness and performance.

It involves adjusting resolver placement, caching, TTLs, and backend nameserver topology.

EDNS client subnet allows resolvers to share approximate client network information to improve geolocation-aware answers.

Because it can expose location information or violate privacy expectations.

It is distributed across hundreds of nameservers and resolvers operated by many organizations worldwide.

The root trust foundation ensures that TLD and authoritative namespaces are globally coherent.

A zone cut marks a boundary where a parent zone delegates authority to a child zone.

Versioning helps track changes and supports safe updates, especially when using dynamic DNS systems.

Dynamic DNS automatically updates DNS records when an IP address changes.

It is the way records move from the authoritative server to secondary servers and then to recursive caches.

It is a strategy to reduce query load or answer fewer requests during overload or attack conditions.

It selects healthy service endpoints and reroutes client traffic when regions fail.

It enforces routing or access decisions based on domain, subdomain, geolocation, or client identity.

DNS records are often used for domain ownership verification when requesting TLS certificates.

ACME is the protocol used by certificate authorities to automate certificate issuance and validation.

The CA validates the domain by checking a DNS record before issuing a certificate.

Because changing service IPs, endpoints, or load balancers often relies on controlled DNS updates.

DNS can direct part of the traffic to a new version while leaving the rest on the previous deployment.

It is a controlled migration strategy often supported by DNS-based routing or weighted responses.

DNS is a general-purpose naming system; service mesh discovery often adds runtime service awareness and dynamic routing.

It helps map application endpoints, edge routes, and service dependencies to actual infrastructure.

It includes query metrics, cache usage, latency, cache misses, and abnormal patterns.

Because a compromised DNS layer can redirect user traffic, hide malicious activity, and break trust in the broader network.

A domain takeover occurs when an attacker gains control of a domain or subdomain without the proper ownership.

It occurs when attackers register domain names similar to legitimate domains to capture traffic.

Using protective measures, monitoring suspicious registrations, and offering domain monitoring services.

DNS abuse includes phishing, malware infrastructure, spam domains, and malicious domain registration practices.

It blocks or warns on domains with known malicious or abusive behavior.

Because organizations rely on DNS for routing and identity, and misconfiguration can globally disrupt service availability.

It includes identifying broken delegation, stale records, malicious lookups, and compromised nameservers.

DNS is not just a lookup system; it is the naming fabric of the internet, the trust layer for service discovery, and a key security and reliability boundary for modern systems.