how DNS actually works

explaining how dns work after years of using it

you type a domain, hit enter, and the page loads in milliseconds. but between those two moments, your computer asked a stranger where that domain lives, that stranger asked three other strangers, and someone finally answered with an IP address. here's what actually happens.

the query you never see:

when you type daoudi.li, your computer doesn't know where that is. it asks a recursive resolver , that's the DNS your ISP gives you, or 1.1.1.1 / 8.8.8.8 if you changed it.

that resolver doesn't know either. but it knows who to ask. it goes through this whole chain:

asks the root servers "where's daoudi.li?" → they say "no idea, ask the .li guys"
asks the .li servers → they say "ask this nameserver, it owns daoudi.li"
asks the authoritative nameserver → finally someone answers with the IP

then it comes back to your machine and the page loads. all of that in like 50ms. wild.

everyone calls this "iterative" because the resolver asks step by step, and "recursive" from your side because you just ask once and someone else runs around for you. the naming is confusing at first but honestly: you ask once, the resolver walks the chain. that's it.

try it yourself, it makes everything click:

dig +trace daoudi.li

you literally see it hop from root to .li to the nameserver. (fun detail: .li is Liechtenstein's TLD, so loading this blog involves asking servers about a country most people can't point at on a map.)

the caching part (this is where it gets interesting)

obviously nobody wants to redo that whole chain for every request. so everything caches — your OS, your browser, and especially the resolver itself.

run the same dig twice and look at the query time. first one ~50ms, second one 0ms. that's your cache talking.

TTL, or why your DNS change "isn't working"

every DNS record has a TTL , basically an expiry date in seconds. "trust this answer for the next 3600 seconds."

dig daoudi.li
# daoudi.li.  3600  IN  A  216.198.79.193
#              ^^^ this number, counting down on every query

so when you change a DNS record and nothing happens, nothing is broken. thousands of resolvers still have the old answer cached, and they'll keep serving it until the TTL runs out. that's why people say to lower your TTL to 300 before moving a domain.

wait, DNS queries are plaintext?

yeah. regular DNS is plain UDP on port 53. anyone between you and the resolver > your ISP, the café wifi, whoever can see every domain you're looking up. not the content, but the full list of sites.

that's why DoT and DoH exist:

DoT (DNS over TLS) : same DNS, but wrapped in a TLS session on port 853. clean, but easy for networks to spot and block
DoH (DNS over HTTPS : DNS disguised as regular HTTPS traffic on port 443. blends in with everything else, so it's harder to block (which is why some ISPs hate it)

most of the big public resolvers support both now:

Cloudflare 1.1.1.1, endpoint https://cloudflare-dns.com/dns-query
Google 8.8.8.8, endpoint https://dns.google/dns-query
Quad9 9.9.9.9, endpoint https://dns.quad9.net/dns-query

and you can test it right from the terminal:

# plain query, anyone watching can see this
dig @1.1.1.1 daoudi.li

# same query over DoH
curl -s "https://cloudflare-dns.com/dns-query?name=daoudi.li&type=A" \
  -H "accept: application/dns-json"

your browser probably already does DoH without you noticing , firefox enables it by default with Cloudflare in some regions.

the resume of what i said already :

you ask once, the resolver walks root → .li → nameserver
everything caches everywhere
TTL is just an expiry date, and it's why DNS changes feel slow
plain DNS is readable by anyone on the path DoT/DoH fix that, and 1.1.1.1 / 8.8.8.8 / 9.9.9.9 all support it
run dig +trace daoudi.li once and you'll never forget this