DNS Resolution

DNS hierarchy, recursive resolution, caching, TTL, negative caching, and DNSSEC validation.

Overview

Overview DNS (Domain Name System) is the distributed hierarchical naming system that translates human-readable names to IP addresses. It is often called the "phone book of the internet," but a more accurate analogy is a distributed key-value store with hierarchical delegation and time-to-live caching.

The resolution hierarchy: root servers (13 root server clusters managed by IANA; they know who manages .com, .org, etc.) -> TLD nameservers (Verisign manages .com; they know who manages example.com) -> authoritative nameservers (your DNS provider, e.g., Route53; they have the actual A, CNAME, MX records).

Recursive resolution: when a client queries a recursive resolver (e.g., your ISP's DNS, 8.8.8.8, 1.1.1.1), the resolver walks the hierarchy on the client's behalf. Resolvers cache responses up to the record's TTL, dramatically reducing load on authoritative servers.

TTL (Time To Live) controls caching. Low TTL (60s) means changes propagate quickly but increase query load and latency. High TTL (86400s = 1 day) reduces load but means changes take a day to propagate. Before a DNS migration, reduce TTL to 60s a day in advance, perform the migration, then restore TTL. This gives you a rollback window of only 60 seconds.

Negative caching (NXDOMAIN): when a name does not exist, resolvers cache the NXDOMAIN response up to the SOA record's negative TTL (typically 5 minutes). This means if you query for a name that does not exist, wait the negative TTL before re-querying — the resolver will return cached NXDOMAIN.

Key concepts

TTL (Time To Live)
Seconds a DNS record may be cached by resolvers. Low TTL = fast propagation, high query load. High TTL = slow propagation, low load. Reduce TTL 24h before migrations.
Recursive resolver
A DNS server that performs the full resolution on behalf of the client. Caches results per TTL. Examples: 8.8.8.8 (Google), 1.1.1.1 (Cloudflare), CoreDNS in Kubernetes.
Authoritative nameserver
The server that holds the actual DNS records for a zone. Returns authoritative answers. Route53, Cloudflare DNS, and GoDaddy are authoritative nameservers.
Negative caching
Caching of NXDOMAIN (name does not exist) responses. Resolvers cache these up to the SOA minimum TTL. Queries for non-existent names fail fast after the first miss.
NXDOMAIN vs SERVFAIL
NXDOMAIN means the name definitively does not exist. SERVFAIL means the resolver could not complete the query (nameserver unreachable, DNSSEC failure). Different root causes.

When to use it

  • Debugging DNS propagation delays after changing a record
  • Explaining why lowering TTL before a migration is essential
  • Diagnosing Kubernetes pod DNS failures with nslookup from inside the pod
  • Understanding why flush caches does not help if the authoritative TTL is still high

Interview questions

  • Walk through a full DNS resolution for api.example.com from a Kubernetes pod.

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio