Unlocking DNS: How Domain Names Resolve to IP Addresses Step‑by‑Step

What is DNS?

DNS (Domain Name System) translates human‑readable domain names into IP addresses, acting like a massive phone book for the Internet.

Query Process

Although a single IP address is returned, the DNS lookup involves several steps. The dig utility can display the entire process.

<code>$ dig math.stackexchange.com</code>

The command outputs six sections: query parameters, query content, server response, NS records, server IPs, and transmission details.

Example output shows that math.stackexchange.com has four A records (IP addresses) and a TTL of 600 seconds.

DNS Servers

Your machine must know the IP address of a DNS server (often obtained via DHCP or configured in /etc/resolv.conf). Common public servers include Google’s 8.8.8.8 and Level 3’s 4.2.2.2.

The @ option in dig lets you query a specific server, e.g.:

<code>$ dig @4.2.2.2 math.stackexchange.com</code>

Domain Hierarchy

Domain names are resolved through a hierarchical, or “tiered”, lookup. Every fully‑qualified domain name ends with a root dot ( .).

The hierarchy consists of:

Root domain (.)

Top‑level domain (TLD) such as .com or .net Second‑level domain (SLD) like example in www.example.com Host name (e.g., www)

In notation: host.sld.tld.root.

Root Name Servers

Root servers store the NS records for all TLDs. There are thirteen root server groups (A‑ROOT‑SERVERS.NET to M‑ROOT‑SERVERS.NET) with fixed IP addresses, typically cached for long periods (TTL ≈ 1 000 hours).

Trace Example (Hierarchical Lookup)

Using dig +trace shows each step from the root to the authoritative server:

<code>$ dig +trace math.stackexchange.com</code>

The output first lists all root NS records, then the .com TLD NS records, followed by the stackexchange.com NS records, and finally the A records for math.stackexchange.com.

NS Record Queries

You can query NS records for any zone:

<code>$ dig ns com</code>

<code>$ dig ns stackexchange.com</code>

DNS Record Types

Common DNS record types include: A: address record, returns an IPv4 address. NS: name‑server record, points to the server responsible for the next zone. MX: mail exchange record, specifies mail servers. CNAME: canonical name, an alias to another domain. PTR: pointer record, used for reverse lookups (IP → domain).

For reliability, at least two NS records are recommended, and multiple A or MX records provide redundancy.

Other DNS Tools

Besides dig, useful utilities include:

host : a simplified query tool, e.g. $ host github.com.

nslookup : interactive lookup, e.g. $ nslookup then facebook.github.io.

whois : displays domain registration information, e.g. $ whois github.com.

These tools help inspect records, perform reverse lookups ( dig -x), and verify DNS configurations.

Source: http://ruanyifeng.com/blog/2016/06/dns.html