DNS: How Domains Resolve to IPs

The Domain Name System (DNS) is the internet's phone book. It translates human-readable domain names like google.com into IP addresses like 142.250.80.46 that computers use to route traffic.

When you type a URL, your browser queries DNS:

1. Check local cache (fast)
2. Query local resolver (usually your router or ISP)
3. Resolver queries root nameserver for TLD authority
4. Query TLD nameserver (e.g., .com) for domain authority
5. Query authoritative nameserver for the actual record
6. IP returned and cached

Common DNS record types:

• A — domain to IPv4 address
• AAAA — domain to IPv6 address
• CNAME — alias pointing to another domain
• MX — mail server for a domain
• TXT — arbitrary text (SPF, DKIM, verification)
• NS — nameserver for a domain

Each DNS record has a TTL (time-to-live) value in seconds. Once cached, resolvers use the cached value until TTL expires, then re-query. Lowering TTL before a migration reduces propagation delay.

Security professionals enumerate DNS records to map an organization's infrastructure:

A DNS zone transfer (AXFR) copies all records from a nameserver — useful for backup but dangerous if exposed to everyone. Misconfigured nameservers can reveal the full internal DNS of an organization.

Cache poisoning injects fake DNS records into a resolver's cache, redirecting users to attacker-controlled servers. DNSSEC (DNS Security Extensions) uses cryptographic signatures to prevent this.

Traditional DNS sends queries in plaintext — anyone on the network can see which domains you visit. DoH and DoT encrypt DNS queries, preventing surveillance and man-in-the-middle interception of DNS traffic.

DNS tunneling encodes data inside DNS queries/responses to exfiltrate data or maintain C2 communication through firewalls that allow DNS traffic. Security teams monitor for unusually long DNS queries and high query volumes as indicators.

Organizations run split-horizon DNS: internal DNS resolves private addresses for internal services; external DNS serves only public-facing entries. This prevents internal topology exposure to external queries.

Essential DNS tools:

Which DNS record type specifies the mail server responsible for handling email for a domain?

DNS translates domain names to IP addresses through a hierarchical resolution process involving root, TLD, and authoritative nameservers. Key record types include A, AAAA, MX, CNAME, and TXT. Security concerns include cache poisoning, zone transfer exposure, and DNS tunneling. DoH/DoT encrypt DNS for privacy.