Walking Through a DNS Lookup

When you enter a domain name, your device must turn it into an IP address before connecting. This process is a DNS lookup, and it follows a clear sequence of steps.

The goal is to find the authoritative answer as quickly as possible, using caches along the way to save work.

The device first checks its own local DNS cache and the hosts file. If the name was looked up recently and is still valid, the cached IP is used immediately.

This avoids any network query. Caching is why visiting a site a second time often connects faster than the first.

If the local cache has no answer, the device sends the query to its configured recursive resolver, usually run by the ISP or a public provider like 8.8.8.8.

The resolver takes responsibility for finding the answer, querying other servers as needed and returning the final IP to the device.

The device’s request to the resolver is recursive: "find me the full answer." The resolver then makes iterative queries to the hierarchy, each server pointing it closer to the answer.

Recursive means do all the work; iterative means give the next step. The resolver bridges the two styles.

If the resolver has nothing cached, it starts at a root server. The root does not know the final answer but knows which TLD server handles the domain’s ending, such as .com.

The root replies with a referral pointing the resolver toward the right TLD servers.

Next the resolver asks the TLD server (for example, the .com servers). The TLD server does not hold the final record either, but it knows the authoritative name servers for the specific domain.

It returns another referral, narrowing the search to the domain’s own servers.

Finally the resolver asks the domain’s authoritative name server, which holds the real record. It returns the actual IP address for the requested name.

This is the definitive answer. The resolver now has what the original device needs.

The resolver sends the IP back to your device, which can now connect. Both the resolver and your device cache the answer for a set time.

Subsequent lookups for the same name skip the full journey and use the cache, making the system fast and reducing load on the servers.

Most DNS queries travel over UDP port 53, chosen for speed since lookups are small and frequent. The lightweight, connectionless transport suits quick question-and-answer exchanges.

For larger responses or zone transfers between servers, DNS switches to TCP port 53. Knowing DNS uses port 53 is a common exam point.

The full path, when nothing is cached, is: local cache → recursive resolver → root → TLD → authoritative → answer.

Memorize this order for the exam. Each level either answers from cache or refers the resolver one step deeper until the authoritative record is reached.

Knowing the lookup path helps you troubleshoot. If a name fails, you can test whether the resolver responds, whether the authoritative server is reachable, and where the chain breaks.

Tools like nslookup let you query specific servers directly to pinpoint which stage of the lookup is failing.

Order the lookup.

You walked through a DNS lookup.

• Order: local cache → resolver → root → TLD → authoritative → answer.
• The device makes a recursive query; the resolver makes iterative queries.
• Root servers refer to TLD servers; TLD servers refer to authoritative servers.
• The authoritative server holds the real record and gives the final IP.
• Answers are cached to speed up future lookups.