When you type a website address such as example.com into your browser, it may feel as though the browser simply knows where that website is located.
It doesn't.
Computers communicate using IP addresses, while humans generally prefer names that are easier to remember. The system that connects those human-friendly names with computer-friendly addresses is called the Domain Name System, or DNS.
DNS is one of the fundamental systems that makes the internet practical to use.
Every time you visit a website, send an email, use an API, connect to many online services, or access a server by domain name, DNS may be involved.
Understanding DNS is especially useful if you own a website or manage a server. A surprising number of common website problems are related to DNS configuration.
For example:
- A website works on one network but not another.
- A domain points to an old server.
- A new hosting account is not accessible through the domain.
- Email suddenly stops working after changing DNS.
- A subdomain does not open.
- HTTPS appears to be configured incorrectly.
- A CDN is not receiving traffic.
- A website works using an IP address but not its domain name.
- A domain works with
wwwbut not withoutwww.
These problems can look complicated until you understand what DNS is actually doing.
This guide explains DNS from the beginning and gradually moves toward practical configuration and troubleshooting.
What Does DNS Mean?
DNS stands for Domain Name System.
Its primary job is to translate domain names into information that computers and network services can use.
For example, a person might enter:
www.example.comThe browser needs to determine where that name should connect.
A DNS lookup can provide an IP address such as:
192.0.2.10The browser can then establish a connection to the server associated with that address.
The important point is that DNS does not itself deliver the website.
DNS helps the client discover where the service is located.
After DNS resolution, other protocols such as HTTP or HTTPS are responsible for communicating with the web server.
A simplified process looks like this:
You type a domain
↓
DNS lookup
↓
IP address
↓
Server connection
↓
HTTP/HTTPS request
↓
Website responseThis distinction is important because DNS and web hosting are related, but they are not the same thing.
Why Don't We Just Use IP Addresses?
Technically, you can access many services using IP addresses.
But imagine having to remember addresses such as:
203.0.113.25for every website you visit.
It would be inconvenient.
A domain name such as:
example.comis much easier to remember and communicate.
DNS provides a naming system that allows domains to remain relatively stable even when the underlying server infrastructure changes.
For example, a website could move from one server to another.
The domain name can remain the same while its DNS records are changed to point toward the new infrastructure.
This separation between the name and the physical or logical server is one of the reasons DNS is so useful.
Domain Name and Hosting Are Different Things
Beginners sometimes think that buying a domain automatically means they have purchased website hosting.
Usually, these are separate services.
A domain name is the human-readable address.
Hosting provides infrastructure where the website or application actually runs.
For example:
Domain:
example.com
Hosting:
Server at a particular IP addressDNS connects the two.
You can buy a domain from one company and host the website with another company.
You can also move your website to a different hosting provider while keeping the same domain.
You simply update the relevant DNS configuration.
What Happens When You Type a Website Address?
Let's look at a simplified example.
You type:
https://www.example.cominto your browser.
Several things can happen.
First, the browser and operating system may check whether they already know the DNS result from a cache.
If they do not have a usable cached answer, a DNS query may be sent to a configured DNS resolver.
The resolver then determines the appropriate DNS information.
Eventually, the browser learns an address associated with the hostname.
The browser can then connect to the destination.
After that, HTTPS negotiation and the HTTP request take place.
A simplified sequence is:
Browser
↓
Operating system DNS cache
↓
DNS resolver
↓
DNS hierarchy
↓
Authoritative DNS server
↓
IP address
↓
Web serverReal systems contain additional details, caching layers, optimizations, and network behavior, but this model is enough to understand most everyday DNS problems.
What Is a DNS Resolver?
A DNS resolver is a service that handles DNS queries on behalf of clients.
Your computer does not necessarily contact the authoritative DNS server for every domain directly.
Instead, it can ask a resolver.
The resolver may already have the answer cached.
If the answer is not cached, the resolver can perform the necessary DNS queries to find it.
Resolvers can be provided by:
- Internet service providers
- Public DNS providers
- Companies
- Organizations
- Local networks
- Router software
A device may receive the resolver's address automatically through network configuration.
What Is DNS Caching?
DNS results are normally cached for a period of time.
This reduces unnecessary queries.
Imagine millions of users requesting the same domain information repeatedly.
It would be inefficient if every device had to ask the authoritative DNS server every time.
Instead, DNS records have a TTL, or Time To Live.
The TTL tells caching systems approximately how long a result may be retained.
For example, a record might have a TTL of:
300 secondswhich is five minutes.
Another record might have a much longer TTL.
When you change a DNS record, some users may continue receiving the old result until their cached information expires.
This is one reason DNS changes are not always visible everywhere immediately.
What Is an IP Address?
An IP address identifies a network endpoint using the Internet Protocol.
Two major versions are commonly encountered:
- IPv4
- IPv6
An IPv4 address looks like:
192.0.2.10An IPv6 address looks something like:
2001:db8::10IPv4 has a limited address space, which contributed to the development and adoption of IPv6.
DNS can contain records for both types.
What Is an A Record?
An A record maps a hostname to an IPv4 address.
For example:
example.com → 192.0.2.10A simplified DNS record might look like:
Type: A
Name: @
Value: 192.0.2.10The @ symbol is commonly used by DNS management interfaces to represent the root domain itself.
So this could mean:
example.compoints to:
192.0.2.10A records are among the most commonly used DNS records for websites.
What Is an AAAA Record?
An AAAA record performs a similar job for IPv6.
For example:
example.com → 2001:db8::10A website can have both:
A
AAAArecords.
This allows clients using IPv4 or IPv6 to connect where the network and server configuration support them.
A common beginner mistake is to update an A record while forgetting that an AAAA record still points somewhere else.
This can create confusing behavior.
For example, one network may use IPv4 while another uses IPv6.
If the A record points to the new server but the AAAA record still points to the old server, users can experience different results depending on which protocol their connection uses.
What Is a CNAME Record?
A CNAME record creates an alias for another hostname.
For example:
www.example.com → example.comA CNAME does not normally point directly to an IP address.
Instead, it points to another domain name.
For example:
www → example.comThe DNS system can then resolve the target name.
CNAME records are commonly useful for subdomains.
For example:
blog.example.commight point to a hostname provided by another service.
CNAME and A Records Are Not the Same
Consider:
A:
example.com → 192.0.2.10versus:
CNAME:
blog.example.com → hosting.example.netThe first directly associates the hostname with an IPv4 address.
The second says that the hostname is an alias for another hostname.
This distinction becomes important when configuring third-party services.
What Is an MX Record?
An MX record is used to identify mail servers responsible for receiving email for a domain.
For example:
example.com
↓
MX
↓
mail.example.netThis is separate from the website.
That means you can move your website to a new hosting provider without necessarily moving your email service.
For example:
Website:
example.com → New Web Server
Email:
example.com → Existing Mail ProviderThis is an important reason to be careful when changing DNS.
A person may intend to change only the website but accidentally remove or modify email-related records.
What Is a TXT Record?
TXT records contain text information associated with a domain.
They are widely used for verification and security-related purposes.
For example, services may ask you to add a TXT record to prove that you control a domain.
TXT records are also commonly involved in email authentication systems such as:
- SPF
- DKIM-related configuration
- DMARC-related information
They can also be used for other domain verification purposes.
Because TXT records have many uses, you should follow the exact instructions provided by the service requiring them.
SPF, DKIM and DMARC
Email systems use several mechanisms to help reduce spoofing and improve trust.
These terms can sound complicated, but their general purpose can be understood separately.
SPF
SPF, or Sender Policy Framework, allows a domain to publish information about which servers are authorized to send email for that domain.
It is commonly represented using a DNS TXT record.
DKIM
DKIM, or DomainKeys Identified Mail, uses cryptographic signatures to help receiving systems verify that an email was authorized and that relevant signed content has not been improperly modified.
The public key is published through DNS.
DMARC
DMARC builds on email authentication mechanisms such as SPF and DKIM and allows a domain owner to publish a policy describing how receiving systems should handle messages that fail authentication checks.
DMARC also provides reporting capabilities.
These technologies are especially important for organizations sending email from their own domains.
What Is an NS Record?
NS stands for Name Server.
NS records identify the authoritative name servers for a domain.
For example, a registrar may tell a domain:
Use these DNS servers:
ns1.example-dns.com
ns2.example-dns.comThose servers are responsible for providing authoritative DNS information for the domain.
This is why changing your domain's nameservers can effectively move DNS management from one provider to another.
Domain Registrar vs DNS Provider
These services are often confused.
A domain registrar is responsible for domain registration services.
A DNS provider operates DNS infrastructure for the domain.
Sometimes the same company provides both services.
Sometimes they are separate.
For example:
Domain Registrar
|
| nameserver configuration
v
DNS Provider
|
| DNS records
v
Web Server / Email / Other ServicesThis means you can register a domain with one company and use another company's DNS infrastructure.
What Are Authoritative DNS Servers?
An authoritative DNS server is a server that has authoritative information for a domain's DNS zone.
If a resolver asks:
What is the A record for example.com?the authoritative DNS infrastructure ultimately provides the answer for that domain.
The authoritative server does not need to know every domain on the internet.
It is responsible for the DNS zones it serves.
What Is a DNS Zone?
A DNS zone is a portion of the DNS namespace managed under a particular administrative authority.
For a domain, the zone may contain records such as:
A
AAAA
CNAME
MX
TXT
NSand other record types.
A simple zone might conceptually contain:
example.com A 192.0.2.10
www.example.com CNAME example.com
mail.example.com A 192.0.2.20
example.com MX mail.example.comThis is essentially a set of instructions describing how services associated with the domain should be resolved.
What Is the Root DNS System?
DNS is hierarchical.
At the top is the DNS root.
Below the root are top-level domains such as:
.com
.org
.netand country-code top-level domains such as:
.pk
.uk
.deBelow those are individual domains.
For example:
.
└── com
└── example
└── wwwThe actual DNS infrastructure is distributed rather than being one giant database on one computer.
This distributed design is essential to the operation and scalability of the internet.
How a Resolver Finds an Address
Suppose a resolver needs to find:
www.example.comIt may need to follow the DNS hierarchy.
Conceptually:
Root
↓
.com
↓
example.com
↓
Authoritative server
↓
www.example.comThe resolver eventually obtains the relevant DNS record.
If the result is cacheable, it may retain the answer for the TTL period.
The next client asking for the same information may receive the cached result without the resolver repeating every step.
Why DNS Changes Can Take Time
A common complaint after changing DNS is:
“I changed the IP address, but my website still opens the old server.”
This can happen because DNS results may be cached.
For example:
Old IP:
192.0.2.10
New IP:
192.0.2.20The authoritative server may immediately have the new record.
But a resolver that cached the old answer may continue using it until the TTL expires.
There can also be additional caching at the device, browser, router, application, or network level.
Therefore, DNS changes should not always be expected to appear simultaneously everywhere.
Why Your Website Can Work on One Device but Not Another
This is one of the most confusing DNS problems for beginners.
Suppose:
Computer A → Website works
Computer B → Website does not workPossible causes include:
- Different DNS resolvers
- Different cached results
- IPv4/IPv6 differences
- Local DNS cache
- Browser cache
- Network-level filtering
- Incorrect DNS configuration
- Temporary resolver problems
This does not automatically mean that the website server is broken.
DNS should be checked separately from the web server.
What Is a Subdomain?
A subdomain is a hostname below the main domain.
For example:
example.comcould have:
www.example.com
blog.example.com
shop.example.com
api.example.com
mail.example.comEach can potentially have different DNS records and point to different infrastructure.
For example:
example.com → Main website
blog.example.com → Blog platform
api.example.com → API server
shop.example.com → E-commerce platformThis allows a single domain to support multiple services.
DNS and Third-Party Services
Modern websites frequently use external services.
For example, you might use:
- A web hosting provider
- A CDN
- An email provider
- A payment service
- A verification service
- A cloud platform
- A SaaS application
These services may ask you to create DNS records.
For example:
Add CNAME:
blog → provider.example.netor:
Add TXT:
verification=some-valueThis allows the third-party service to associate your domain with your account.
DNS and CDNs
A CDN, or Content Delivery Network, can sit between users and the origin infrastructure.
A simplified architecture might look like:
Visitor
|
v
DNS
|
v
CDN
|
v
Origin ServerThe CDN may cache static content and provide other network services.
DNS can therefore become part of the process used to direct users toward the CDN.
When configuring a CDN, the provider's DNS instructions should be followed carefully because the required records vary.
DNS and HTTPS Are Related but Different
DNS tells the client where to connect.
HTTPS protects communication between the client and the server using TLS.
The relationship can be simplified as:
DNS
↓
Find destination
↓
Connect to server
↓
TLS/HTTPS
↓
Secure HTTP communicationA correct DNS configuration does not automatically mean that HTTPS is configured correctly.
Similarly, an HTTPS certificate problem does not necessarily mean that DNS is broken.
Keeping these layers separate makes troubleshooting easier.
Why a Website May Show a Certificate Error After a DNS Change
Imagine you move your website from:
Old Serverto:
New Serverand update DNS.
Some visitors may reach the new server while others temporarily reach the old server because of caching.
If the old server has a certificate or configuration different from the new server, users may see different HTTPS behavior.
This is one reason migrations should be planned carefully.
The new server should be properly configured before traffic is moved.
DNS Troubleshooting: Start With the Domain
When a website does not open, do not immediately reinstall the server.
First ask:
Does the domain resolve correctly?
On Windows, you can use:
nslookup example.comYou can also query a particular hostname:
nslookup www.example.comThe result can help determine whether DNS is returning an address.
Using nslookup
A typical command might return information resembling:
Name: example.com
Address: 192.0.2.10If the expected IP address is different, investigate DNS.
If DNS returns the expected address but the website still does not work, the problem may be farther down the stack.
For example:
DNS → Correct
Server → Not respondingis a different problem from:
DNS → Incorrect
Server → Working correctlyThis distinction can save time.
Using ping Carefully
You may also see people recommend:
ping example.comPing can sometimes help determine whether a hostname resolves to an IP address.
However, ping is not a complete website test.
A server can block ICMP/ping while still serving websites perfectly through HTTPS.
Therefore:
Ping failsdoes not automatically mean:
Website is downUse ping as one diagnostic tool rather than the final test.
Using tracert on Windows
Windows also provides:
tracert example.comThis can show the path packets attempt to take toward the destination.
It can sometimes help investigate routing problems.
Again, it is not a direct replacement for testing HTTP or HTTPS.
Using dig on Linux
Linux systems commonly provide the dig command.
For example:
dig example.comYou can query specific record types:
dig example.com Aor:
dig example.com MXor:
dig example.com TXTThis is particularly useful for server administrators.
Checking Different DNS Resolvers
If you suspect caching or resolver differences, compare results using different DNS resolvers.
For example, your local resolver might return one result while another resolver has already updated.
This can help determine whether the issue is:
- Local caching
- Resolver caching
- Authoritative DNS configuration
- Incorrect records
The important thing is to compare results rather than assuming that one computer's result represents the entire internet.
Common DNS Mistake: Wrong IP Address
One of the simplest DNS problems is entering the wrong IP address.
Suppose your server's real address is:
192.0.2.20but the A record contains:
192.0.2.10DNS may work perfectly from a technical perspective.
It is simply providing the wrong destination.
This is an important lesson:
DNS can be functioning correctly while your DNS configuration is incorrect.
Common DNS Mistake: Forgetting www
A website owner may configure:
example.combut forget:
www.example.comThe result can be:
example.com → works
www.example.com → does not workA common solution is to configure an appropriate record for www, often as a CNAME or another suitable record depending on the hosting architecture.
Common DNS Mistake: Conflicting Records
DNS records can interact in ways that are not always obvious.
For example, trying to create incompatible record types for the same hostname can produce configuration errors or unexpected behavior.
One particularly important rule is that a hostname generally cannot simultaneously function as a conventional CNAME and have unrelated records at that same name.
DNS management interfaces may prevent some invalid configurations, but administrators should still understand what they are configuring.
Common DNS Mistake: Old Nameservers
Suppose you move DNS management from one provider to another.
You configure all the correct records at the new provider.
But the domain is still using the old nameservers.
In that case, your new DNS records may have no effect.
The chain is:
Domain
↓
Nameservers
↓
DNS Zone
↓
A/CNAME/MX/TXT/etc.If the domain points to the wrong nameservers, changing records in another DNS dashboard will not necessarily affect public resolution.
Common DNS Mistake: Accidentally Changing MX Records
Imagine your website and email are both working.
You move the website to a new host.
You replace the DNS records but accidentally delete:
MX
TXTrecords required by your email provider.
The website may work while email stops working.
This is why DNS changes should be made carefully and existing records should be documented before a migration.
DNS Backup Before Making Changes
DNS zones are configuration data.
Before making major changes, record your current configuration.
For example:
A records
AAAA records
CNAME records
MX records
TXT records
NS configuration
Other service-specific recordsYou can save screenshots, export a zone file if your provider supports it, or maintain your own documentation.
This makes it easier to recover from accidental changes.
Should You Use a Low TTL Before a Migration?
A common strategy during planned migrations is to reduce the TTL of relevant DNS records before changing them.
For example, a record that normally has a long TTL might temporarily use a shorter value before migration.
The purpose is to reduce how long old cached results may persist.
However, this does not mean every DNS change becomes instant.
Existing caches may still have previously obtained TTL values.
After the migration is complete, the TTL can be increased again if appropriate.
DNS Is Not a Magic Internet Switch
One of the most useful things to understand is that changing DNS does not instantly move your application.
Suppose you change:
example.comfrom:
Old serverto:
New serverYou also need the new server to be ready.
That means:
- Website files deployed
- Database migrated
- Application configured
- Firewall configured
- HTTPS configured
- DNS ready
- Email records preserved
- Backups available
DNS only changes where clients are directed.
It does not copy your website to the new server.
DNS and Website Migration
A safer website migration can look like this:
Step 1: Build the New Server
Install and configure the new application.
Step 2: Test It
Use a temporary hostname, local hosts-file testing, or another suitable method to verify the server.
Step 3: Migrate the Database
Move the required data.
Step 4: Configure HTTPS
Make sure the new server can correctly serve the domain.
Step 5: Verify the Application
Test login, forms, images, APIs, downloads, and other important functions.
Step 6: Change DNS
Update the relevant records.
Step 7: Monitor
Watch both the old and new environments during the transition.
This approach reduces the chance of changing DNS before the new server is ready.
Can DNS Improve Website Speed?
DNS itself is usually only one small part of the overall page-loading process.
A DNS lookup must happen before the browser can connect when no suitable cached result exists.
However, website performance depends on many other factors:
- Server response time
- Database queries
- JavaScript
- Images
- CSS
- Network latency
- CDN caching
- Compression
- Browser caching
- Application architecture
Therefore, changing DNS providers solely because you expect a huge website speed improvement may not solve the actual performance problem.
DNS performance can matter, but it is only one part of the complete request process.
DNS Security
DNS is fundamental infrastructure, so protecting DNS configuration is important.
A person who gains unauthorized control over DNS could potentially redirect users toward another infrastructure.
For example, an attacker who can change:
example.com → malicious servercould potentially redirect traffic.
This is why the account used to manage DNS should be protected with strong authentication and, where available, multi-factor authentication.
Domain registrar security is also important.
DNSSEC
DNSSEC stands for Domain Name System Security Extensions.
It provides cryptographic mechanisms that help validate DNS data and protect against certain forms of DNS tampering.
DNSSEC does not encrypt ordinary DNS queries.
Its primary purpose is authentication and integrity of DNS data.
Whether you should enable it depends on your domain, DNS provider, registrar, and operational requirements.
When enabled, it must be configured correctly because mistakes can make a domain difficult to resolve.
DNS Over HTTPS and DNS Over TLS
Traditional DNS queries can be sent using ordinary DNS transport.
Modern systems may also support encrypted DNS mechanisms such as:
- DNS over HTTPS (DoH)
- DNS over TLS (DoT)
These technologies protect the communication between the client and resolver in different ways.
They should not be confused with DNSSEC.
The concepts solve different problems.
DNSSEC helps authenticate DNS data.
DoH and DoT protect the connection between the client and DNS resolver.
DNS Does Not Replace a Firewall
Another common misunderstanding is that DNS can protect a server by itself.
It cannot.
A secure server still needs appropriate:
- Firewall rules
- Operating system updates
- Application security
- Authentication
- Access controls
- HTTPS
- Monitoring
- Backups
DNS is one layer of the system.
It should not be treated as a complete security solution.
DNS and Cloud Infrastructure
Modern cloud applications may use DNS for much more than a single A record.
A domain might eventually connect to:
CDN
Load balancer
Web servers
API
Object storage
Email provider
Monitoring service
Verification servicesFor example:
example.com
|
+--- Website
|
+--- api.example.com
|
+--- files.example.com
|
+--- mail.example.comDNS allows these services to coexist under the same domain structure.
As websites grow, DNS becomes an important part of the overall architecture.
DNS for Beginners: The Most Important Records
If you remember only a few record types, remember these:
| Record | Main Purpose |
|---|---|
| A | Maps a hostname to an IPv4 address |
| AAAA | Maps a hostname to an IPv6 address |
| CNAME | Creates an alias to another hostname |
| MX | Specifies mail-handling servers |
| TXT | Stores text information used for verification and other purposes |
| NS | Identifies authoritative nameservers |
There are additional DNS record types, but these are among the most commonly encountered when managing websites.
A Simple Mental Model
You can think of DNS like an internet address book.
The domain is the name you remember.
The DNS system helps find information associated with that name.
For example:
Name:
example.com
Website address:
192.0.2.10
Mail service:
mail.example.net
Verification information:
TXT records
Subdomain:
blog.example.comThis is not a perfect technical analogy, but it is useful for beginners.
The Difference Between DNS, HTTP and HTTPS
These three concepts are often mixed together.
DNS
Answers questions such as:
Where should this hostname resolve?
HTTP
Defines how web requests and responses are exchanged.
HTTPS
HTTP protected by TLS encryption and authentication mechanisms.
The simplified flow is:
DNS
↓
Find destination
↓
TCP/QUIC/network connection
↓
TLS for HTTPS where applicable
↓
HTTP request
↓
HTTP responseUnderstanding these layers makes troubleshooting much easier.
A Practical Troubleshooting Order
When a website does not work, check problems in layers.
1. Check the Domain
Does the domain resolve?
Use:
nslookup example.com2. Check the IP
Is the returned IP actually your server?
3. Check the Server
Is the server online?
4. Check the Web Server
Is Nginx, Apache, or another web server running?
5. Check the Application
Is your Python, PHP, Node.js, Java, or other application running?
6. Check the Database
Can the application connect to the database?
7. Check HTTPS
Is the certificate valid and configured for the correct hostname?
8. Check Application Logs
Look for errors rather than guessing.
This layered approach is much more effective than changing random settings.
Final Thoughts
DNS is one of those technologies that most internet users never think about until something stops working.
But once you start managing websites, domains, hosting, email, APIs, servers, or cloud services, understanding DNS becomes extremely valuable.
The most important concepts are relatively straightforward:
A domain name is a human-friendly name.
DNS translates that name into information that network clients can use.
A records commonly point to IPv4 addresses.
AAAA records are used for IPv6.
CNAME records create aliases between hostnames.
MX records direct email delivery.
TXT records are commonly used for verification and email-related information.
NS records identify authoritative nameservers.
DNS resolvers retrieve and cache DNS information.
TTL controls how long DNS results can generally be cached.
And DNS is separate from the actual web server.
When a website is not working, this distinction is extremely important.
If DNS points to the wrong server, repairing the web application will not solve the problem.
If DNS is correct but the server is down, changing DNS may not solve the underlying problem either.
If the website works but email has stopped, the MX or related email records may need investigation.
If one network sees the new website while another sees the old one, caching or different DNS paths may be involved.
The best way to troubleshoot DNS is therefore to stop treating the internet as one single system.
Think in layers:
Domain
↓
Nameservers
↓
DNS records
↓
IP address
↓
Network connection
↓
Web server
↓
Application
↓
DatabaseEach layer has a different job.
Once you understand those jobs, many mysterious website problems become much easier to diagnose.
And perhaps the most useful thing about learning DNS is that the knowledge remains relevant regardless of whether your website eventually runs on shared hosting, a VPS, a Raspberry Pi, a cloud server, a CDN, or a large distributed infrastructure.
The technology used to host the website may change over the years.
The fundamental role of DNS remains.

Comments
Post a Comment