Skip to content

Interactive guide

How DNS resolution works

When you type a domain name, your browser needs an IP address. DNS resolution is the process of walking a distributed hierarchy — from root servers to TLD servers to authoritative servers — to find that address. Step through the process below.

DNS resolution actors

Step 1 of 8

1

Your Browser

User types a URL

You type "stackcache.app" in the address bar. The browser checks its own DNS cache first. If the domain was resolved recently (within the TTL), the cached IP is used immediately and no query is sent.

Key concepts

Caching at every level

DNS responses are cached at four levels: the browser, the OS, the recursive resolver, and sometimes edge/CDN resolvers. Each cache respects the TTL value from the authoritative response. This is why DNS changes do not propagate instantly.

Iterative vs recursive queries

Your client makes a recursive query (asking the resolver to do all the work). The resolver then makes iterative queries to each server in the hierarchy, following referrals until it reaches the authoritative answer.

DNSSEC validation

DNSSEC adds cryptographic signatures to DNS responses. The recursive resolver validates these signatures at each step, building a chain of trust from the root zone to the authoritative server. This prevents DNS spoofing and cache poisoning.

DNS over HTTPS (DoH)

Traditional DNS queries are sent in plaintext over UDP port 53, visible to anyone on the network. DNS over HTTPS encrypts the query inside an HTTPS connection, preventing eavesdropping and manipulation by network intermediaries.

Typical timing breakdown

ScenarioLatencySteps
Browser cache hit< 1 ms0 network requests
Resolver cache hit1-5 ms1 request to resolver
TLD cached, auth query needed10-50 msResolver → authoritative
Full resolution (cold cache)50-200 msResolver → root → TLD → auth
With DNSSEC validation80-300 msFull resolution + signature checks

Frequently asked questions

How long does DNS resolution take?

A fully uncached DNS resolution (querying root, TLD, and authoritative servers) typically takes 20-120 milliseconds. Cached responses return in under 1 millisecond. This is why TTL values matter — higher TTLs mean fewer full resolutions.

What is a recursive resolver?

A recursive resolver is a DNS server that performs the full resolution process on behalf of clients. It walks the DNS hierarchy (root → TLD → authoritative) and caches results. Common public resolvers include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).

What happens if DNS resolution fails?

If the authoritative server is unreachable or returns SERVFAIL, the resolver may retry or try alternate servers. If all attempts fail, the browser shows a "DNS_PROBE_FINISHED_NXDOMAIN" or similar error. NXDOMAIN means the domain does not exist; SERVFAIL means the server encountered an error.

What is TTL in DNS?

TTL (Time To Live) is the number of seconds a DNS response can be cached before it must be re-queried. A TTL of 300 means resolvers cache the answer for 5 minutes. Lower TTLs allow faster propagation of changes but increase query load on authoritative servers.

Why are there only 13 root servers?

There are 13 root server identities (a through m), but hundreds of physical servers distributed worldwide via anycast. The number 13 is a historical constraint from the maximum size of a DNS UDP response (512 bytes), which could fit 13 NS records.

Look up DNS records yourself

Query A, AAAA, MX, TXT, CNAME, and other DNS records for any domain via DNS-over-HTTPS — all from your browser.

Open DNS Lookup