Interactive guide
How DNS resolution works
When you type a domain name, your browser needs an IP address. DNS resolution is the process of walking a distributed hierarchy — from root servers to TLD servers to authoritative servers — to find that address. Step through the process below.
DNS resolution actors
Client
Browser + OS
Recursive Resolver
1.1.1.1 / 8.8.8.8
Root Server
13 clusters worldwide
TLD Server
.app registry
Authoritative NS
Domain's nameserver
Step 1 of 8
Your Browser
User types a URL
You type "stackcache.app" in the address bar. The browser checks its own DNS cache first. If the domain was resolved recently (within the TTL), the cached IP is used immediately and no query is sent.
Key concepts
Caching at every level
DNS responses are cached at four levels: the browser, the OS, the recursive resolver, and sometimes edge/CDN resolvers. Each cache respects the TTL value from the authoritative response. This is why DNS changes do not propagate instantly.
Iterative vs recursive queries
Your client makes a recursive query (asking the resolver to do all the work). The resolver then makes iterative queries to each server in the hierarchy, following referrals until it reaches the authoritative answer.
DNSSEC validation
DNSSEC adds cryptographic signatures to DNS responses. The recursive resolver validates these signatures at each step, building a chain of trust from the root zone to the authoritative server. This prevents DNS spoofing and cache poisoning.
DNS over HTTPS (DoH)
Traditional DNS queries are sent in plaintext over UDP port 53, visible to anyone on the network. DNS over HTTPS encrypts the query inside an HTTPS connection, preventing eavesdropping and manipulation by network intermediaries.
Typical timing breakdown
| Scenario | Latency | Steps |
|---|---|---|
| Browser cache hit | < 1 ms | 0 network requests |
| Resolver cache hit | 1-5 ms | 1 request to resolver |
| TLD cached, auth query needed | 10-50 ms | Resolver → authoritative |
| Full resolution (cold cache) | 50-200 ms | Resolver → root → TLD → auth |
| With DNSSEC validation | 80-300 ms | Full resolution + signature checks |
Frequently asked questions
How long does DNS resolution take?
A fully uncached DNS resolution (querying root, TLD, and authoritative servers) typically takes 20-120 milliseconds. Cached responses return in under 1 millisecond. This is why TTL values matter — higher TTLs mean fewer full resolutions.
What is a recursive resolver?
A recursive resolver is a DNS server that performs the full resolution process on behalf of clients. It walks the DNS hierarchy (root → TLD → authoritative) and caches results. Common public resolvers include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).
What happens if DNS resolution fails?
If the authoritative server is unreachable or returns SERVFAIL, the resolver may retry or try alternate servers. If all attempts fail, the browser shows a "DNS_PROBE_FINISHED_NXDOMAIN" or similar error. NXDOMAIN means the domain does not exist; SERVFAIL means the server encountered an error.
What is TTL in DNS?
TTL (Time To Live) is the number of seconds a DNS response can be cached before it must be re-queried. A TTL of 300 means resolvers cache the answer for 5 minutes. Lower TTLs allow faster propagation of changes but increase query load on authoritative servers.
Why are there only 13 root servers?
There are 13 root server identities (a through m), but hundreds of physical servers distributed worldwide via anycast. The number 13 is a historical constraint from the maximum size of a DNS UDP response (512 bytes), which could fit 13 NS records.
Look up DNS records yourself
Query A, AAAA, MX, TXT, CNAME, and other DNS records for any domain via DNS-over-HTTPS — all from your browser.
Open DNS Lookup