DNS (the Domain Name System) is the internet’s directory: it translates human-readable domain names such as namechk.com into the numeric IP addresses computers use to find each other. When you type a web address, a DNS resolver asks a chain of servers (the root, the top-level domain server and the domain’s authoritative nameserver) for the right IP address, usually in milliseconds, and caches the answer for next time. Without DNS, you would need to remember a string of numbers for every website you visit.
This guide explains what DNS is, how a DNS lookup works step by step, the main DNS record types and how to change your DNS settings safely.
Updated October 2026.
Go to:
What is DNS and why is it necessary?
Every device connected to the internet has an IP address, such as 192.0.2.1 in IPv4 or 2001:db8::1 in IPv6. These numbers are how computers route data to each other, but they are hard for people to remember and they can change when a website moves to a new server.
The Domain Name System solves this by mapping names to numbers. You remember a domain name, and DNS finds the current IP address behind it. Website owners can move hosting providers, add email services or change servers simply by updating DNS records, without changing the address people type.
DNS is also distributed. Instead of one giant directory, responsibility is split across millions of servers around the world, which makes the system fast, resilient and able to scale.
How does DNS work?
A DNS lookup follows a hierarchy that mirrors the structure of a domain name. Reading a name from right to left, namechk.com has an implied root (the final dot), the top-level domain .com, and the second-level domain namechk.
The four types of DNS servers
- DNS resolver (recursive resolver): the server that receives your device’s question and does the work of finding the answer. It is usually run by your internet service provider, your company or a public DNS service.
- Root nameservers: the top of the hierarchy. They do not know a domain’s IP address, but they know which servers handle each top-level domain, such as .com or .uk. There are 13 root server identities (A through M) run by 12 operators, served by more than 2,000 server instances worldwide as of October 2026.
- TLD nameservers: servers for each top-level domain. The .com TLD servers, for example, know which authoritative nameservers are responsible for every .com domain.
- Authoritative nameservers: the servers that hold the actual DNS records for a domain, usually run by your domain registrar, web host or a DNS provider. They give the final answer.
What happens during a DNS lookup?
Here is what happens when you type a web address into your browser and the answer is not already cached:
- Your browser checks its own cache, then asks the operating system, which checks its cache.
- If there is no cached answer, your device sends a query to its configured DNS resolver.
- The resolver asks a root nameserver, which replies with the address of the TLD nameservers for that extension (for example, .com).
- The resolver asks the TLD nameserver, which replies with the domain’s authoritative nameservers.
- The resolver asks the authoritative nameserver, which returns the IP address from the domain’s A or AAAA record.
- The resolver sends the IP address back to your device and caches it.
- Your browser connects to that IP address and loads the website.
The whole process typically takes a fraction of a second. Because resolvers cache answers, most lookups skip steps 3 to 5 entirely.
What are the types of DNS queries?
DNS servers use three kinds of queries:
- Recursive query: the client asks the resolver for a complete answer. The resolver must either return the IP address or an error. Your device sends this type of query.
- Iterative query: the server returns the best answer it has, often a referral to another server closer to the answer. Resolvers use iterative queries when they talk to root and TLD servers.
- Non-recursive query: the server already knows the answer, either because it is authoritative for the domain or because the answer is cached, so it replies immediately.
What are the most common DNS record types?
DNS records are the instructions stored on authoritative nameservers. These are the ones most website and business owners use:
| Record | What it does | Example use |
|---|---|---|
| A | Points a name to an IPv4 address | example.com to 192.0.2.10 |
| AAAA | Points a name to an IPv6 address | example.com to 2001:db8::10 |
| CNAME | Makes one name an alias of another | www.example.com to example.com |
| MX | Says which mail servers receive email for the domain | Google Workspace or Microsoft 365 mail |
| TXT | Holds text, often for verification and email security | SPF, DKIM and DMARC records, site verification |
| NS | Lists the authoritative nameservers for the domain | Set at your registrar |
| SOA | Stores administrative details about the zone | Serial number, refresh timers |
| CAA | Lists which certificate authorities may issue SSL certificates | Limits issuance to Let’s Encrypt, for example |
TXT records are especially important for email. SPF, DKIM and DMARC all live in DNS and help your messages reach the inbox, as explained in our guide to email deliverability.
What is DNS caching and TTL?
DNS caching stores answers temporarily so repeat lookups are faster and lighter on the network. Browsers, operating systems, routers and resolvers all keep caches.
Each DNS record has a TTL (time to live), measured in seconds, that tells caches how long to keep it. A TTL of 3600 means one hour. Short TTLs let changes spread quickly, while long TTLs reduce lookups. When you plan to move a website or change email providers, lower the TTL a day or so beforehand so the switch takes effect faster.
“DNS propagation” is the time it takes for old cached records to expire around the world after you make a change. It depends on the TTL and on how often each resolver refreshes. Changing nameservers at your registrar can take up to 24 to 48 hours to be seen everywhere.
What is DNS security?
Because DNS was designed in the 1980s without built-in security, several protections have been added:
- DNSSEC adds digital signatures to DNS records so resolvers can verify that answers have not been forged. Many registrars let you enable it with one click.
- DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the queries between your device and the resolver, so others on the network cannot see or tamper with the domains you look up. Major browsers and operating systems support encrypted DNS.
- Protective DNS resolvers block domains known to host malware or phishing.
Common attacks include DNS spoofing (cache poisoning), which tricks a resolver into returning a fake address, and domain hijacking, where an attacker takes over a domain’s registrar account. Use a strong password and two-factor authentication at your registrar, and turn on registrar lock.
Should you use a third-party DNS resolver?
By default, your devices use your internet provider’s DNS resolver. You can switch to a public resolver instead. Popular free options include:
| Resolver | Primary IPv4 address | Notable features |
|---|---|---|
| Cloudflare | 1.1.1.1 | Focus on speed and privacy; 1.1.1.2 adds malware blocking |
| Google Public DNS | 8.8.8.8 | Large global network |
| Quad9 | 9.9.9.9 | Blocks known malicious domains; nonprofit |
A public resolver can be faster than your provider’s, can support encrypted DNS and can add malware filtering. Switching is safe, and you can change back at any time. You can set it on a single device in its network settings, or on your router so every device on your network uses it.
How do you manage DNS for your own domain?
When you register a domain, your registrar usually provides free DNS hosting. You can manage records there, point the domain to your website host’s nameservers, or use a dedicated DNS provider for extra speed and features. If you are still choosing a domain, check availability with Namechk and compare registrars in our list of the best domain name registrars.
FAQs
What is DNS in simple terms?
DNS, the Domain Name System, is the internet’s phone book. It converts domain names that people can remember, such as namechk.com, into the numeric IP addresses that computers use to locate each other. When you type a web address, a DNS resolver looks up the matching IP address so your browser knows which server to connect to.
How long does a DNS lookup take?
A DNS lookup usually takes a few milliseconds to a few hundred milliseconds. Most lookups are much faster than a full lookup because browsers, operating systems and resolvers cache answers for the duration of each record’s TTL. A slow or overloaded resolver can add noticeable delay, which is one reason some people switch to a faster public DNS service.
Is it safe to change my DNS server?
Yes, changing your DNS server is safe as long as you choose a reputable provider, such as Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8) or Quad9 (9.9.9.9). A good public resolver can be faster, support encrypted DNS and block malicious domains. You can change the setting on a device or router and switch back at any time.
What is DNS propagation?
DNS propagation is the time it takes for a DNS change to be seen by resolvers around the world. Resolvers keep cached copies of records until the record’s TTL expires, so some users see the old value for a while. Changes to individual records often appear within minutes to hours, while nameserver changes can take up to 24 to 48 hours.
What is the difference between a domain name and DNS?
A domain name is the address you register, such as example.com. DNS is the system that tells the internet what that address points to, using records such as A records for websites and MX records for email. You register a domain at a registrar, then manage its DNS records at the registrar, your web host or a DNS provider.
How many DNS root servers are there?
There are 13 root server identities, named A through M, operated by 12 organizations including Verisign, ICANN, NASA and RIPE NCC. Each identity is served by many physical servers using anycast, so as of October 2026 there are more than 2,000 root server instances around the world. Root servers point resolvers to the right top-level domain servers.
CHK_ YOUR NAME RIGHT NOW
Use our engine to quickly check your content right now!
