Domain Name System

The Domain Name System, usually abbreviated DNS, provides names that people can use to locate Internet resources and a distributed way for computers to retrieve information associated with those names. Its design grew out of the limits of maintaining a single, centrally distributed host file as the network expanded. DNS represents names in a hierarchy: in www.example.org, labels are separated by dots, with org at the top level, example beneath it, and www beneath that. The hierarchy supports delegation: the authority to manage part of the namespace can be passed to another organization or operator. A domain name is not itself a website or a URL; separate services, such as web hosting, must make content available at that name.

When an application needs information about a domain, it asks a resolver. A recursive resolver can first use an unexpired answer in its cache; otherwise it follows referrals through the DNS hierarchy. Root name servers direct it toward the relevant top-level domain, whose servers can refer it to the authoritative name servers for the domain. The authoritative servers publish the records for their zones. The resolver returns the requested data to the application and may cache it for the period specified by the record’s time to live (TTL). The 13 named root-server authorities are not just 13 individual machines: the root zone is served by hundreds of server instances in many countries.

DNS stores resource records rather than only a single address per name. An A record supplies an IPv4 address, while AAAA supplies an IPv6 address. An MX record identifies mail servers for a domain; other record types can describe name servers, aliases, or text used by services. A domain can therefore support a website, email, and other services through different records. DNS answers may be cached by resolvers, so a change to a record is not necessarily visible everywhere immediately; caching follows the record’s TTL and implementation behavior.

DNS is distributed, but its hierarchy depends on coordinated delegation and a common root. Registries, registrars, domain holders, and DNS operators carry out distinct roles at different levels; a domain holder typically arranges records through a DNS provider, while parent zones publish delegations to child zones. IANA publishes the root-server list and root-zone information. The 13 root-server names are operated by different organizations, and each authority is served by multiple instances around the world. A resolver normally starts its search with root hints, a list of root-server names and addresses included in or supplied to the resolver software.

DNS answers affect where Internet traffic is directed, so forged or altered data can mislead users and applications. DNS Security Extensions (DNSSEC) add data-origin authentication and integrity protection: a validating resolver can check that signed DNS data follows a chain of trust. DNSSEC does not encrypt DNS data or provide confidentiality, and it does not secure the content of a website itself. It is one part of Internet security, not a replacement for other safeguards.