Guides DNS
What is DNS?
Every website and mail server is reachable on the internet via an IP address: a string of numbers like `192.0.2.44`. Those numbers are impossible to remember, so we use names instead. DNS (Domain Name System) is the system that looks those names up for you and turns them into the right address, every time you visit a site or send a mail. It happens in a fraction of a second and you normally don't notice it, until something goes wrong.
How a lookup works
Type example.com, and your computer asks for the address through a 'resolver' (usually your internet provider's, or a public one like Google or Cloudflare). That resolver looks it up in steps:
- first the root: 'who runs
.com?' - then the TLD
.com: 'who runsexample.com?' - then your nameservers: 'what is the address of
example.com?'
Each answer is briefly remembered (cached) along the way, so the next lookup doesn't have to walk the whole route again. That's why a lookup usually takes only a few milliseconds, even with billions of names.
Nameservers: where your records live
A domain's nameservers are the servers 'in charge' of your DNS records: they give the official answers. Usually those are your DNS provider's nameservers (often your hosting company or registrar), for example ns1.example.net and ns2.example.net.
Want to manage your DNS somewhere else? Then you point your domain at that new party's nameservers. That's a big change: from that moment on, all answers come from there. If your records aren't fully in place at that new party, your website and mail go down as soon as the switch takes effect.
TTL and propagation: why a change takes time
Every record has a TTL (Time To Live): the number of seconds resolvers may remember the answer before fetching it again. A TTL of 3600 means: cache for an hour.
That's why a DNS change isn't visible everywhere right away. It's called 'propagation'. Resolvers that still have the old answer in their cache keep using it until the TTL expires. Planning a change soon? Lower the TTL beforehand (e.g. 300 seconds) so the switch takes effect faster.
Domain, zone and records
A domain name reads right to left, getting more specific: in mail.example.com, .com is the TLD (top-level domain), example.com is the main domain, and mail is a subdomain. Everything you set for your domain (addresses, mail servers, security) lives in the 'zone': the collection of your domain's DNS records.
A 'record' is one line with a type (e.g. A or MX) and a value. Which types exist and what you use them for is covered in the guide on DNS record types.
Common mistakes
- Calling a change 'broken' too soon: give propagation time (TTL)
- Forgetting your domain can sit at two parties: the registrar (where you hold the domain) and the DNS provider (where the records live) aren't always the same
- A typo in a record: one wrong character and the website or mail won't work
- During a move, turning off the old DNS too soon, before the new nameservers are known everywhere
Frequently asked questions
What's the difference between DNS and an IP address?
An IP address is a server's actual address (a string of numbers). DNS is the system that translates the name you type into that IP address. The name is for people, the IP address for computers.
What is a resolver?
The service that does the lookup for you: it finds the right answer step by step and remembers it briefly. Often your internet provider's, or a public one like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare).
How long does a DNS change take?
It depends on the TTL the record had before your change. Usually within an hour, sometimes up to 24-48 hours for high TTLs or a nameserver switch. Setting a low TTL beforehand speeds it up.
What's the difference between registrar, DNS provider and hosting?
The registrar is where you hold the domain (the registration). The DNS provider manages your records (the nameservers). The hosting runs your website or mail. These can be three different parties, or all the same one.
Is DNS secure?
Not by default: plain DNS has no check on whether an answer is genuine. DNSSEC adds that check (see the DNSSEC guide), and DoH/DoT encrypt your DNS queries for privacy.