How DNS Works and Why It Matters

What DNS does

Humans use names; computers route by IP address. DNS is the distributed directory that maps one to the other (RFC 1034 and 1035).

How a lookup works

1. Your device asks its recursive resolver (from your ISP, company or a public service).
2. If the answer is not cached, the resolver asks a root server, which points to the TLD servers (for example for .pk or .com).
3. The TLD server points to the domain's authoritative name servers.
4. The authoritative server returns the record; the resolver caches it for the record's TTL and answers you.

Common record types

Try it yourself:

dig example.com A +short
dig example.com MX
dig example.com TXT

Why defenders care

• Spoofing / cache poisoning can send users to the wrong server; DNSSEC adds signatures so resolvers can verify answers.
• Encrypted DNS (DNS over HTTPS, RFC 8484, and DNS over TLS) hides queries from on-path observers.
• Email authentication (SPF, DKIM, DMARC) lives in TXT records.
• Misconfigured zones can leak internal names: a zone transfer (AXFR) should only be allowed to secondary servers you control.
• DNS tunnelling hides data in queries; unusually long or frequent queries are a detection signal.
• Passive DNS and logs help investigations — see log analysis.

Practise

Capture a lookup in Wireshark with the display filter dns and identify the query and response. Learn more about the layers underneath in networking fundamentals.