By the end of the lesson, you can say why an IP address is needed for a name, explain the actors of name resolution and the basic record types, and understand what TTL means, and what a successful DNS response does and does not prove.
Why do we need name resolution?
The name in a web address (kurzuspont.example) is an identifier understandable to both people and the service. The network, however, does not use names but IP addresses to target data packets. If the browser had to use a central, hand-maintained table for every name, it would not work worldwide: the table would be enormous and would constantly change. DNS solves this task in a distributed, hierarchical way: it gives a network address for a name. This step connects the URL with the data transfer.
DNS resolves the host name. It does not know the path /kurzusok; the web service will interpret that later.
The IP address
An IP address is the address of a network endpoint. Two formats live side by side:
Format
Example
Characteristics
IPv4
104.20.23.154
four numbers separated by dots
IPv6
2606:4700:10::6814:179a
hexadecimal groups separated by colons, a much larger address space
An IP address does not necessarily identify a single physical server: it can be an intermediary or the common entry point of many servers. The reverse is also true: several web names can share one address (this is why HTTP has the Host header, see 2.2).
The actors of name resolution
DNS is distributed and hierarchical. According to RFC 1034 it has three main components: the name space and the records, the name servers, which manage zones and are their authoritative sources, and the resolvers, which look up the information on behalf of the client.
The recursive resolver walks through the hierarchy on behalf of the client. This is usually the resolver of the internet service provider or a public service; the client asks this.
The hierarchy leads from the root through the top-level domains (.com, .hu) to the domain itself.
The authoritative name server gives the final answer about the records of its own zone.
flowchart LR
B[Browser] --> R[Recursive resolver]
R -->|if it has no valid answer| H[DNS hierarchy: root, TLD, authoritative server]
H --> R
R -->|record: address| B
B --> C[Connection to the received address]
The diagram shows one possible complete resolution, not the mandatory path of every page opening: the browser, the operating system, and the resolver can store an earlier result, in which case some steps are left out.
DNS records
A name server stores records. These are what we most often see on the web. The examples are real queries (dig command) for the example.com domain reserved for documentation purposes, the time of the query is 11 October 2026:
Record
Meaning
Example from the query
A
The IPv4 address of the name
example.com. 288 IN A 104.20.23.154 and 172.66.147.243
AAAA
The IPv6 address of the name
example.com. 194 IN AAAA 2606:4700:10::6814:179a
NS
The name server responsible for the zone
example.com. 86400 IN NS elliott.ns.cloudflare.com.
CNAME
An "alias" of a name pointing to another name
www.wikipedia.org. 19608 IN CNAME dyna.wikimedia.org.
MX
The mail-receiving server
example.com. 300 IN MX 0 .
Three observations:
Several addresses can belong to the same name (example.com gave two IPv4 and two IPv6 addresses). The order of the response can also change, which can help distribute the load.
A CNAME says "look up this name as well", so the provider can change the infrastructure behind it without the public name changing.
The MX record of example.com (0 .) is a "null MX" according to RFC 7505, which signals that the domain does not accept email.
Cache and TTL
Every record has a TTL (Time to Live): the time in seconds for which the response may be stored in the cache. The numbers in the example show this (288, 194, 86400 seconds). We asked the same resolver for the same record with two queries, four seconds apart:
example.com. 183 IN A 104.20.23.154
example.com. 183 IN A 172.66.147.243
...
example.com. 180 IN A 172.66.147.243
example.com. 180 IN A 104.20.23.154
The TTL decreased from 183 to 180, meaning the second response came from the resolver's cache, with the remaining validity time. (The order of the A records also changed.) Caching reduces latency and the load on name servers.
The consequence: if the provider changes an address, some resolvers may keep using the old answer until the TTL expires, so the change does not appear for everyone at once. This is taken into account when a service is moved: before the move, the TTL is shortened.
What does DNS answer and what does it not?
A nonexistent name also gets an answer: the query for kurzuspont.example returned an NXDOMAIN status, meaning DNS says "there is no such name". This error appears before HTTP, so there is no status code behind it.
DNS is not in itself the authentication of the content. A forged or faulty DNS response can lead to a wrong address. Certificate checking (4.2, 4.3) is a separate layer of protection: DNS looks up an address, while TLS provides the protection of the connection and the authentication of the named service.
Worked example: the name of Kurzuspont
The operator of Kurzuspont sets up the name kurzuspont.example as follows:
Name
Record
Meaning
kurzuspont.example
A / AAAA
the addresses of the web entry point
www.kurzuspont.example
CNAME → kurzuspont.example
the "www" variant leads to the same place
kurzuspont.example
MX
the servers for email (for the confirmation emails)
If the operator later moves to another provider, the public name does not change, only the addresses behind it. Students do not have to change anything, but because of the TTL some may still land on the old address for a while. (The table is a fictional setup, not a real query.)
Common misconceptions
Statement
Clarification
"DNS finds the file of the web page."
It gives network information for a name; the path is interpreted by the web service.
"A domain has a single, permanent IP address."
Several addresses and changing answers are possible.
"A successful DNS answer means the page works."
The connection and the HTTP request can still fail later.
"Every time a page is opened the whole DNS hierarchy must be walked again."
A valid answer from the cache can skip several steps.
"A DNS change is visible everywhere immediately."
Because of the TTL some resolvers use the old answer for a while.
In brief
DNS gives an IP address (and other records) for a name; it does not know the path.
The actors: recursive resolver, hierarchy, authoritative name server.
Important records: A, AAAA, NS, CNAME, MX.
The TTL determines how long a response may be stored; this is why a DNS change is not immediate.
DNS success does not prove that the page works, and it does not authenticate.
Review questions
What is the difference between the A and the AAAA record?
What does CNAME mean, and what is it good for?
Why does a DNS change not appear everywhere immediately?
What is the difference between a DNS error and a 404?
Domain name, IP address, and DNS
Objectives
By the end of the lesson, you can say why an IP address is needed for a name, explain the actors of name resolution and the basic record types, and understand what TTL means, and what a successful DNS response does and does not prove.
Why do we need name resolution?
The name in a web address (
kurzuspont.example) is an identifier understandable to both people and the service. The network, however, does not use names but IP addresses to target data packets. If the browser had to use a central, hand-maintained table for every name, it would not work worldwide: the table would be enormous and would constantly change. DNS solves this task in a distributed, hierarchical way: it gives a network address for a name. This step connects the URL with the data transfer.DNS resolves the host name. It does not know the path
/kurzusok; the web service will interpret that later.The IP address
An IP address is the address of a network endpoint. Two formats live side by side:
104.20.23.1542606:4700:10::6814:179aAn IP address does not necessarily identify a single physical server: it can be an intermediary or the common entry point of many servers. The reverse is also true: several web names can share one address (this is why HTTP has the
Hostheader, see 2.2).The actors of name resolution
DNS is distributed and hierarchical. According to RFC 1034 it has three main components: the name space and the records, the name servers, which manage zones and are their authoritative sources, and the resolvers, which look up the information on behalf of the client.
.com,.hu) to the domain itself.flowchart LR B[Browser] --> R[Recursive resolver] R -->|if it has no valid answer| H[DNS hierarchy: root, TLD, authoritative server] H --> R R -->|record: address| B B --> C[Connection to the received address]The diagram shows one possible complete resolution, not the mandatory path of every page opening: the browser, the operating system, and the resolver can store an earlier result, in which case some steps are left out.
DNS records
A name server stores records. These are what we most often see on the web. The examples are real queries (
digcommand) for theexample.comdomain reserved for documentation purposes, the time of the query is 11 October 2026:Aexample.com. 288 IN A 104.20.23.154and172.66.147.243AAAAexample.com. 194 IN AAAA 2606:4700:10::6814:179aNSexample.com. 86400 IN NS elliott.ns.cloudflare.com.CNAMEwww.wikipedia.org. 19608 IN CNAME dyna.wikimedia.org.MXexample.com. 300 IN MX 0 .Three observations:
example.comgave two IPv4 and two IPv6 addresses). The order of the response can also change, which can help distribute the load.CNAMEsays "look up this name as well", so the provider can change the infrastructure behind it without the public name changing.example.com(0 .) is a "null MX" according to RFC 7505, which signals that the domain does not accept email.Cache and TTL
Every record has a TTL (Time to Live): the time in seconds for which the response may be stored in the cache. The numbers in the example show this (288, 194, 86400 seconds). We asked the same resolver for the same record with two queries, four seconds apart:
The TTL decreased from 183 to 180, meaning the second response came from the resolver's cache, with the remaining validity time. (The order of the A records also changed.) Caching reduces latency and the load on name servers.
The consequence: if the provider changes an address, some resolvers may keep using the old answer until the TTL expires, so the change does not appear for everyone at once. This is taken into account when a service is moved: before the move, the TTL is shortened.
What does DNS answer and what does it not?
A nonexistent name also gets an answer: the query for
kurzuspont.examplereturned anNXDOMAINstatus, meaning DNS says "there is no such name". This error appears before HTTP, so there is no status code behind it.DNS is not in itself the authentication of the content. A forged or faulty DNS response can lead to a wrong address. Certificate checking (4.2, 4.3) is a separate layer of protection: DNS looks up an address, while TLS provides the protection of the connection and the authentication of the named service.
Worked example: the name of Kurzuspont
The operator of Kurzuspont sets up the name
kurzuspont.exampleas follows:kurzuspont.exampleA/AAAAwww.kurzuspont.exampleCNAME→kurzuspont.examplekurzuspont.exampleMXIf the operator later moves to another provider, the public name does not change, only the addresses behind it. Students do not have to change anything, but because of the TTL some may still land on the old address for a while. (The table is a fictional setup, not a real query.)
Common misconceptions
In brief
Review questions
Aand theAAAArecord?CNAMEmean, and what is it good for?404?Learning resources