Other meanings of Domain Name System
Internet infrastructure
The Domain Name System (DNS) is the hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It translates human-readable domain names (like example.com) into the numerical IP addresses needed for locating and identifying computer services and devices with the underlying network protocols.
The DNS is often described as the "phonebook of the Internet" because it maps domain names to IP addresses. When a user types a URL, a DNS resolver (typically operated by an ISP or a public DNS service) queries a series of servers to find the corresponding IP address. The system is hierarchical: the root zone sits at the top, followed by top-level domains (TLDs) like .com, .org, and country-code TLDs (ccTLDs) like .uk, then second-level domains (e.g., example.com), and possibly subdomains (e.g., www.example.com).
DNS uses a distributed database, with each level managed by authoritative name servers. The root servers are operated by 12 organizations, including Verisign, the University of Maryland, and NASA, and they answer queries for the root zone, directing resolvers to TLD servers. This hierarchy ensures resilience and scalability, as no single server holds the entire mapping.1
Before DNS, hostname-to-address mappings were stored in a single file called HOSTS.TXT, maintained by the Stanford Research Institute (SRI). As the ARPANET grew, this centralized approach became impractical. In 1983, Paul Mockapetris, then at the University of Southern California's Information Sciences Institute, designed the DNS as part of the ARPANET's transition to the TCP/IP protocol suite. His RFC 882 and RFC 883 laid out the original specifications, which were later refined in RFC 1034 and RFC 1035.2
The first implementation was JEEVES, written by Mockapetris, and the first root server was installed at SRI. The system was designed to be scalable, hierarchical, and distributed, addressing the limitations of the HOSTS.TXT file. Over the years, DNS has evolved to support new record types (e.g., MX for mail, TXT for arbitrary text), security extensions (DNSSEC), and internationalized domain names (IDNs).3
DNS queries are typically sent over UDP port 53, with TCP used for large responses (e.g., DNSSEC-signed records). The system uses various record types: A and AAAA records map hostnames to IPv4 and IPv6 addresses, respectively; MX records specify mail servers; CNAME records alias one name to another; and TXT records can hold arbitrary text, often used for verification and SPF email authentication.4
DNS resolution involves several steps: a recursive resolver queries a root server, which directs it to a TLD server, which in turn points to the authoritative server for the domain. The resolver caches responses to improve performance, with each record having a time-to-live (TTL) value. Caching can lead to propagation delays when changes are made, a phenomenon known as DNS propagation.5
DNS was designed without security in mind, making it vulnerable to attacks such as cache poisoning, where an attacker injects false records into a resolver's cache. To address this, DNSSEC (Domain Name System Security Extensions) was developed, adding cryptographic signatures to DNS records to ensure authenticity and integrity. DNSSEC is now widely deployed, though not universal.
Privacy concerns have led to the adoption of DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt DNS queries to prevent eavesdropping and tampering. Major public resolvers like Cloudflare's 1.1.1.1 and Google Public DNS support these protocols. However, these technologies have sparked debates about centralization and control, as they can shift DNS traffic away from local ISPs.6
Beyond the basics, DNS has several niche and surprising dimensions. For instance, the root zone is managed by the Internet Assigned Numbers Authority (IANA), a function of ICANN, and changes to the root zone are processed by Verisign under a contract with the U.S. Department of Commerce. The root servers themselves are not physical machines but clusters of servers distributed worldwide, using anycast routing to provide redundancy.1
Another obscure fact: DNS can be used for purposes other than name resolution. For example, DNS tunneling can encapsulate other protocols (like SSH or HTTP) within DNS queries, often used to bypass firewalls, but also exploited by malware for command-and-control. Additionally, there are special-use domain names like .onion (for Tor hidden services) and .local (for mDNS), which are not part of the global DNS hierarchy.5
Historically, the first DNS root server was named "A" and is now operated by Verisign. The DNS protocol also includes the obscure ANY query type, which asks for all record types, but it is often disabled due to abuse. Furthermore, the DNS system has been extended to support internationalized domain names (IDNs) using punycode, allowing non-Latin scripts like Arabic or Chinese in domain names.3
DNS is a foundational technology of the Internet, and its design has influenced many distributed systems.
Help improve the encyclopedia. Reports go straight to the site manager.