Humans remember domain names like google.com, but computers need IP addresses like 142.250.183.46 to route packets. Without DNS lookup, every website visit would require knowing its numeric IP address.
DNS lookup is the process of translating a human-readable domain name into a machine-readable IP address. It checks multiple caches and queries a hierarchical chain of DNS servers to find the IP.
The lookup follows this priority order:
- Browser Cache: Recently visited domains are cached by the browser
- OS Cache: Operating system maintains its own DNS cache
- Hosts File: Manual mappings (e.g.,
127.0.0.1 localhost) - Router Cache: Home/office router may cache DNS responses
- ISP DNS Server: Internet provider’s recursive resolver
- Recursive Resolution (if not cached):
- Root server: “Where is .com server?”
- TLD server: “Where is google.com server?”
- Authoritative server: “Here is the IP”
- Caching at every level speeds up repeated lookups
- TTL (Time To Live) controls how long entries are cached
- Recursive resolvers do the work so clients don’t need to query multiple servers
- UDP port 53 is used for standard queries (TCP for large responses)
- Built from: DNS Cache — caching is core to DNS lookup efficiency
- Builds into: TCP Handshake — IP from DNS used to establish TCP connection
- Related: DNS Hierarchy — the chain of servers queried
- Related: ARP Protocol — after DNS gives IP, ARP finds MAC address
- Contrasts with: Recursive DNS — DNS lookup includes caching, recursive is the fallback mechanism
- DNS poisoning can redirect users to malicious sites
- Cache poisoning attacks exploit trust in DNS responses
- Some ISPs hijack failed DNS lookups to show ads
- DNS over HTTPS (DoH) encrypts DNS queries for privacy