Card 02/ 09
Resolving api.example.com, Step by Step
A recursive resolver asks three servers in turn and caches every answer it gets.
A full DNS lookup is a chain of questions: the operating system asks a recursive resolver, which asks a root server, a .com server and finally example.com's authoritative server, then returns the address and caches every answer. This is the lookup when nothing along the way has been cached.
The lookup, step by step
The operating system checks its own cache
The browser and the operating system keep recent answers. If api.example.com is there and has not expired, the lookup ends here, with no network traffic.
It asks the recursive resolver
The stub sends one query to the resolver configured for the network, usually handed out with the laptop's address. The resolver checks its own cache first.
The resolver asks a root server
The root server answers with a referral: the names and addresses of the servers for .com.
The resolver asks a .com server
The .com server answers with another referral: the servers that hold example.com's records.
The resolver asks the authoritative server
example.com's server returns the A record, 203.0.113.7, with a TTL of 300 seconds.
The resolver caches and answers
The resolver stores the answer and both referrals, each for its own TTL, and sends the address back to the laptop.
A first lookup like this takes several round trips, tens of milliseconds or more, before the browser can even start its connection. The second lookup is different. Another user of the same resolver asking for api.example.com within 300 seconds gets the answer from its cache in one round trip. A lookup for www.example.com skips the root and .com steps, because the referral to example.com's servers is cached for much longer.
That caching is why DNS can serve the whole internet: most queries never reach an authoritative server.
Each step is also a place a lookup can fail. A resolver that is down or unreachable fails every name at once. A referral that points to the wrong servers, after a domain moves to a new DNS provider, fails only that domain. An authoritative server missing a record answers NXDOMAIN, "no such name", and the resolver caches that too. Knowing the steps tells you which server to ask directly, with dig @server, to find the one giving the wrong answer.
← → move through sections and cards