DNS Servers — The Phonebook of the Internet
nslookup and dig.
Press Next → or use ← → arrow keys
What is a DNS Server?
google.com, wikipedia.org).
Computers only route to numbers (142.250.183.174,
208.80.154.224).A DNS server is the phonebook that translates human names into those numeric IP addresses — so you never have to memorise them.
DNS (Domain Name System) is the distributed, hierarchical service that turns
example.com into 93.184.216.34 — the very first thing that happens
before any web request, email, or app connection.
Where DNS Is Used — Everywhere
youtube.com → DNS lookup → IP → HTTPS connection. Every single page load starts with DNS.you@company.com? Mail server asks DNS for the MX record to find where mail goes.10 Benefits of DNS Over Raw IP Addresses
| Benefit | Why it matters | Example |
|---|---|---|
| 1. Easy to remember | Humans remember names far better than numbers. | www.google.com vs 142.250.183.78 |
| 2. IP can change | A server's IP may change, but the domain name stays the same — only the DNS record is updated. | A website moves to a new host without users noticing. |
| 3. Load balancing | One name resolves to many IPs, spreading traffic across servers. | amazon.com points to many servers worldwide. |
| 4. High availability | If one server fails, DNS steers users to a healthy replacement. | Automatic failover during a server outage. |
| 5. Geographic routing | DNS returns different IPs based on the user's location — nearest server wins. | Indian users → Mumbai edge, US users → New York edge. |
| 6. Easier management | Admins update one DNS record instead of notifying every user of a new IP. | Server migration = one DNS change. |
| 7. Multiple services | DNS stores different record types for web, email, VoIP and more. | MX for email, A/AAAA for websites. |
| 8. Scalability | Large orgs can add or remove servers without changing the domain name. | microsoft.com serves millions with no name change. |
| 9. Better UX | Meaningful names are easier to type, share and trust than numeric IPs. | facebook.com vs 157.240.229.35 |
| 10. Security features | Modern DNS supports DNSSEC, DoH and DoT for authenticity + privacy. | Prevents spoofing & encrypts DNS queries. |
DNS is the layer of indirection that decouples what humans use (names) from what the network uses (numbers) — enabling scale, resilience, geography-aware delivery and security that raw IPs alone can never provide.
Who Gives Your Computer Its DNS Server?
intranet, log queries and block bad domains.
Your DNS provider sees every website your device visits. Switching to 1.1.1.1 or 9.9.9.9 (with DoH/DoT enabled) hides that traffic from your ISP.
Check It Yourself — ipconfig /all
The DNS Servers line tells you the resolvers your computer will query.
If it says 192.168.1.1 that's your router — and behind it, your ISP's DNS.
The Hosts File — DNS Before There Was DNS
HOSTS.TXT maintained at Stanford. Every computer downloaded it manually.
Every time a new host joined the network, everyone had to re-download.It obviously didn't scale — which is exactly why DNS was invented. But the file itself never went away. Every modern OS still has a
hosts file, and it's checked BEFORE any DNS query.
Because hosts is checked first, malware often modifies it to hijack banking sites —
point hdfcbank.com to an attacker's IP and the browser never even asks DNS.
Always keep hosts read-only when not editing it.
The DNS Hierarchy — a Global Tree
A name like www.google.com. is read backwards: root (.) →
.com TLD → google zone → the www host inside it.
Every DNS lookup walks this tree.
The Four Types of DNS Servers
.). Doesn't know any specific domain — but knows which TLD server to ask (e.g. "go ask .com's server")..com, .in, .org. Knows which authoritative server owns each specific domain under it.google.com's NS servers). Its answer is the definitive one.Who Actually Owns the DNS? — ICANN Chain
ICANN (non-profit) sets policy → IANA (inside ICANN) publishes the Root Zone → Registries operate each TLD (VeriSign for .com, NIXI for .in) → Registrars (GoDaddy, Namecheap…) sell you the name → you, the domain owner, point it at your servers.
Root Servers in India — Who Runs Them, Where They Sit
There are only 13 logical root servers worldwide, named A through M, operated by 12 different organisations (VeriSign, USC-ISI, Cogent, U.Maryland, NASA, ISC, US-DoD, US Army, Netnod, RIPE NCC, ICANN, WIDE Japan).
But every one of them uses anycast — meaning hundreds of physical mirror instances worldwide, including many in India.
| Root | Operator | Anycast instances in India |
|---|---|---|
F-root | ISC (Internet Systems Consortium) | Mumbai · Delhi · Chennai · Bengaluru · Hyderabad · Guwahati · Bhopal |
I-root | Netnod (Sweden) | Delhi · Bengaluru |
J-root | VeriSign | Mumbai · Bengaluru |
K-root | RIPE NCC (Europe) | Mumbai · Delhi |
L-root | ICANN | Delhi · Mumbai · Chennai · Bengaluru |
NIXI (National Internet Exchange of India) hosts and peers most root-server anycast instances inside India via its IXPs in Delhi, Mumbai, Chennai, Bengaluru, Hyderabad, Kolkata, Guwahati & more. NIXI also runs the .in registry. So while no root server is owned by an Indian entity, India has multiple root-server mirrors kept up by NIXI in partnership with ISC, ICANN, RIPE NCC and others — keeping DNS queries fast & resilient without leaving the country.
How DNS Actually Works — Full Resolution
1. Browser asks recursive resolver 2. Resolver asks Root 3. Root replies "ask .com TLD" 4. Resolver asks .com TLD 5. TLD replies "ask google.com's NS" 6. Resolver asks Authoritative 7. Authoritative replies with the IP 8. Resolver returns to browser (and caches).
Common DNS Record Types
| Record | What it stores | Example |
|---|---|---|
A | IPv4 address for a name | google.com → 142.250.183.174 |
AAAA | IPv6 address | google.com → 2404:6800:4007::200e |
CNAME | Alias — points one name to another | www.example.com → example.com |
MX | Mail server for the domain | example.com → mail.example.com |
NS | Authoritative name servers | google.com → ns1.google.com |
TXT | Free-form text — SPF, DKIM, verification | "v=spf1 include:_spf.google.com ~all" |
PTR | Reverse DNS — IP back to name | 8.8.8.8 → dns.google |
SOA | Start of Authority — zone metadata | serial · refresh · TTL |
CAA | Which CAs may issue SSL certs | example.com CAA 0 issue "letsencrypt.org" |
nslookup — the Cross-Platform Tool
nslookup ships with Windows, Linux and macOS. Fast and simple for basic checks.
dig — the Sysadmin's Favourite
dig is more powerful and readable than nslookup. Native on Linux/macOS; install BIND tools on Windows.
Run dig +trace www.google.com on any Linux/macOS terminal. It literally
replays the animated diagram from the previous slide — Root → .com TLD → Google's NS →
final IP. There's no better way to understand DNS.
DNS Security Threats
DNS Golden Rules — 1 to 4
ipconfig /all (Windows) or cat /etc/resolv.conf (Linux). If it says your router's IP,
your ISP sees every domain you visit.
DNS Golden Rules — 5 to 8
A/AAAA for IPs, MX for email, NS for authoritative servers,
TXT for SPF/DKIM/verification, CNAME for aliases.
nslookup and dig.
They're your first troubleshooting tools. dig +trace is the single best way to see DNS work.
You Now Understand DNS End-to-End
You now know what DNS is, who supplies your resolver via DHCP, why the hosts file still matters,
how Root → TLD → Authoritative servers cooperate, and how to inspect real DNS traffic with
nslookup and dig +trace.
Read RFC 1034 & 1035 (the original DNS specs). Set up Pi-hole or AdGuard Home to run your own resolver. Try switching your device to 1.1.1.1 with DoH enabled and see the difference.
📖 End of tutorial · Press ← to review, or click Restart