Cyber Security Basics 📂 Slides · 7 of 11 55 min read

DNS Servers Explained — Root, TLD, Authoritative, ICANN Chain, Hosts File, nslookup & dig

An 18-slide interactive walkthrough of DNS from the ground up — what a DNS server is, how DHCP hands you your resolver, what the hosts file does, and the full 8-step animated resolution flow through Root → TLD → Authoritative servers. Covers all four DNS server types, DNS record types (A, MX, CNAME, TXT, NS), the ICANN → IANA → Registry → Registrar → Owner ownership chain, root servers in India managed by NIXI, plus real nslookup and dig command examples and DNS security threats

📖

DNS Servers — The Phonebook of the Internet

What DNS is, who gives your computer its DNS address, the hosts file, the four types of DNS servers, and how a single lookup travels through Root → TLD → Authoritative — with nslookup and dig.
What is DNS Root · TLD · Auth Full Resolution nslookup · dig

Press Next → or use ← → arrow keys

Section 01

What is a DNS Server?

The Internet's Phonebook
Humans remember names (google.com, wikipedia.org). Computers only route to numbers (142.250.183.174, 208.80.154.224).

A DNS server is the phonebook that translates human names into those numeric IP addresses — so you never have to memorise them.
🎯
DNS in One Sentence

DNS (Domain Name System) is the distributed, hierarchical service that turns example.com into 93.184.216.34the very first thing that happens before any web request, email, or app connection.

1 · 1983DNS invented (RFC 882/883)
13Root server clusters worldwide
<50msTypical lookup time
TrillionsDNS queries per day
Section 01 · Usage

Where DNS Is Used — Everywhere

🌐
Web Browsing
every URL
Type youtube.com → DNS lookup → IP → HTTPS connection. Every single page load starts with DNS.
📧
Email Routing
MX records
Sending to you@company.com? Mail server asks DNS for the MX record to find where mail goes.
📱
Every App
API endpoints
WhatsApp, Instagram, banking apps — all connect to backend servers via DNS lookups behind the scenes.
☁️
Cloud & CDN
geo-routing
DNS steers you to the nearest CloudFront / Akamai / Cloudflare edge — faster loads, less latency.
🔒
Security
SPF, DKIM, DMARC
Email-authentication records live in DNS. Ad-blockers & parental filters also work at the DNS layer.
⚖️
Load Balancing
round-robin
One name can resolve to many IPs. DNS spreads traffic across servers for scale and failover.
Section 01 · Benefits

10 Benefits of DNS Over Raw IP Addresses

Benefit Why it matters Example
1. Easy to remember Humans remember names far better than numbers. www.google.com vs 142.250.183.78
2. IP can change A server's IP may change, but the domain name stays the same — only the DNS record is updated. A website moves to a new host without users noticing.
3. Load balancing One name resolves to many IPs, spreading traffic across servers. amazon.com points to many servers worldwide.
4. High availability If one server fails, DNS steers users to a healthy replacement. Automatic failover during a server outage.
5. Geographic routing DNS returns different IPs based on the user's location — nearest server wins. Indian users → Mumbai edge, US users → New York edge.
6. Easier management Admins update one DNS record instead of notifying every user of a new IP. Server migration = one DNS change.
7. Multiple services DNS stores different record types for web, email, VoIP and more. MX for email, A/AAAA for websites.
8. Scalability Large orgs can add or remove servers without changing the domain name. microsoft.com serves millions with no name change.
9. Better UX Meaningful names are easier to type, share and trust than numeric IPs. facebook.com vs 157.240.229.35
10. Security features Modern DNS supports DNSSEC, DoH and DoT for authenticity + privacy. Prevents spoofing & encrypts DNS queries.
🎯
One-Line Summary

DNS is the layer of indirection that decouples what humans use (names) from what the network uses (numbers) — enabling scale, resilience, geography-aware delivery and security that raw IPs alone can never provide.

Section 02

Who Gives Your Computer Its DNS Server?

🔑 THREE WAYS YOUR PC LEARNS ITS DNS SERVER
DHCP
Default — from your router. When your PC/phone joins Wi-Fi or a wired LAN, it asks for an IP via DHCP. The router replies with an IP, a gateway, and a DNS server address — usually the router itself, which forwards to the ISP.
ISP
Behind the router — from your ISP. Airtel, Jio, Comcast etc. give the router their own DNS servers, so unless you change it, your ISP sees every domain you look up.
MANUAL
Set by hand — public resolvers. You can override with Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, etc. Common for privacy, speed, or filtering.
GPO / MDM
Enterprise — pushed by IT. On corporate laptops, Group Policy or MDM forces internal DNS servers so the company can resolve intranet, log queries and block bad domains.
🔒
Privacy Tip

Your DNS provider sees every website your device visits. Switching to 1.1.1.1 or 9.9.9.9 (with DoH/DoT enabled) hides that traffic from your ISP.

Section 02 · Verify

Check It Yourself — ipconfig /all

💻 WINDOWS · Command Prompt
C:\Users\Mohit> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : DESKTOP-MOHIT Ethernet adapter Wi-Fi: Connection-specific DNS Suffix . : home Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 Physical Address. . . . . . . . . : A4-B1-C1-D2-E3-F4 DHCP Enabled. . . . . . . . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.1.42 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 192.168.1.1 ← your router 8.8.8.8 ← Google (backup)
🐧 LINUX / macOS
$ cat /etc/resolv.conf # Generated by NetworkManager nameserver 192.168.1.1 nameserver 1.1.1.1 $ scutil --dns # macOS — full DNS config
🔍
What to Look For

The DNS Servers line tells you the resolvers your computer will query. If it says 192.168.1.1 that's your router — and behind it, your ISP's DNS.

Section 03

The Hosts File — DNS Before There Was DNS

One text file. Copied to every computer. By hand.
Before DNS existed (pre-1983), the whole ARPANET shared a single file called HOSTS.TXT maintained at Stanford. Every computer downloaded it manually. Every time a new host joined the network, everyone had to re-download.

It obviously didn't scale — which is exactly why DNS was invented. But the file itself never went away. Every modern OS still has a hosts file, and it's checked BEFORE any DNS query.
📄 EXAMPLE HOSTS FILE
# Windows: C:\Windows\System32\drivers\etc\hosts # Linux / macOS: /etc/hosts 127.0.0.1 localhost ::1 localhost # Local development — override live domains 127.0.0.1 myapp.local 192.168.1.50 printer.home # Block a site (send it to nowhere) 0.0.0.0 ads.example.com 0.0.0.0 tracker.badsite.com
⚠️
Security Angle

Because hosts is checked first, malware often modifies it to hijack banking sites — point hdfcbank.com to an attacker's IP and the browser never even asks DNS. Always keep hosts read-only when not editing it.

Section 04

The DNS Hierarchy — a Global Tree

. ROOT .com TLD .in TLD .org TLD google AUTH nic AUTH wiki AUTH
🌳
Read It Right-to-Left

A name like www.google.com. is read backwards: root (.).com TLD → google zone → the www host inside it. Every DNS lookup walks this tree.

Section 04 · Types

The Four Types of DNS Servers

🔁
Recursive Resolver
"non-authoritative"
The one your PC talks to (from DHCP or 8.8.8.8). Does all the legwork on your behalf, walks the tree, and caches the answer. It doesn't own the data — it just fetches it.
🌍
Root Server
13 clusters worldwide
The top of the tree (.). Doesn't know any specific domain — but knows which TLD server to ask (e.g. "go ask .com's server").
🏷️
TLD Server
Top-Level Domain
Owns a whole extension — .com, .in, .org. Knows which authoritative server owns each specific domain under it.
📌
Authoritative Server
the source of truth
Actually owns the records for a specific domain (e.g. google.com's NS servers). Its answer is the definitive one.
📖
Cache / Stub Resolver
on your device
A tiny in-OS cache that remembers recent lookups so your browser doesn't re-query for every page load.
🔀
Forwarder
middleman
A DNS server that doesn't recurse itself — it just forwards queries to another recursive resolver (common on home routers & enterprise firewalls).
Section 04 · Ownership

Who Actually Owns the DNS? — ICANN Chain

🏛️ ICANN non-profit · global oversight 📜 IANA Root Zone · IP · protocols .com Registry VeriSign .org PIR .in 🇮🇳 NIXI Other TLDs .net · .io · 1500+ 🛒 Registrars GoDaddy · Namecheap · Google Domains 👤 Domain Owners (you)
🔗
The Ownership Ladder

ICANN (non-profit) sets policy → IANA (inside ICANN) publishes the Root Zone → Registries operate each TLD (VeriSign for .com, NIXI for .in) → Registrars (GoDaddy, Namecheap…) sell you the name → you, the domain owner, point it at your servers.

Section 04 · India

Root Servers in India — Who Runs Them, Where They Sit

🌍
Global Reality First

There are only 13 logical root servers worldwide, named A through M, operated by 12 different organisations (VeriSign, USC-ISI, Cogent, U.Maryland, NASA, ISC, US-DoD, US Army, Netnod, RIPE NCC, ICANN, WIDE Japan). But every one of them uses anycast — meaning hundreds of physical mirror instances worldwide, including many in India.

RootOperatorAnycast instances in India
F-rootISC (Internet Systems Consortium)Mumbai · Delhi · Chennai · Bengaluru · Hyderabad · Guwahati · Bhopal
I-rootNetnod (Sweden)Delhi · Bengaluru
J-rootVeriSignMumbai · Bengaluru
K-rootRIPE NCC (Europe)Mumbai · Delhi
L-rootICANNDelhi · Mumbai · Chennai · Bengaluru
🇮🇳
Who Manages Root Servers in India?

NIXI (National Internet Exchange of India) hosts and peers most root-server anycast instances inside India via its IXPs in Delhi, Mumbai, Chennai, Bengaluru, Hyderabad, Kolkata, Guwahati & more. NIXI also runs the .in registry. So while no root server is owned by an Indian entity, India has multiple root-server mirrors kept up by NIXI in partnership with ISC, ICANN, RIPE NCC and others — keeping DNS queries fast & resilient without leaving the country.

Section 05 · Full Flow

How DNS Actually Works — Full Resolution

💻 User / Browser "open google.com" 🔁 Recursive Resolver non-authoritative e.g. 8.8.8.8 / 1.1.1.1 🌍 ROOT ( . ) "ask a .com TLD server" 🏷️ TLD (.com) "ask google.com's NS" 📌 AUTHORITATIVE google.com → 142.250.183.174 1 2 3 4 5 6 7 8 1. Ask resolver 8. Get final IP + cache Cache check first (hosts, OS, browser)
🎬
The 8-Step Journey (watch the loop)

1. Browser asks recursive resolver  2. Resolver asks Root  3. Root replies "ask .com TLD"  4. Resolver asks .com TLD  5. TLD replies "ask google.com's NS"  6. Resolver asks Authoritative  7. Authoritative replies with the IP  8. Resolver returns to browser (and caches).

Section 06

Common DNS Record Types

RecordWhat it storesExample
AIPv4 address for a namegoogle.com → 142.250.183.174
AAAAIPv6 addressgoogle.com → 2404:6800:4007::200e
CNAMEAlias — points one name to anotherwww.example.com → example.com
MXMail server for the domainexample.com → mail.example.com
NSAuthoritative name serversgoogle.com → ns1.google.com
TXTFree-form text — SPF, DKIM, verification"v=spf1 include:_spf.google.com ~all"
PTRReverse DNS — IP back to name8.8.8.8 → dns.google
SOAStart of Authority — zone metadataserial · refresh · TTL
CAAWhich CAs may issue SSL certsexample.com CAA 0 issue "letsencrypt.org"
Section 07

nslookup — the Cross-Platform Tool

nslookup ships with Windows, Linux and macOS. Fast and simple for basic checks.

🔍 BASIC LOOKUP
$ nslookup google.com Server: 192.168.1.1 ← the resolver you queried Address: 192.168.1.1#53 Non-authoritative answer: ← came from cache, not authoritative Name: google.com Address: 142.250.183.174 ← the IP Name: google.com Address: 2404:6800:4007:820::200e
🎯 LOOKUP A SPECIFIC RECORD TYPE
$ nslookup -type=MX gmail.com gmail.com mail exchanger = 5 gmail-smtp-in.l.google.com gmail.com mail exchanger = 10 alt1.gmail-smtp-in.l.google.com $ nslookup -type=NS wikipedia.org wikipedia.org nameserver = ns0.wikimedia.org wikipedia.org nameserver = ns1.wikimedia.org $ nslookup google.com 8.8.8.8 # query a specific resolver
Section 07 · Pro Tool

dig — the Sysadmin's Favourite

dig is more powerful and readable than nslookup. Native on Linux/macOS; install BIND tools on Windows.

🔬 BASIC DIG
$ dig google.com ; <<>> DiG 9.16 <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 278 IN A 142.250.183.174 ;; Query time: 14 msec ;; SERVER: 192.168.1.1#53(192.168.1.1)
🎯 USEFUL DIG FLAGS
$ dig +short google.com # just the IP 142.250.183.174 $ dig MX gmail.com +short # MX records only 5 gmail-smtp-in.l.google.com. $ dig +trace google.com # WATCH the full walk from root! # Shows Root → TLD → Authoritative step-by-step $ dig @1.1.1.1 example.com # use Cloudflare's resolver $ dig -x 8.8.8.8 # reverse lookup: IP → name
🧪
Try This Right Now

Run dig +trace www.google.com on any Linux/macOS terminal. It literally replays the animated diagram from the previous slide — Root → .com TLD → Google's NS → final IP. There's no better way to understand DNS.

Section 08

DNS Security Threats

🎭
DNS Spoofing / Cache Poisoning
Attacker injects fake answers into a resolver's cache. Users are silently sent to a phishing IP for hours.
🚪
DNS Hijacking
Malware changes your device's DNS setting, or an attacker compromises your router — every lookup goes through the attacker.
📡
DNS Tunneling
Data exfiltration hidden inside DNS queries. Bypasses many firewalls because DNS is almost never blocked.
🌊
DDoS on DNS
Take down a DNS provider (Dyn, 2016) → knock Twitter, Netflix, Reddit offline simultaneously.
🔐
DNSSEC
Cryptographically signs DNS answers so resolvers can verify authenticity. Stops most spoofing — still under-deployed.
🔒
DoH / DoT
DNS-over-HTTPS & DNS-over-TLS encrypt queries so your ISP can't see or tamper with them.
Section 09 · Part 1

DNS Golden Rules — 1 to 4

🏆 KEY TAKEAWAYS · 1–4
1
DNS is the internet's phonebook. Every URL, email, and app connection starts with a DNS lookup. When DNS breaks, "the internet" appears broken.
2
Check who your resolver is. Run ipconfig /all (Windows) or cat /etc/resolv.conf (Linux). If it says your router's IP, your ISP sees every domain you visit.
3
Hosts file is checked BEFORE DNS. Great for local dev, blocking ads, or debugging — but a common malware target. Keep it read-only.
4
Learn the hierarchy: Root → TLD → Authoritative. Root doesn't know your domain — it knows the TLD server. TLD doesn't know your record — it knows the authoritative NS. Authoritative owns the truth.
Section 09 · Part 2

DNS Golden Rules — 5 to 8

🏆 KEY TAKEAWAYS · 5–8
5
"Non-authoritative" just means "cached." Your recursive resolver isn't lying — it's giving you the copy it saved from a previous walk to the authoritative NS. Fast and normal.
6
Know your record types. A/AAAA for IPs, MX for email, NS for authoritative servers, TXT for SPF/DKIM/verification, CNAME for aliases.
7
Master nslookup and dig. They're your first troubleshooting tools. dig +trace is the single best way to see DNS work.
8
Protect DNS with DNSSEC and DoH/DoT. DNS spoofing, hijacking and tunnelling are real attacks. Signing (DNSSEC) proves authenticity; encryption (DoH/DoT) hides queries from ISPs and attackers.
FINAL

You Now Understand DNS End-to-End

1983DNS invented
4Server types
8Steps in resolution
9+Common record types
2Core CLI tools
1930Report DNS scams (India)
🎯
The Full Picture

You now know what DNS is, who supplies your resolver via DHCP, why the hosts file still matters, how Root → TLD → Authoritative servers cooperate, and how to inspect real DNS traffic with nslookup and dig +trace.

📚
Where To Go Next

Read RFC 1034 & 1035 (the original DNS specs). Set up Pi-hole or AdGuard Home to run your own resolver. Try switching your device to 1.1.1.1 with DoH enabled and see the difference.

📖 End of tutorial · Press to review, or click Restart