DNS explained: the phone book of the internet
DNS explained: the Domain Name System is the invisible backbone of the internet. In this article DNS is explained in an understandable way, so that you know exactly how domain names are translated into IP addresses.
Every time you visit a website, something happens in the background. You type "example.nl" into your browser, but computers work with numbers (IP addresses). DNS handles the translation. Without DNS you would have to memorize 185.199.108.153 instead of github.com. In this article we explain how DNS works and why it is so important.
What is DNS?
DNS stands for Domain Name System. It is like a phone book for the internet: you look up a name (domain) and get the number (IP address) back. This system is essential to how we use the internet.
Imagine you could not store contacts in your phone and had to memorize every phone number. That is what the internet would be like without DNS. Instead of easy names, you would have to type strings of numbers: 142.250.185.206 for Google, 157.240.1.35 for Facebook, and so on.
When you type example.nl, the following happens in fractions of a second:
- Your browser asks a DNS server: "What is the IP of example.nl?"
- The DNS server looks it up in its database
- The IP address (for example 93.184.216.34) is sent back
- Your browser connects to that IP address
- The website loads on your screen
This whole process is called "DNS resolution" and takes only milliseconds, but it happens with every website you visit.
How DNS works technically
DNS is a hierarchical system with multiple layers. When your browser wants to look up a domain, the request goes through several steps:
1. The browser cache
First, your browser checks its own memory. If you recently visited the same website, the IP address is still stored there.
2. The operating system
Next, your computer looks in its own DNS cache. Windows, Mac and Linux all keep a local cache of recently visited domains.
3. The resolver (your provider)
If the answer is not available locally, your computer asks a resolver. This is usually the DNS server of your internet provider. The resolver has a large cache with millions of domains.
4. The root nameservers
If the resolver does not know the answer, it asks the root nameservers. There are 13 root server clusters worldwide that know where to find information about top-level domains (.nl, .com, .org).
5. The TLD nameservers
The root server points to the TLD (Top Level Domain) server for .nl. This one knows which nameservers are responsible for example.nl.
6. The authoritative nameserver
Finally, the resolver asks the domain's authoritative nameserver what the IP address is. This is the server that has the definitive answer.
The result is then cached at each layer so that future requests are faster.
Important DNS records
DNS contains different types of "records" that have different functions. These are the most important ones you will come across:
| Record type | Function | Example |
|---|---|---|
| A | Links a domain to an IPv4 address | example.nl -> 93.184.216.34 |
| AAAA | Links a domain to an IPv6 address | example.nl -> 2606:2800:220:1::248 |
| CNAME | Alias to another domain | www.example.nl -> example.nl |
| MX | Mail server for the domain | example.nl -> mail.example.nl (priority 10) |
| TXT | Text info (verification, SPF, DKIM) | example.nl -> "v=spf1 include:..." |
| NS | Nameservers for the domain | example.nl -> ns1.provider.nl |
| CAA | Certificate authority authorization | example.nl -> 0 issue "letsencrypt.org" |
| SRV | Service location (e.g. for SIP, XMPP) | _sip._tcp.example.nl -> sip.example.nl:5060 |
A record: the basics
The A record is the most fundamental DNS record. It links your domain name directly to the IPv4 address of your web server. Without an A record, no one can find your website through your domain name.
A domain can have multiple A records that point to different IP addresses. This is used for load balancing: traffic is spread across multiple servers. If one server goes down, visitors can still reach another.
The AAAA record does the same for IPv6 addresses. With the growth of the internet and the depletion of IPv4 addresses, IPv6 is becoming increasingly important. Modern websites often have both an A and an AAAA record.
CNAME record: aliases
A CNAME (Canonical Name) record is an alias that points to another domain instead of to an IP address. This is useful when the target IP can change, because you then only need to update the source.
Common uses:
- www subdomain: www.example.nl -> example.nl
- CDN integration: static.example.nl -> example.cdnprovider.com
- SaaS services: shop.example.nl -> shops.platform.com
Note: a CNAME cannot coexist with other records on the same name. For the root domain (example.nl without www) you therefore usually use an A record or an ALIAS/ANAME record (if your provider supports it).
MX record: for email
MX stands for Mail Exchange. This record tells where email for your domain should go. If someone sends an email to info@example.nl, their mail server looks up the MX record to know where the mail should go.
You can have multiple MX records with different priorities. Lower numbers have higher priority. This provides redundancy: if the primary mail server is unreachable, the mail goes to the backup.
Example of MX records:
- example.nl MX 10 mail.example.nl (primary)
- example.nl MX 20 backup.example.nl (backup)
If you use Google Workspace or Microsoft 365 for email, you set up their MX records so that mail goes to their servers.
TXT record: verification and security
TXT records contain text information for various purposes. They have become essential for email security and domain verification.
SPF (Sender Policy Framework)
SPF defines which servers are allowed to send mail on behalf of your domain. This helps prevent spam and phishing by stopping malicious parties from sending mail that appears to come from your domain.
Example: v=spf1 include:_spf.google.com ~all
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to outgoing emails. Receiving mail servers can use this to verify that the mail really comes from your domain and has not been altered along the way.
DMARC (Domain-based Message Authentication)
DMARC tells recipients what to do with mail that does not pass SPF or DKIM. You can set whether such mail should be rejected, land in spam, or be delivered normally.
Domain verification
Services such as Google Search Console, Microsoft 365 and many others use TXT records to prove that you own a domain. You place a specific code in a TXT record as verification.
Nameservers (NS)
Nameservers are the servers that store and answer your DNS records. When you register a domain, you set nameservers. This determines where the world looks for information about your domain.
You always have at least two nameservers for redundancy. If one server is unreachable, the other can still respond. Most providers offer three or four nameservers.
You can choose to use the nameservers of your domain registrar, those of your hosting provider, or an external DNS service such as Cloudflare. Each option has pros and cons:
- Registrar DNS: Simple, everything in one place
- Hosting DNS: Easy integration with your hosting
- External DNS: Often faster and more features, but added complexity
DNS propagation: why changes take time
When you change DNS records, it takes a while before the whole world has the new data. This is called DNS propagation. DNS servers worldwide cache information to be faster and to spread the load.
The TTL (Time To Live) determines how long records are cached. A TTL of 3600 means servers keep the record for at most 1 hour before fetching a new version.
Propagation usually takes 1-24 hours, sometimes up to 48 hours in extreme cases. During this period, some visitors may still see old data while others have the new data.
Tips for faster propagation
- Lower the TTL to 300 seconds a day before the change
- Make the change
- Raise the TTL again after successful propagation
Managing your DNS
You usually manage DNS through one of these places:
- Your domain registrar: Where you bought the domain (TransIP, Versio, etc.)
- Your hosting provider: If you point your nameservers there
- An external DNS service: Cloudflare, Route53, DNS Made Easy
At Theory7 you get free DNS management with your domain name through a user-friendly dashboard.
Solving DNS problems
Website or email not working? DNS is often the culprit. Here are common problems and solutions:
Website does not load after a DNS change
Propagation needs time. Wait 24 hours. You can flush your local DNS cache or try a different browser or incognito mode. Tools like whatsmydns.net show what your DNS looks like worldwide.
Email does not arrive
Check your MX records. They must point to your mail server or the servers of your email provider (Google, Microsoft). Also check SPF and DKIM records if mail ends up in spam.
Subdomain does not work
You probably do not have a DNS record for that subdomain. Add an A record or CNAME for the specific subdomain.
SSL certificate error
If you recently moved servers, the old certificate may point to the wrong server. Generate a new certificate after DNS propagation.
Handy DNS tools
These tools help with checking and debugging DNS:
- whatsmydns.net: Check DNS propagation worldwide
- mxtoolbox.com: Test MX records, SPF, DKIM and more
- dig: Command line tool for DNS queries (Linux/Mac)
- nslookup: Command line tool (Windows)
- dnschecker.org: Compare DNS across different providers
DNS security
DNS was originally not designed with security in mind. There are now techniques to make DNS safer:
DNSSEC
DNSSEC adds digital signatures to DNS records so you can be sure they have not been tampered with. Not all providers support this.
DNS over HTTPS (DoH) and DNS over TLS (DoT)
These protocols encrypt DNS traffic so that others (such as your internet provider) cannot see which websites you look up.
More about domains
DNS is the invisible but essential technology behind the internet. Without DNS you would have to memorize numeric IP addresses. With a basic understanding of how DNS works, you can troubleshoot better and manage your domain more effectively.
Want to register a domain? Check availability here. Also read our articles on connecting a domain to hosting and transferring a domain name.
Setting up DNS for your website
If you are setting up a new website or moving to a new hosting provider, you need to configure DNS correctly. Here is what you need to do:
Basic setup for a website
For a simple website you need at least these records:
- A record for the main domain: example.nl to the IP of your server
- A record or CNAME for www: www.example.nl to the same IP or as an alias to example.nl
If your hosting has a control panel (cPanel, DirectAdmin, Plesk), these records are often set up automatically when you add a domain.
Configuring email
For email you need MX records. If you use your hosting's mail server, the MX records point to that server. If you use external email such as Google Workspace or Microsoft 365, you set up their MX records:
Example for Google Workspace:
- MX 1 ASPMX.L.GOOGLE.COM
- MX 5 ALT1.ASPMX.L.GOOGLE.COM
- MX 5 ALT2.ASPMX.L.GOOGLE.COM
- MX 10 ALT3.ASPMX.L.GOOGLE.COM
- MX 10 ALT4.ASPMX.L.GOOGLE.COM
SPF, DKIM and DMARC for email security
To prevent your emails from ending up in spam and to protect your domain against spoofing, you set up these TXT records:
- SPF: Defines which servers are allowed to send mail. Example:
v=spf1 include:_spf.google.com ~all - DKIM: Digital signature. Your mail provider gives you the correct value.
- DMARC: Policy for unverified mail. Example:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.nl
Best practices for DNS management
Follow these recommendations for trouble-free DNS management:
Document your records
Keep an overview of all your DNS records outside the management panel. If something goes wrong or you switch providers, you have a reference.
Use realistic TTL values
A higher TTL (3600-86400 seconds) reduces DNS queries and improves performance. A lower TTL (300 seconds) allows quick changes but increases the load. Lower it temporarily for migrations, then raise it again.
Test changes in advance
Before you change DNS, test the new configuration where possible. Use tools such as dig or nslookup to verify that records are set up correctly before you start propagation.
Plan changes
Do not make DNS changes on a Friday afternoon or before the weekend. If something goes wrong, you want support to be available.
Keep access to your DNS
Make sure you always have access to your DNS management. Store login details safely and make sure more than one person has access for emergencies.
Common DNS scenarios
Moving a website to new hosting
- Set up the site at the new host
- Test via the IP address or hosts file
- Lower the TTL of your A record to 300
- Wait until the old TTL expires
- Change the A record to the new IP
- Raise the TTL after a successful migration
Adding a subdomain
Add an A record for the subdomain (blog.example.nl) that points to the correct IP. Or use a CNAME if the subdomain needs to point to an external service.
Changing email provider
Update the MX records to the new provider. Email in transit can be lost during propagation, so communicate the change in advance and schedule it for a quiet moment.
DNS explained: frequently asked questions
Now that we have explained the basics of DNS, we cover a few frequently asked questions that help you understand the system even better.
How long does DNS propagation take?
When you change DNS settings, it can take 24 to 48 hours before the changes are applied worldwide. This is called DNS propagation. As explained earlier, nameservers cache the records temporarily, which is why old settings are sometimes still visible for a while. With a lower TTL value you can speed up this process.
With DNS explained as a foundation, you can now better understand how your domain name works behind the scenes. For an optimal configuration, it is important to choose a reliable DNS provider that fits your hosting plan. DNS explained is the first step toward professional domain management.
DNS explained: advanced configuration
For advanced users, DNS explained offers even more depth in the area of advanced configuration. When DNS is explained at an expert level, concepts such as DNS load balancing, geo-routing and failover come into play. With DNS explained as a foundation, you can use these techniques to make your website faster and more reliable. DNS explained at this level also helps you understand issues such as DNS spoofing and cache poisoning, so you can better protect your infrastructure.
Theory7 is a SIDN-accredited registrar, which means you can register domain names directly at the source, without an intermediary. This ensures faster processing times and direct management through WHOIS.
DNS explained: solving common DNS problems
Even with a well-configured DNS setup, you can run into problems. Below we describe the most common DNS problems and how to solve them.
DNS propagation takes too long
After a DNS change, it can take up to 48 hours before the new settings are applied worldwide. Want to speed this up? Lower the TTL (Time to Live) of your DNS records to 300 seconds in advance. After the change, you can check propagation using tools such as whatsmydns.com. If it still does not work after 48 hours, check whether you made the change at the correct DNS provider, because sometimes your nameservers point to a different provider than you think.
Flushing the DNS cache
Sometimes your computer still shows the old DNS data because of local caching. On Windows you flush the DNS cache with the command ipconfig /flushdns in the command prompt. On macOS you use sudo dscacheutil -flushcache. On Linux you clear the cache with sudo systemd-resolve --flush-caches. Do not forget to clear the browser cache either, because browsers have their own DNS cache that is separate from the operating system.
DNS security: protection against attacks
Protecting your DNS configuration against attacks is essential. Enable DNSSEC to prevent DNS spoofing. Use a DNS provider with DDoS protection so your website stays reachable during attacks.
