Overview
The Domain Name System (DNS) translates human-readable names like api.example.com into IP addresses like 93.184.216.34. It is a globally distributed, hierarchical, heavily cached database: no single server knows every name, but any resolver can find any name by walking from the root servers to the top-level domain (.com) to the domain's authoritative name servers.
DNS is also a traffic management tool. By returning different IPs based on location, health, or weights, DNS can route users to the nearest region, split traffic between versions, and fail over when a data center goes down. Its main limitation is caching: changes take effect only after TTLs expire.
You ask your local librarian (resolver) for a number. If they do not know it, they ask the national directory (root), which points to the directory for '.com' (TLD), which points to the company's own receptionist (authoritative server), who gives the number. The librarian remembers the answer for a while (TTL).
When to use it
- Mapping domain names to servers, load balancers, or CDNs.
- Geographic routing: send users to the closest region.
- Failover between regions using health-checked records.
- Service discovery inside private networks (Kubernetes CoreDNS).
Where it shows up in interviews
Recognize it when: users in many countries; route each to the nearest region.
- Design a global CDN
- Design multi-region active-active
Recognize it when: region outage; how do users reach the healthy region?
- Design a highly available web service
- Disaster recovery design
Recognize it when: a globally distributed, read-heavy, cached lookup system.
- Design a DNS service
- Design a service discovery system
Where it is used in real software
Managed DNS providers offer latency-based, geolocation, weighted, and failover routing policies with health checks.
Public resolvers like 1.1.1.1 and 8.8.8.8 announce the same IP from hundreds of locations; your query reaches the nearest one.
A DDoS on a major DNS provider made Twitter, GitHub, and Netflix unreachable for many users, showing DNS as a critical dependency.
Key terms
- Recursive resolver
- Does the lookup work for clients (usually your ISP, 8.8.8.8, or 1.1.1.1) and caches results.
- Authoritative server
- Holds the real records for a domain.
- A / AAAA
- Map a name to an IPv4 / IPv6 address.
- CNAME
- Alias one name to another name (www to a CDN hostname).
- TTL
- How many seconds resolvers may cache a record.
- NS, MX, TXT
- Name server delegation, mail servers, and arbitrary text (domain verification, SPF).
How it works, step by step
- 1Check local caches
Browser cache, then the operating system cache and hosts file.
- 2Ask the recursive resolver
If it has a cached answer within TTL, it returns it immediately.
- 3Resolver asks a root server
Root servers reply with the name servers for the TLD (.com).
- 4Resolver asks the TLD server
The .com servers reply with the domain's authoritative name servers.
- 5Resolver asks the authoritative server
It returns the record (for example A 93.184.216.34) and its TTL.
- 6Cache and return
The resolver caches the answer and returns it to the client, which caches it too.
STEP 1The client asks its resolver for api.example.com. Caches are empty.
Common record types for one service
Zone example.com
| Name | Type | Value | Purpose |
|---|---|---|---|
| example.com | A | 203.0.113.10 | Apex points to a load balancer IP |
| www.example.com | CNAME | d123.cloudfront.net | Alias to a CDN |
| api.example.com | A (latency) | US or EU LB IP | Route to nearest region |
| example.com | MX | 10 mail.example.com | Receive email |
| example.com | TXT | v=spf1 include:_spf.mail.com ~all | Email sender policy |
NOWName: example.com | Type: A | Value: 203.0.113.10 | Purpose: Apex points to a load balancer IP
One domain combines several record types. Routing policies on A records turn DNS into a global traffic manager.
Implementation
# Look up an A record and see the TTLdig api.example.com A +noall +answer # Follow the full resolution path from the rootdig api.example.com +trace # Ask a specific resolverdig @1.1.1.1 example.com AAAA # Find the authoritative name servers and mail serversdig example.com NSdig example.com MXComplexity and performance
Browser or OS cache.
Several round trips to name servers.
Lower TTL means faster changes, more queries.
Trade-offs
A 60 s TTL lets you fail over quickly but increases query load and latency; a 1-day TTL is efficient but changes propagate slowly.
DNS spreads traffic cheaply and globally but cannot react instantly, because clients cache answers and some ignore TTLs.
Variants and related techniques
The same IP announced from many locations so queries hit the nearest server.
Encrypts DNS queries to protect privacy.
Returns internal IPs to internal clients and public IPs to external clients.
Common mistakes
- Expecting instant DNS changes.
Fix: Lower the TTL well before a migration, then raise it again afterward.
- CNAME at the zone apex.
Fix: Standards forbid CNAME at example.com; use ALIAS/ANAME records or provider-specific alias features.
- Single DNS provider.
Fix: Critical services can use two providers to survive a provider outage.
Interview questions
How does DNS scale to billions of queries?
It is hierarchical (no server knows everything), heavily cached at every level with TTLs, and served by anycast replicas worldwide. Most queries never leave a resolver's cache.
How would you use DNS for failover?
Health-check each region's endpoint and configure failover or latency-based records so DNS only returns healthy endpoints. Keep TTLs low (for example 60 s) to limit how long clients use a failed region.
Why might users still hit an old server after a DNS change?
Resolvers and clients cache the old answer until its TTL expires, and some clients or JVMs cache DNS longer than the TTL.
Practice problems
| Problem | Difficulty | What it trains |
|---|---|---|
| Trace the resolution of a domain with dig +trace | Easy | Hierarchy. |
| Plan a zero-downtime migration to a new load balancer | Medium | TTL strategy. |
| Design a DNS service | Hard | Caching, anycast, replication. |