What is DNS?
- DNS turns a name like proxyhorizon.com into an IP address your device can actually connect to.
- A full lookup asks up to four servers, but caching means most queries never leave your resolver.
- Whoever runs your resolver holds a timestamped list of every domain you visit — that is the real privacy story.
- A DNS leak lets that list escape even when your VPN is working perfectly.
- DoH and DoT encrypt your lookups. They change who can see them; they do not make you anonymous.
The scale is genuinely hard to picture. DNS handles trillions of queries a day across a hierarchy nobody owns, with no central database, and answers most of them in a few milliseconds. It has been running more or less continuously since 1985, which makes it one of the oldest systems on the internet still doing its original job.
It also has almost no security in its original design. Everything interesting about DNS today — encryption, filtering, leaks, censorship — traces back to the fact that the protocol was built for a network where nobody was expected to lie.
A DNS lookup, step by step
This entire exchange normally completes in under 100 milliseconds, before your browser has opened a single connection.
proxyhorizon.com — A record?Nothing on your laptop knows where proxyhorizon.com lives. It forwards the question to a recursive resolver, normally the one your router was handed by your internet provider. If that resolver already has the answer cached, everything below is skipped and you get a reply in a millisecond.
Stub resolver
The tiny client built into your operating system. It knows almost nothing and asks almost everything, forwarding each question to whichever resolver your network handed it.
Recursive resolver
Does the actual work: asks around the hierarchy until it has an answer, then caches it for everyone else who asks. Run by your provider, or by whoever you have chosen to point at instead.
Root servers
Thirteen server identities, operated by twelve organisations, spread across hundreds of physical machines. They answer exactly one kind of question: which servers handle a given top-level domain.
TLD servers
One set per top-level domain — .com, .org, .co.uk. They hold the delegation records saying which nameservers each registered domain has nominated.
Authoritative nameserver
The source of truth for one domain, holding the records its owner published. Everything above exists only to help you find this server.
www.proxyhorizon.com. the rightmost dot is the root, then .com, then proxyhorizon, then the host. Each level delegates authority to the next, and that hierarchy is exactly the order a lookup follows.DNS record types
Records are just lines of text. Pick one to see the syntax and what it does.
proxyhorizon.com. 300 IN A 203.0.113.42Maps a hostname to an IPv4 address. The workhorse of the entire system — most lookups you make are asking for one of these.
Reading left to right: the name, the TTL in seconds, the class (always IN in practice), the type, and the value.
www at your apex domain but cannot put a CNAME on the apex itself when it also needs MX records for email. Providers work around it with non-standard ALIAS or ANAME records that resolve the target server-side.TTL and caching
You updated the record. Every resolver holding a cached copy keeps serving the old one until its own TTL runs out.
The common default for records that might need to move. A sensible balance for most sites.
There is no such thing as global DNS propagation as a single event. It is thousands of independent caches each expiring on their own clock.
Before a migration
Drop the TTL to 60 seconds a day ahead. By the time you move, every cache is refreshing every minute and the switch is close to instant.
Where answers hide
Your browser caches, your OS caches, your router caches, and your resolver caches. Clearing one and seeing no change usually means another still holds the old record.
Negative caching too
A does-not-exist answer is cached as well, governed by the zone SOA record. Create a record after someone tried to reach it and they may keep seeing the failure for a while.
Who sees your DNS lookups
DNS leaks
Your traffic is encrypted either way. The question is whether the question itself is.
- Encrypted — unreadable to your provider
- Plain DNS, outside the tunnel
More on the failure modes in DNS leak and WebRTC leak.
- The operating system keeps using its own configured resolver instead of the tunnel.
- IPv6 queries escape while only IPv4 is routed through the VPN.
- Windows sends queries to every interface at once and takes the fastest reply.
- The browser runs its own DoH resolver that ignores the system route entirely.
- The tunnel drops for a moment and the client has no kill switch.
- Use a VPN that runs its own resolver inside the tunnel and forces all queries to it.
- Turn on the kill switch so traffic stops rather than falling back when the tunnel drops.
- Disable IPv6, or confirm your provider routes it through the tunnel too.
- Set the browser DoH resolver deliberately rather than leaving the vendor default.
- Test after connecting — every time you change client, network or operating system.
Encrypted DNS: DoH, DoT and DNSCrypt
Same question, very different exposure.
Sends queries as ordinary HTTPS requests on port 443, mixed in with the rest of your web traffic. Practically impossible to single out and block, which is precisely why privacy advocates favour it and why network administrators and schools object to it.
What encrypted DNS does not do
It hides the question, not the destination. Once your device has the address it opens a connection to it, and your provider can see that IP whatever your DNS setup looks like. For most sites the address alone is enough to identify who you visited.
There is also DNSSEC, which is often confused with this and solves a different problem: it cryptographically signs records so a resolver can prove an answer was not tampered with. It provides authenticity, not privacy — the query and the response are still readable to anyone watching. You want both, and they are unrelated.
Filtering, censorship and SmartDNS
Protective filtering
Resolvers like Quad9 refuse to resolve known-malicious domains, so a phishing link fails before your browser connects. Pi-hole applies the same idea to ad and tracker domains for a whole household, with no software on any device.
Censorship
The cheapest national blocking method is simply instructing providers to return the wrong answer, or none. It is also the easiest to sidestep, which is exactly why encrypted DNS is politically contested rather than merely technical.
SmartDNS
Returns a proxy address for a handful of streaming domains and the genuine one for everything else, so only that traffic is redirected. Fast, because nothing is encrypted — and offering no privacy at all, for the same reason. See our SmartDNS guide.
Choosing a resolver
Whichever resolver you point at sees every domain you visit. Choose deliberately.
1.1.1.1 / 1.0.0.1Test yourself
1Which server is the authoritative source for a domain’s records?
2What does a TTL of 3600 mean?
3A DNS leak means…
4Which record maps a hostname to an IPv6 address?
5Why is DNS over HTTPS harder to block than DNS over TLS?
DNS FAQ
1What is DNS in simple terms?
DNS is the internet’s address book. You type a name like proxyhorizon.com, and DNS turns it into the numeric IP address your device actually needs to open a connection. It runs before every single request you make, which is why a DNS failure feels like the whole internet is down.
2How does a DNS lookup work?
Your device asks a recursive resolver, usually run by your internet provider. If the answer is not already cached, the resolver asks a root server which nameservers handle .com, asks those which nameservers handle the domain, then asks the domain’s own authoritative server for the record. It caches the answer and returns it. Four questions, and it typically finishes in well under a tenth of a second.
3What is the difference between a recursive resolver and an authoritative nameserver?
A recursive resolver does the legwork on your behalf: it asks around until it has an answer, then caches it. An authoritative nameserver is the source of truth for one specific domain, holding the records its owner published. The resolver is the librarian, the authoritative server is the book.
4What is TTL in DNS?
Time to live is a number of seconds attached to every record telling resolvers how long they may cache it. A TTL of 300 means an answer can be reused for five minutes before it must be looked up again. Low TTLs make changes propagate fast but increase query volume; high TTLs are efficient but slow to update.
5What is a DNS leak?
It is when your traffic goes through a VPN or proxy but your DNS lookups do not, so your internet provider still receives a list of every domain you visit. The tunnel is working and your IP really is hidden, yet the record of where you went escapes anyway. It is one of the most common ways a privacy setup silently fails.
6Does a VPN stop DNS leaks?
A properly built one does, by running its own resolver inside the tunnel and forcing all queries through it. Not every client does this correctly on every operating system, and some fail specifically for IPv6. It is worth testing rather than assuming.
7What is the difference between DNS over HTTPS and DNS over TLS?
Both encrypt your queries so nobody on the path can read them. DoT uses its own port, 853, which makes it easy to identify and therefore easy for a network to block. DoH sends queries over port 443 alongside ordinary web traffic, so it is very hard to single out — which privacy advocates like and network administrators do not.
8Does encrypted DNS make me anonymous?
No. It stops your provider reading your lookups, but it moves that visibility to whoever runs the resolver rather than removing it. The site you connect to still sees your IP address, and the server name is often still visible in the connection itself. Encrypted DNS is one useful layer, not a cloak.
9Why do DNS changes take so long to take effect?
Because of caching. Every resolver that already holds the old record keeps serving it until its TTL expires, and some ignore short TTLs and impose a floor of their own. Lowering the TTL a day before you make a change is the standard way to keep propagation quick.
10Is changing my DNS resolver safe?
Yes, and it is reversible in seconds. Switching to a public resolver such as Cloudflare or Quad9 often improves speed and adds malware filtering. Be deliberate about it though: whoever you point at now sees every domain you look up, so pick one whose logging policy you have actually read.