Learning Center

What Is DNS? How Domain Name Resolution Actually Works

The lookup chain, record types, TTL and caching, DNS leaks, and encrypted DNS explained properly.

15 min readIntermediateUpdated August 2026
Start here

What is DNS?

DNS— the Domain Name System — is the internet’s address book. Computers route to numbers; people remember names. DNS is the translation layer in between, and it runs before every request you make without ever announcing itself.
The short answer
  • DNS turns a name like proxyhorizon.com into an IP address your device can actually connect to.
  • A full lookup asks up to four servers, but caching means most queries never leave your resolver.
  • Whoever runs your resolver holds a timestamped list of every domain you visit — that is the real privacy story.
  • A DNS leak lets that list escape even when your VPN is working perfectly.
  • DoH and DoT encrypt your lookups. They change who can see them; they do not make you anonymous.

The scale is genuinely hard to picture. DNS handles trillions of queries a day across a hierarchy nobody owns, with no central database, and answers most of them in a few milliseconds. It has been running more or less continuously since 1985, which makes it one of the oldest systems on the internet still doing its original job.

It also has almost no security in its original design. Everything interesting about DNS today — encryption, filtering, leaks, censorship — traces back to the fact that the protocol was built for a network where nobody was expected to lie.

Watch it happen

A DNS lookup, step by step

Nothing on your device knows where a domain lives. Finding out means walking down a hierarchy, one delegation at a time. Step through it below.
One name, four questions

This entire exchange normally completes in under 100 milliseconds, before your browser has opened a single connection.

Your devicestub resolverRecursive resolverasks, then cachesRoot serverswho handles .com?.com TLD serverswhich nameservers?Authoritative NSthe actual record
Step 1 of 5
Your device asks a resolver
proxyhorizon.com — A record?

Nothing on your laptop knows where proxyhorizon.com lives. It forwards the question to a recursive resolver, normally the one your router was handed by your internet provider. If that resolver already has the answer cached, everything below is skipped and you get a reply in a millisecond.

Stub resolver

The tiny client built into your operating system. It knows almost nothing and asks almost everything, forwarding each question to whichever resolver your network handed it.

Recursive resolver

Does the actual work: asks around the hierarchy until it has an answer, then caches it for everyone else who asks. Run by your provider, or by whoever you have chosen to point at instead.

Root servers

Thirteen server identities, operated by twelve organisations, spread across hundreds of physical machines. They answer exactly one kind of question: which servers handle a given top-level domain.

TLD servers

One set per top-level domain — .com, .org, .co.uk. They hold the delegation records saying which nameservers each registered domain has nominated.

Authoritative nameserver

The source of truth for one domain, holding the records its owner published. Everything above exists only to help you find this server.

Read a domain name right to left
In www.proxyhorizon.com. the rightmost dot is the root, then .com, then proxyhorizon, then the host. Each level delegates authority to the next, and that hierarchy is exactly the order a lookup follows.
The data itself

DNS record types

A zone file is a plain text list of records. There are dozens of types; seven cover nearly everything you will meet in practice.
What a zone file actually contains

Records are just lines of text. Pick one to see the syntax and what it does.

proxyhorizon.com. 300 IN A 203.0.113.42

Maps a hostname to an IPv4 address. The workhorse of the entire system — most lookups you make are asking for one of these.

Reading left to right: the name, the TTL in seconds, the class (always IN in practice), the type, and the value.

The CNAME rule that catches everyone
A name with a CNAME on it cannot carry any other record. That is why you can point www at your apex domain but cannot put a CNAME on the apex itself when it also needs MX records for email. Providers work around it with non-standard ALIAS or ANAME records that resolve the target server-side.
Why the internet survives

TTL and caching

If every lookup walked the full hierarchy, the root servers would have collapsed decades ago. Caching is what makes DNS work at all — and what makes changes frustratingly slow.
Why a DNS change is not instant

You updated the record. Every resolver holding a cached copy keeps serving the old one until its own TTL runs out.

Your ISP198.51.100.9
Cloudflare 1.1.1.1198.51.100.9
Google 8.8.8.8198.51.100.9
Quad9 9.9.9.9198.51.100.9
A corporate resolver198.51.100.9
Time since change
0s
of a 5 min TTL window
Resolvers updated
0 / 5
still serving the old address

The common default for records that might need to move. A sensible balance for most sites.

There is no such thing as global DNS propagation as a single event. It is thousands of independent caches each expiring on their own clock.

Before a migration

Drop the TTL to 60 seconds a day ahead. By the time you move, every cache is refreshing every minute and the switch is close to instant.

Where answers hide

Your browser caches, your OS caches, your router caches, and your resolver caches. Clearing one and seeing no change usually means another still holds the old record.

Negative caching too

A does-not-exist answer is cached as well, governed by the zone SOA record. Create a record after someone tried to reach it and they may keep seeing the failure for a while.

The part that matters

Who sees your DNS lookups

Your browsing history is not only in your browser. A near-complete copy exists in whatever resolved your queries, and by default that is your internet provider.
Who
What they can see
Your internet provider
Every domain you look up, with timestamps — unless you use encrypted DNS pointed elsewhere.
Your DNS resolver
Every domain you look up. Encryption changes who this is, not whether they can see.
Anyone on the same Wi-Fi
With plain DNS, the lot. With DoH or DoT, nothing readable.
The website itself
Your IP address and the request. It never sees your DNS history.
Your browser vendor
If the browser ships its own DoH resolver and you left the default on, potentially all of it.
A DNS log is a browsing history in all but name
It does not record which pages you read, but a timestamped list of every domain is remarkably revealing — which bank, which health service, which dating app, which employer, and at what hour. In several countries providers are legally required to retain exactly this. That is the reason to care about DNS, far more than performance.
How privacy setups fail

DNS leaks

You connect a VPN, your IP changes, the site shows a different country, and everything looks correct. Meanwhile your provider is still receiving every domain you ask about.
A DNS leak: the tunnel works, the lookups escape

Your traffic is encrypted either way. The question is whether the question itself is.

encrypted tunnelYouVPN clientVPN serverWebsiteYour ISP resolversees every domainLogged
  • Encrypted — unreadable to your provider
  • Plain DNS, outside the tunnel
Your IP really is hidden and your traffic really is encrypted — and your provider still holds a timestamped list of every domain you visited, because the question travelled outside the tunnel in plain text. Nothing looks wrong from your side. This is why leak testing exists.

More on the failure modes in DNS leak and WebRTC leak.

Why it happens
  • The operating system keeps using its own configured resolver instead of the tunnel.
  • IPv6 queries escape while only IPv4 is routed through the VPN.
  • Windows sends queries to every interface at once and takes the fastest reply.
  • The browser runs its own DoH resolver that ignores the system route entirely.
  • The tunnel drops for a moment and the client has no kill switch.
What fixes it
  • Use a VPN that runs its own resolver inside the tunnel and forces all queries to it.
  • Turn on the kill switch so traffic stops rather than falling back when the tunnel drops.
  • Disable IPv6, or confirm your provider routes it through the tunnel too.
  • Set the browser DoH resolver deliberately rather than leaving the vendor default.
  • Test after connecting — every time you change client, network or operating system.
A leak is silent by design
Nothing breaks. No warning appears. Your IP checker shows the VPN country and your connection feels normal, because the tunnel genuinely is working — only the questions are escaping around it. The only way to know is to look, which is what a kill switch and a leak test are for.
The modern fix

Encrypted DNS: DoH, DoT and DNSCrypt

Plain DNS travels in clear text on port 53, readable and rewritable by anyone on the path. Three protocols close that gap in slightly different ways.
Four ways to carry a DNS query

Same question, very different exposure.

Transport
TCP 443
Encrypted
Yes
Blockable by a network
Very hard

Sends queries as ordinary HTTPS requests on port 443, mixed in with the rest of your web traffic. Practically impossible to single out and block, which is precisely why privacy advocates favour it and why network administrators and schools object to it.

Encryption moves who can see your lookups; it does not remove the visibility. Whoever runs the resolver still sees every domain you ask about.

What encrypted DNS does not do

It hides the question, not the destination. Once your device has the address it opens a connection to it, and your provider can see that IP whatever your DNS setup looks like. For most sites the address alone is enough to identify who you visited.

There is also DNSSEC, which is often confused with this and solves a different problem: it cryptographically signs records so a resolver can prove an answer was not tampered with. It provides authenticity, not privacy — the query and the response are still readable to anyone watching. You want both, and they are unrelated.

DNS as a control point

Filtering, censorship and SmartDNS

Because every connection starts with a lookup, whoever answers your lookups can decide what you are able to reach. That is used for good and for ill, sometimes by the same mechanism.

Protective filtering

Resolvers like Quad9 refuse to resolve known-malicious domains, so a phishing link fails before your browser connects. Pi-hole applies the same idea to ad and tracker domains for a whole household, with no software on any device.

Censorship

The cheapest national blocking method is simply instructing providers to return the wrong answer, or none. It is also the easiest to sidestep, which is exactly why encrypted DNS is politically contested rather than merely technical.

SmartDNS

Returns a proxy address for a handful of streaming domains and the genuine one for everything else, so only that traffic is redirected. Fast, because nothing is encrypted — and offering no privacy at all, for the same reason. See our SmartDNS guide.

Why DoH became an argument
The moment browsers began shipping their own encrypted resolvers, network operators lost the ability to see or filter DNS — including schools enforcing safeguarding rules and companies enforcing security policy. Both positions are reasonable, which is why the standards work has been slow and the defaults keep changing.
Practical advice

Choosing a resolver

This is a two-minute change in your router or OS settings, and it is fully reversible. It is also the single highest-leverage privacy adjustment most people never make.
Who should answer your questions?

Whichever resolver you point at sees every domain you visit. Choose deliberately.

Address
1.1.1.1 / 1.0.0.1
Typical speed96%
Filtering
Optional (1.1.1.2 blocks malware)
Query logs
Discarded within 24 hours
Consistently among the fastest public resolvers, with a published and audited privacy policy. The 1.1.1.2 and 1.1.1.3 variants add malware and adult-content filtering if you want them.
Speed figures are indicative of typical global averages, not a measurement from your location. The nearest resolver is often the fastest one regardless of brand.
A sensible default for most people
Set an encrypted resolver you have actually chosen — Cloudflare for speed, Quad9 if you want malware blocking as well — at the router so every device inherits it. If you also use a VPN, let the VPN resolve inside its tunnel instead, and verify there is no leak afterwards rather than trusting the marketing.
Check your understanding

Test yourself

Five questions. Nothing is recorded — this is just for you.
Quick knowledge check0 / 5

1Which server is the authoritative source for a domain’s records?

2What does a TTL of 3600 mean?

3A DNS leak means…

4Which record maps a hostname to an IPv6 address?

5Why is DNS over HTTPS harder to block than DNS over TLS?

Common questions

DNS FAQ

1What is DNS in simple terms?

DNS is the internet’s address book. You type a name like proxyhorizon.com, and DNS turns it into the numeric IP address your device actually needs to open a connection. It runs before every single request you make, which is why a DNS failure feels like the whole internet is down.

2How does a DNS lookup work?

Your device asks a recursive resolver, usually run by your internet provider. If the answer is not already cached, the resolver asks a root server which nameservers handle .com, asks those which nameservers handle the domain, then asks the domain’s own authoritative server for the record. It caches the answer and returns it. Four questions, and it typically finishes in well under a tenth of a second.

3What is the difference between a recursive resolver and an authoritative nameserver?

A recursive resolver does the legwork on your behalf: it asks around until it has an answer, then caches it. An authoritative nameserver is the source of truth for one specific domain, holding the records its owner published. The resolver is the librarian, the authoritative server is the book.

4What is TTL in DNS?

Time to live is a number of seconds attached to every record telling resolvers how long they may cache it. A TTL of 300 means an answer can be reused for five minutes before it must be looked up again. Low TTLs make changes propagate fast but increase query volume; high TTLs are efficient but slow to update.

5What is a DNS leak?

It is when your traffic goes through a VPN or proxy but your DNS lookups do not, so your internet provider still receives a list of every domain you visit. The tunnel is working and your IP really is hidden, yet the record of where you went escapes anyway. It is one of the most common ways a privacy setup silently fails.

6Does a VPN stop DNS leaks?

A properly built one does, by running its own resolver inside the tunnel and forcing all queries through it. Not every client does this correctly on every operating system, and some fail specifically for IPv6. It is worth testing rather than assuming.

7What is the difference between DNS over HTTPS and DNS over TLS?

Both encrypt your queries so nobody on the path can read them. DoT uses its own port, 853, which makes it easy to identify and therefore easy for a network to block. DoH sends queries over port 443 alongside ordinary web traffic, so it is very hard to single out — which privacy advocates like and network administrators do not.

8Does encrypted DNS make me anonymous?

No. It stops your provider reading your lookups, but it moves that visibility to whoever runs the resolver rather than removing it. The site you connect to still sees your IP address, and the server name is often still visible in the connection itself. Encrypted DNS is one useful layer, not a cloak.

9Why do DNS changes take so long to take effect?

Because of caching. Every resolver that already holds the old record keeps serving it until its TTL expires, and some ignore short TTLs and impose a floor of their own. Lowering the TTL a day before you make a change is the standard way to keep propagation quick.

10Is changing my DNS resolver safe?

Yes, and it is reversible in seconds. Switching to a public resolver such as Cloudflare or Quad9 often improves speed and adds malware filtering. Be deliberate about it though: whoever you point at now sees every domain you look up, so pick one whose logging policy you have actually read.

Next steps

Keep learning

Where to go from here.