DNS Resolution

When you type google.com in your browser and press Enter, a chain of systems works together to convert that name into an IP address and load the website.

1. Browser checks its own cache

The browser asks:

"Have I recently visited google.com and stored its IP?"

If yes, it uses it directly (fastest path).

2. OS cache (Operating System)

If the browser doesn't know, it asks the operating system. The OS keeps its own DNS cache too.

Examples:

Windows DNS cache
Linux systemd-resolved cache

If found, the resolution is done.

3. Hosts file check

Before going to the internet, the OS checks a local file:

Linux/macOS: /etc/hosts
Windows: C:\Windows\System32\drivers\etc\hosts

If someone manually mapped google.com to an IP in this file, that mapping is used.

4. DNS resolver (ISP or public DNS)

If still not found, the request goes to a DNS resolver. This is usually:

Your ISP's DNS
Or a public DNS like Google DNS (8.8.8.8) or Cloudflare (1.1.1.1)

This is where the real DNS lookup starts. The resolver, not the browser or OS, does the multi-hop journey described below.

5. Recursive DNS lookup

5.1 Root DNS server

The resolver asks:

"Where can I find .com domains?"

The root server replies:

"Go to the .com TLD servers."

There are about 13 logical root server systems globally.

5.2 TLD server (.com)

The resolver asks the .com server:

"Where is google.com?"

It replies:

"Ask Google's authoritative DNS server."

5.3 Authoritative DNS server (Google)

The resolver asks Google's authoritative DNS server:

"What is the IP of google.com?"

It replies with the actual IP, e.g. 142.250.x.x.

This is the final, definitive answer; the authoritative server is the source of truth for the domain's records, not a cache or middleman.

6. DNS response cached

The resolver caches this result, and so do the OS and browser, for the duration of the record's TTL.

Next time, the resolution is faster.

7. Browser connects to the IP (HTTP/HTTPS starts)

7.1 TCP connection

The browser opens a connection to the server (port 443 for HTTPS).

7.2 TLS handshake (for HTTPS)

Secure encryption is established, including certificate validation against a trusted certificate authority.

7.3 HTTP request

The browser sends a request, e.g.:

GET /
Host: google.com

8. Server responds

Google's server returns HTML, CSS, JS, and images. The browser renders the page.

🧠 Mental diagram

You type google.com
        |
Browser cache
        |
OS cache
        |
Hosts file
        |
DNS Resolver (ISP / 8.8.8.8)
        |
Root DNS
        |
.com TLD DNS
        |
Google DNS (Authoritative)
        |
IP address returned
        |
Browser connects via HTTPS
        |
Google homepage loads

Key idea

DNS is a distributed phonebook of the internet that converts domain names into IP addresses.

Transport protocol note

DNS queries use UDP by default (typically port 53) because they're small and fast, with no need for connection setup.

What an authoritative server is

The authoritative DNS server holds the official records for a domain; it's the source of truth, not a cache or middleman.

When the resolver reaches it, the answer is definitive.

For google.com, this is a server Google runs (or contracts out), and it's the only place where a change to the domain's records actually originates.

Every other layer (resolvers, ISPs, your OS) is just caching a copy of what the authoritative server said, for as long as the TTL allows.