How DNS Works

What Is DNS?

DNS — the Domain Name System — is the internet's distributed naming system. It maintains a global database of domain names and their corresponding IP addresses, allowing humans to use memorable names like ipdetecto.com instead of numeric addresses like 104.21.18.93.

DNS is hierarchical and distributed: no single server holds all domain records. Instead, the system uses a tree of servers — from root name servers at the top, down through top-level domain (TLD) servers, to authoritative name servers operated by individual domain owners. This distributed architecture makes DNS highly resilient and scalable for billions of daily queries.

The DNS Resolution Process

When you type a URL into your browser, the following sequence of events resolves it to an IP address:

DNS Record Types

DNS supports many record types, each serving a specific purpose in directing internet traffic:

DNS Caching and TTL

DNS responses include a TTL (Time to Live) value that tells resolvers how long to cache the result. This dramatically reduces DNS query volume and speeds up resolution for popular domains.

DNS Privacy: DoH and DoT

Traditional DNS queries are sent in plain text over UDP port 53, meaning your ISP and any network observer can see every domain you look up. Two modern protocols address this:

DNS Propagation in Practice

One of the most misunderstood aspects of DNS is propagation. When you update a DNS record — say, you point your domain to a new server — the change does not appear instantly for everyone. Here is what actually happens:

Your new record is written to your authoritative name server immediately. But every resolver in the world that has cached the old record will continue serving it until the old TTL expires. If your A record had a TTL of 86400 (24 hours), some users could see the old server for up to 24 hours after you made the change.

This is why the professional practice before a major migration is to lower your TTL to 300 seconds (5 minutes) at least 48 hours before the change, perform the switch, then raise the TTL again after confirming everything works. The 48-hour wait is necessary because old cached records with the original high TTL need to expire first.

DNS Leaks: When Your VPN Fails at the DNS Level

A DNS leak is one of the most common VPN failures. It happens when your device sends DNS queries outside the VPN tunnel — typically back to your ISP’s resolver — even though all your other traffic is encrypted and tunnelled. The result: your ISP can see every domain you look up, even though they cannot see the actual content of the pages you visit.

DNS leaks happen because the operating system may continue using its configured DNS server (from DHCP, before the VPN connected) in parallel with the VPN’s DNS. On Windows, the "Smart Multi-Homed Name Resolution" feature can cause this — it sends DNS queries to all configured resolvers simultaneously and uses whichever responds fastest, which is often the ISP’s local resolver.

You can verify whether your VPN has a DNS leak using our privacy leak test. The tool makes a DNS request from your browser and checks which resolver handled it. If the resolver’s location does not match your VPN server’s location, you likely have a leak.

Troubleshooting DNS with Lookup Tools

When email stops working, a website goes down after a migration, or a subdomain resolves incorrectly, DNS is usually the first place to investigate. Here is how to use DNS lookup tools effectively: