What Is DNS? The Internet's Phone Book, Explained

Think of DNS as the contacts app on your phone. You do not dial +1-650-253-0000 to call Google — you tap "Google" in your contacts and your phone looks up the number for you. DNS does the exact same thing for the internet, except instead of phone numbers, it looks up IP addresses.

Every device connected to the internet has an IP address — a unique numerical label. Websites live on servers that have IP addresses. When you type "google.com" into your browser, DNS figures out that google.com currently lives at 142.250.80.46 and connects you there.

The system was invented in 1983 by Paul Mockapetris (described in RFC 1034 and RFC 1035) to replace the old method of maintaining a single hosts file. Before DNS, a literal text file called HOSTS.TXT was distributed to every computer on ARPANET. That worked when there were a few hundred hosts. It does not work when there are 350 million registered domain names.

DNS is hierarchical and distributed. There is no single computer that knows every domain name. Instead, the system is split into zones, each managed by different organizations. The root zone is managed by ICANN and operated by 13 root server clusters. Below them sit the TLD (Top-Level Domain) servers for .com, .org, .net, and so on. Below those are the authoritative servers for individual domains.

DNS would be impossibly slow if every lookup required the full resolution chain. Instead, every layer of the system caches results. Here is how caching works at each level:

Here is a fact that surprises most people: traditional DNS queries are completely unencrypted. Every domain you visit is transmitted in plaintext over the network. Your ISP can see every website you request. Your employer, your coffee shop's Wi-Fi operator, and anyone intercepting your traffic can build a complete list of every site you visit.

This is a serious privacy problem, and the industry has responded with two solutions:

DNS was designed in the 1980s without any security mechanisms. The protocol trusts every response at face value, which creates attack vectors.

DNS Hijacking occurs when an attacker intercepts your DNS queries and returns fake IP addresses. You type "mybank.com" but get redirected to a phishing site. This can happen through compromised routers, malware modifying your DNS settings, or rogue Wi-Fi access points.

DNS Cache Poisoning (also called DNS spoofing) tricks a resolver into storing an incorrect record. Once poisoned, every user of that resolver gets the wrong IP for the targeted domain — potentially for hours, depending on TTL.

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. Resolvers can verify that a response truly came from the authoritative server and was not modified in transit. It does not encrypt queries (that is what DoH/DoT does), but it guarantees authenticity. Quad9 (9.9.9.9) and Cloudflare (1.1.1.1) both validate DNSSEC by default.

For the best protection, combine DNSSEC validation (use Cloudflare or Quad9 as your resolver) with DoH or DoT encryption. This gives you both authentication and confidentiality — meaning your queries cannot be seen, intercepted, or modified.