IP Addresses & Networks Basic Technical Explainer

What is DNS?¶

The Domain Name System (DNS) is a distributed system for finding information associated with domain names. It is often used to find the IP address needed to connect to a service, but it stores other kinds of information too.

The short version

DNS helps software turn names such as example.org into the technical information needed to use internet services. A DNS lookup is not the same thing as visiting the service.

Names and records¶

People usually find names easier to remember than IP addresses. DNS lets an application ask a question such as:

Which IP address is currently associated with example.org?

The answer is held in a DNS resource record. Different record types answer different questions.

Record	Common purpose
A	Associates a name with an IPv4 address
AAAA	Associates a name with an IPv6 address
MX	Identifies mail-exchange systems for a domain
NS	Identifies authoritative name servers
CNAME	Makes one name an alias of another
TXT	Holds text used for several purposes, including some email controls
PTR	Associates an address with a name in reverse DNS

An answer may contain more than one record. One name can resolve to several addresses, and several names can ultimately lead to the same service or address.

What happens during a lookup¶

Most devices do not search the whole DNS hierarchy themselves. They send the question to a DNS resolver.

The resolver may already have a saved answer. If not, it can follow referrals through the DNS hierarchy until it reaches a server that can provide an authoritative answer for the relevant zone.

The complete lookup process can involve:

an application asking the device for a name;
the device consulting local information or a configured resolver;
the resolver using cached information or contacting other DNS servers; and
the answer returning to the application.

The application can then use the returned information to attempt a connection.

Caching and change¶

DNS answers are commonly cached so the same question does not need to be resolved from the beginning every time.

Each resource record has a time to live (TTL) that controls how long it may be cached. This means a resolver can legitimately return an older answer for a period after the authoritative record has changed.

DNS caching is one reason current lookup results may not describe what a user or system received at an earlier time.

DNS is not a complete record of internet activity¶

A DNS query shows that a name was looked up from a particular technical position. It does not by itself prove:

that a website was visited;
that a connection to the returned address succeeded;
what content was viewed or exchanged;
which application caused the lookup; or
which person was using the device or connection.

Queries can be generated by browsers, applications, background services, security tools, previews and automated systems. Answers may also come from a local cache without a new external query being recorded.

DNS and privacy¶

Traditional DNS queries are often sent in a form visible to the resolver and network path. Encrypted DNS methods can protect the query while it travels to the chosen resolver, but the resolver still needs to process the name.

Where the DNS request is made and logged therefore depends on the device, application, network configuration and resolver being used.

Domain names are not IP addresses¶

A domain name is a name within the DNS hierarchy. An IP address is network addressing information.

DNS can associate the two, but the relationship can change over time. A domain can move to a different address, use several addresses or use an intermediary such as a content-delivery network. An IP address can also host services for many domain names.

The point to remember¶

DNS answers questions about names. A lookup can be useful technical evidence, but it is not proof that a person visited or used the named service.

Explore related guidance

Go deeper

Investigator First - back to the investigation