DNS

Think about how you call a friend: you tap their name in your phone's contacts rather than memorizing a 10-digit number. The internet works the exact same way. Humans remember words easily, but computers only understand precise numbers.

This numerical address is called an IP address—a unique identifier for every device connected to the internet. Because these numbers are long and complicated, it is nearly impossible for people to memorize them for every website. That is why we need a directory that pairs human-friendly domain names with machine-readable IP addresses.

The moment you type an address into your web browser, your computer consults DNS, the internet's giant phone book. In less than a second, it looks up the number matched to that name and connects straight to the server behind it to display the page.

If the world relied on a single master phone book, billions of requests would crash it instantly. Instead, DNS uses a distributed system where multiple servers divide the workload and manage records hierarchically, much like departments in a large corporation.

When looking up an address, DNS works backward from the right end of the domain. It first asks a root server at the very top, which points to the server handling endings like .com or .org. That server then directs the request to the next level down. Step by step, the inquiry gets handed off until the final IP address is found.

Going through all these steps every single time would be slow, so recently discovered addresses are temporarily saved on your computer and your internet provider's network. This storage is called a cache. If you visit the same site again before the cache expires, your browser skips the lookup and connects instantly.

Web addresses look like a single string, but dots actually break them into a clear hierarchy. At the very top sit the root nameservers—operated across 13 global clusters—with domain-extension servers branching out underneath them like tree limbs.

When you enter a web address, a messenger program does the legwork of tracking down the number across global DNS servers on your behalf. This is called a recursive resolver, and it is typically run by your internet service provider (ISP).

If a DNS record is tampered with and hands out the wrong number, you could be redirected to an impostor site that looks identical to the real thing. To prevent this, DNS Security Extensions (DNSSEC) use digital signatures to verify that the returned data is authentic, and adoption is growing across domains and servers worldwide.