DNS Explorer

How does your computer find a website's address?

Beginner8 minSimulated

Words you’ll meet:

DNS
UDP
Caching

A resolver that knows nothing but the root hints, walking the tree from the top: two referrals, one answer, and then a second question whose answer will not fit in a UDP datagram.

The root server returns a referral, never an address
One recursive query at the top becomes several iterative ones below it
Glue: why a referral carries addresses as well as names
TC and the retry over TCP when a response exceeds 512 bytes

Look up a name

Simulated

Resolved against the zone fixtures bundled with this page, inside this browser tab. No name typed here is ever sent to a real nameserver, and there is no code path in this module that could send one.

Domain name

Record type

An IPv4 address. The record everyone means when they say "DNS lookup".

Resolver cache

The resolver knows only the root hints, so this costs the whole walk.

Transport

The default. One datagram out, one back, and 512 bytes unless EDNS(0) raises it.

DNSSEC

Unsigned. The answer is believed because of where it came from, not because it can be proved.

Names these zones can answer for

8 steps. Pause, step back or replay any of them.

Press Play to watch it happen, in 8 steps.

Steps

Nothing is cached, so this costs the full walk from the root. The stub resolver in the operating system sends one query with RD set and then waits. It walks nothing itself -- that is the whole division of labour, and everything that follows happens on the far side of this single question.
j.root-servers.net is asked for example.com and does not answer it. Back come the nameservers for the top-level domain and their addresses -- a referral. A root server has never held the address of a website and never will.
a.gtld-servers.net knows which servers run each domain in its registry and nothing whatever about what is inside them. So it refers as well, and the resolver ends the exchange one label closer than it started.
The first server in the chain that has ever heard of example.com. It answers out of its own zone file with AA set -- or refers once more, if the zone has been cut again below it.
One question went out and one answer comes back, however much work happened in between. The stub never saw the root, the TLD, or a single referral -- which is why DNS looks like a lookup table from the application side, and why so few people picture the tree behind it.
A DKIM public key -- a long TXT record in the same zone, which is about to run into the size limit of a datagram. The stub resolver in the operating system sends one query with RD set and then waits. It walks nothing itself -- that is the whole division of labour, and everything that follows happens on the far side of this single question.
The answer will not fit in the 512 bytes a plain UDP DNS response is limited to. What comes back is a header with TC set and nothing much else; the resolver throws it away, opens a TCP connection, and asks the identical question a second time.
One question went out and one answer comes back, however much work happened in between. The stub never saw the root, the TLD, or a single referral -- which is why DNS looks like a lookup table from the application side, and why so few people picture the tree behind it.

Details

Nothing selected

Click anything on the map (a device, a cable, or a moving message) to see what it is.

Step 1 of 8

0 ms243 ms

Resolution ladder

5 queries · 143 ms · the hierarchy was walked · click a rung to seek

stub resolverclient192.168.1.112
recursive resolverresolver.example.net192.0.2.53
root serverj.root-servers.net192.0.2.10
TLD servera.gtld-servers.net192.0.2.30
authoritative serverns1.example.com203.0.113.10

Query: stub resolver → recursive resolver

UDP/53

the resolver asked 3 questions of its own to answer this one (RFC 1034 §4.3.2 — Domain Names -- Concepts and Facilities)

ID: 0x05d9
Flags: RD
An/Ns/Ar: 0/0/0
Size: 29 B

Question

example.com. IN A

Answer

Empty. Nothing here answered the question — on a referral that is correct, and the authority section says who to ask next.

Authority

Empty. Nobody was named to ask instead.

Additional

Empty. No glue was needed, or none could be supplied.

Resolver cache

0 live · 0 negative

At the playhead

Empty. Nothing has been learned yet — the resolver knows only the root hints, which are configuration rather than cache.

Everything that happened7 / 89

The map as a list

5 machines, 4 links

Loading the simulation…

DNS Explorer

Look up a name

How to use this page

Steps

Details

Resolution ladder

Query: stub resolver → recursive resolver

Question

Answer

Authority

Additional

Resolver cache

The map as a list

Look up a name

How to use this page

Steps

Details

Resolution ladder

Query: stub resolver → recursive resolver

Question

Answer

Authority

Additional

Resolver cache

The map as a list