What is DNS?

The Domain Name System (DNS) is the distributed naming service that translates human-readable domain names, such as example.com, into the IP addresses computers use to reach each other on a network. Acting as the internet’s directory, DNS resolves billions of queries daily so users can reach sites and services without memorizing numeric addresses.

Key takeaways

• DNS translates domain names into the IP addresses networks route on.
• Resolution moves through resolvers, root, TLD, and authoritative servers.
• Record types such as A, AAAA, MX, and CNAME each serve a distinct role.
• DNS over TLS and DNS over HTTPS encrypt queries once sent in the clear.
• VOS devices proxy, filter, and steer DNS traffic alongside SD-WAN policy.

On this page: Why it matters · How it works · Types · DNS & Versa · FAQ

Why is DNS important?

DNS is one of the internet’s foundational protocols: essentially no browsing session, API call, or cloud connection starts without a DNS lookup. It exists because people navigate by name and networks route by address, and translating between the two at global scale needs a naming system that is distributed and cacheable, not a single central directory.

That distribution is also why DNS scales. No single server holds every mapping; authority is delegated hierarchically from the root through top-level domains to the organizations operating individual zones, and caching at every layer keeps most queries off the wider internet. The same trust model makes DNS a favorite attack surface – cache poisoning, spoofing, and tunneling all abuse it – which is why encrypted transports and DNS-aware filtering are now standard parts of a security architecture.

What is DNS?

A DNS lookup starts at a stub resolver on the client, which forwards the query to a recursive resolver – often run by an ISP, enterprise, or public provider. If not already cached, the recursive resolver walks the hierarchy: it asks a root server which top-level domain (TLD) server is authoritative for the suffix, asks that TLD server which authoritative server holds the zone, then queries the authoritative server for the record.

Each record carries a time-to-live (TTL) governing how long resolvers may cache it before asking again. Records come in typed formats: an A record maps a name to an IPv4 address, AAAA to IPv6, CNAME aliases one name to another, MX identifies mail servers, NS delegates a zone, and TXT carries text used for records such as SPF and DKIM.

Types of DNS

DNS resolution involves several server roles. Recursive resolvers do the work on a client’s behalf, walking the hierarchy and caching results. Authoritative servers hold the actual records for a zone. Root and TLD servers exist only to redirect queries toward the right authoritative server; they do not answer for individual domains.

Transport has diversified too. Classic DNS runs unencrypted over UDP, falling back to TCP for larger responses – a design that leaves queries visible on the path. DNS over TLS (DoT) and DNS over HTTPS (DoH) wrap queries in TLS to close that gap, at the cost of extra connection setup; plain UDP and TCP remain the default where compatibility outweighs the added encryption.

DNS & Versa

VOS devices can act as a DNS proxy, intercepting client DNS requests and redirecting them to the right resolver based on configurable rules, as described in Configure a DNS Proxy. A common pattern is split DNS: internal domain patterns resolve against an enterprise DNS server while everything else goes to a public resolver, offloading recursive lookups from the corporate server. DNS proxy profiles in Director support failover or round-robin resolvers, SNAT pools, and – from Release 23.1.1 – DoH and DoT connections.

For SD-WAN direct internet access, Configure DNS Proxy with SD-WAN Traffic Steering for DIA lets a DNS query consult SD-WAN traffic-steering policy, giving loose or strict path affinity with the application traffic that follows it. On the security side, Configure DNS Filtering (NGFW) applies allow lists, deny lists, reputation-based lookups for newly observed domains, and DNS tunneling detection to block malicious resolution before a session is established.

Frequently asked questions

What is the difference between a domain name and a DNS record?

A domain name, such as example.com, is the human-readable label. A DNS record is the data an authoritative server returns for it – an IP address, a mail server, a text value – and one domain typically holds many record types at once.

What is a DNS resolver?

A resolver performs lookups on a client’s behalf. A stub resolver on the device forwards the query to a recursive resolver, which walks root, TLD, then authoritative servers and caches the result for reuse.

What is DNS caching and TTL?

Every DNS record carries a time-to-live (TTL), the number of seconds a resolver may reuse a cached answer before querying again. Caching at each layer is what lets DNS absorb global query volume without every lookup reaching an authoritative server.

What is DNS over HTTPS (DoH)?

DoH wraps DNS queries inside an HTTPS connection, encrypting them so intermediaries cannot read or tamper with the request. DoT achieves the same goal over a dedicated TLS connection; both replace plaintext UDP or TCP DNS traffic.

What is DNS filtering?

DNS filtering evaluates DNS requests against allow lists, deny lists, and reputation data to block resolution of known-malicious or newly observed domains before a connection is made. It can also detect DNS tunneling, an attack that hides data inside DNS queries.

More on DNS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DNS, these are worth looking at next.