DNS
No machine anywhere holds a list of every name on the internet. A resolver begins knowing one thing, where the root servers are, and every server it asks either answers or names the servers to ask instead. That referral is not a failure to answer. It is the answer, and following three or four of them is how every name you have ever typed was found.
A walk from the root, one referral at a time, and what a cache is worth
1 A resolver that knows one thing: where the root is
The resolver is told the root servers when it is installed and knows nothing else. Pick a name and watch it start from there.
2 The root, which knows the top-level domain
The root does not know the address and never did. What it knows is which servers are authoritative for the top-level domain, and it says so.
| zone | asked | said | kind |
|---|---|---|---|
| the root | a.root-servers.net | a.cctld.us | ask them instead |
| us | a.cctld.us | ns1.logicalart.us | ask them instead |
| logicalart.us | ns1.logicalart.us | 203.0.113.10 | the answer |
3 The top-level domain, which knows the authoritative server
Each referral is one step further down the tree, and the tree is the name read backwards. The last server in the chain is the only one that holds the address.
- the name
- logicalart.us
- servers asked
- 3
- the address
- 203.0.113.10
4 The answer, and how long anyone is allowed to keep it
The answer arrives with a time to live, which is a permission rather than a promise: it says how long anybody may keep this before asking again. Ask the same name twice and the second walk is shorter, because the referrals were kept too.
- time to live
- 3600 seconds (60 minutes)
- servers asked the second time
- 0
- queries saved
- 3
Three servers, and not one of them held the answer until the last. The root named the top-level domain's servers, those named the domain's own, and only the last had an address. Asked again inside 3600 seconds the whole walk is skipped, which is why the internet does not collapse under the weight of everybody looking things up.
What is real here, and what is not
The zone tree here is a small invented one, and the addresses are reserved
Three names, three top-level domains and one root, so the whole walk fits on a screen. The addresses are all inside 203.0.113.0/24, which RFC 5737 reserves for documentation precisely so that nobody's real host is named on a page like this. The real root has thirteen server names behind a great many machines, and a real walk may involve glue records, several nameservers per zone, and retries.
Nothing here expires on a clock
The time to live is shown and used to decide whether a second walk can skip a step, but the page passes a notional now rather than watching the clock, so a run repeats exactly. A real cache is a race between the record's age and the next question.
There is no security on this page at all
Everything shown is plain UDP with no authentication of any kind, which is what the 1983 design specified and what the internet ran on for decades. DNSSEC, and the various ways of carrying queries inside TLS, are later and are not modelled here.