Every time you type a domain name into a browser, your device has no idea what IP address to connect to. DNS — the Domain Name System — is the distributed database that resolves that name to an address in milliseconds. It has been running since 1983 and still underpins every internet connection made today, but in 2026 it carries far more features than its original designers imagined.
What changed in 2026
- Encrypted DNS is now the norm. DNS over HTTPS (DoH) and DNS over TLS (DoT) ship enabled by default in Chrome, Firefox, Safari, Android 14+, and iOS 18. Your ISP can no longer trivially sniff your DNS queries.
- Zero-trust DNS filtering is mainstream. Teams replace legacy VPN split-tunneling with DNS-based access control — resolvers return NXDOMAIN for unauthorized destinations regardless of network location.
- DNS as a health check layer. Major authoritative providers (Route 53, Cloudflare DNS, NS1) support health-check-based routing that removes unhealthy A records in < 30 s.
- DNSSEC adoption climbed past 40% of TLDs — cryptographic signing of DNS responses is no longer a niche enterprise requirement.
How resolution works
When your browser looks up api.example.com, the resolution chain runs like this:
Browser → OS resolver (stub) → Recursive resolver (ISP or 8.8.8.8)
Recursive resolver asks:
Root server (.) → "ask .com TLD server"
.com TLD server → "ask ns1.example.com"
ns1.example.com → "the A record is 93.184.216.34"
Recursive resolver caches the answer for TTL seconds
Browser connects to 93.184.216.34
The root servers are the starting point for every query not already cached. There are 13 logical root server addresses (A–M), replicated to 1,700+ physical nodes via Anycast.
DNS record types
| Record |
Purpose |
Example value |
| A |
IPv4 address |
93.184.216.34 |
| AAAA |
IPv6 address |
2606:2800:21f:cb07::1 |
| CNAME |
Alias to another hostname |
api → api.example.com |
| MX |
Mail server, with priority |
10 mail.example.com |
| TXT |
Arbitrary text (SPF, DKIM, verification) |
v=spf1 include:… |
| NS |
Nameserver delegation |
ns1.example.com |
| SOA |
Zone authority metadata |
serial, refresh, retry, expire |
| SRV |
Service location (port + host) |
_http._tcp 80 host.example.com |
| CAA |
Which CAs may issue certs for the domain |
0 issue "letsencrypt.org" |
TTL strategy
TTL (Time To Live) is the number of seconds resolvers are allowed to cache an answer.
; Low TTL before a migration (lower first, wait, then change)
api.example.com. 60 IN A 93.184.216.34
; Normal steady-state TTL
api.example.com. 300 IN A 93.184.216.34
; Static content / CDN origin — can be much longer
assets.example.com. 86400 IN CNAME cdn.example.com.
TTL change workflow: lower TTL 24–48 h before you plan to change the record, wait for the old TTL to expire everywhere, make the change, then raise TTL again.
| TTL |
Tradeoff |
| < 30 s |
Very fast failover; floods resolvers |
| 60–300 s |
Good failover balance for APIs |
| 3600 s |
Normal for most records |
| 86400 s |
Good for stable CNAMEs / CDNs |
Encrypted DNS
Classic DNS runs over UDP port 53 with no encryption. DoH wraps queries in HTTPS (port 443). DoT wraps them in TLS (port 853).
# Query using DoH with curl
curl -s "https://cloudflare-dns.com/dns-query?name=example.com&type=A" \
-H "Accept: application/dns-json" | jq '.Answer[].data'
For internal service infrastructure, configure your resolver to use DoH or DoT upstream:
# Unbound resolver config snippet
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853
forward-addr: 8.8.8.8@853
How to pick your DNS provider
| Need |
Provider |
| Developer simplicity |
Cloudflare DNS (free tier generous) |
| AWS-native health routing |
Route 53 |
| Advanced traffic shaping |
NS1 / IBM NS1 |
| Enterprise + DNSSEC SLA |
Akamai Edge DNS |
| Internal / zero-trust |
NextDNS, Cloudflare Gateway |
Common mistakes
Setting TTL to 0 or 1 in production. Many resolvers floor TTL at 30–60 s regardless. Setting it lower wastes queries and can trigger rate limiting at the resolver tier.
Using CNAME at the zone apex. A CNAME on the bare domain (example.com) violates RFC 1034 — it cannot coexist with SOA/NS records. Use ALIAS or ANAME records if your provider supports them, or A records directly.
Forgetting to lower TTL before migration. If your A record has a 24-hour TTL and you change it without pre-lowering, some users will see the old IP for up to 24 hours.
No CAA records. Without CAA, any CA in the world can issue a certificate for your domain. Add 0 issue "letsencrypt.org" (or your CA of choice) to prevent misissuance.
Ignoring negative TTL. NXDOMAIN responses are also cached — set negative-ttl in your zone SOA to a reasonable value (300–600 s) or typo corrections take forever to propagate.
What to skip
- Running your own authoritative nameserver unless you have a specific reason — hosted DNS (Cloudflare, Route 53) is more reliable than a self-managed BIND instance.
- Wildcard A records for everything — they mask misconfigured subdomains and complicate certificate issuance.
- DNSSEC without automated key rotation — DNSSEC misconfiguration can make your entire domain unresolvable; only enable it if you can automate the key rollover.
FAQ
Why does DNS propagation take "24–48 hours"?
It does not, really. DNS changes propagate within seconds to minutes. The "24–48 hours" myth comes from old high-TTL records. With TTLs of 300 s, changes are visible worldwide in under 10 minutes.
What is the difference between a recursive resolver and an authoritative nameserver?
A recursive resolver (like 8.8.8.8) walks the delegation chain on your behalf and caches results. An authoritative nameserver holds the actual zone records and gives definitive answers for its domains.
Can I use multiple A records for load balancing?
Yes — this is DNS round-robin. The resolver returns all A records and the client picks one. It is crude load balancing (no health checking), but useful for simple setups.
How do I test DNS changes before they go live?
Query the authoritative nameserver directly, bypassing resolver caches: dig @ns1.example.com api.example.com A. You will see the authoritative answer immediately.
Where to go next