{"post":{"slug":"dns-explained-2026","title":"DNS explained in 2026: how domain name resolution actually works","excerpt":"DNS is the phonebook of the internet — but in 2026 it also handles service discovery, failover, and encrypted queries. Here is the full picture.","category":"code","date":"March 10, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">E</span>very time you type a domain name into a browser, your device has no idea what IP address to connect to. DNS — the Domain Name System — is the distributed database that resolves that name to an address in milliseconds. It has been running since 1983 and still underpins every internet connection made today, but in 2026 it carries far more features than its original designers imagined.\n\n## What changed in 2026\n\n- **Encrypted DNS is now the norm.** DNS over HTTPS (DoH) and DNS over TLS (DoT) ship enabled by default in Chrome, Firefox, Safari, Android 14+, and iOS 18. Your ISP can no longer trivially sniff your DNS queries.\n- **Zero-trust DNS filtering is mainstream.** Teams replace legacy VPN split-tunneling with DNS-based access control — resolvers return NXDOMAIN for unauthorized destinations regardless of network location.\n- **DNS as a health check layer.** Major authoritative providers (Route 53, Cloudflare DNS, NS1) support health-check-based routing that removes unhealthy A records in < 30 s.\n- **DNSSEC adoption climbed past 40% of TLDs** — cryptographic signing of DNS responses is no longer a niche enterprise requirement.\n\n## How resolution works\n\nWhen your browser looks up `api.example.com`, the resolution chain runs like this:\n\n```\nBrowser → OS resolver (stub) → Recursive resolver (ISP or 8.8.8.8)\n  Recursive resolver asks:\n    Root server (.)        → \"ask .com TLD server\"\n    .com TLD server        → \"ask ns1.example.com\"\n    ns1.example.com        → \"the A record is 93.184.216.34\"\n  Recursive resolver caches the answer for TTL seconds\n  Browser connects to 93.184.216.34\n```\n\nThe root servers are the starting point for every query not already cached. There are 13 logical root server addresses (A–M), replicated to 1,700+ physical nodes via Anycast.\n\n## DNS record types\n\n| Record | Purpose | Example value |\n| --- | --- | --- |\n| A | IPv4 address | `93.184.216.34` |\n| AAAA | IPv6 address | `2606:2800:21f:cb07::1` |\n| CNAME | Alias to another hostname | `api → api.example.com` |\n| MX | Mail server, with priority | `10 mail.example.com` |\n| TXT | Arbitrary text (SPF, DKIM, verification) | `v=spf1 include:…` |\n| NS | Nameserver delegation | `ns1.example.com` |\n| SOA | Zone authority metadata | serial, refresh, retry, expire |\n| SRV | Service location (port + host) | `_http._tcp 80 host.example.com` |\n| CAA | Which CAs may issue certs for the domain | `0 issue \"letsencrypt.org\"` |\n\n## TTL strategy\n\nTTL (Time To Live) is the number of seconds resolvers are allowed to cache an answer.\n\n```\n; Low TTL before a migration (lower first, wait, then change)\napi.example.com.  60  IN  A  93.184.216.34\n\n; Normal steady-state TTL\napi.example.com.  300  IN  A  93.184.216.34\n\n; Static content / CDN origin — can be much longer\nassets.example.com.  86400  IN  CNAME  cdn.example.com.\n```\n\n**TTL change workflow:** lower TTL 24–48 h before you plan to change the record, wait for the old TTL to expire everywhere, make the change, then raise TTL again.\n\n| TTL | Tradeoff |\n| --- | --- |\n| < 30 s | Very fast failover; floods resolvers |\n| 60–300 s | Good failover balance for APIs |\n| 3600 s | Normal for most records |\n| 86400 s | Good for stable CNAMEs / CDNs |\n\n## Encrypted DNS\n\nClassic DNS runs over UDP port 53 with no encryption. DoH wraps queries in HTTPS (port 443). DoT wraps them in TLS (port 853).\n\n```bash\n# Query using DoH with curl\ncurl -s \"https://cloudflare-dns.com/dns-query?name=example.com&type=A\" \\\n  -H \"Accept: application/dns-json\" | jq '.Answer[].data'\n```\n\nFor internal service infrastructure, configure your resolver to use DoH or DoT upstream:\n\n```yaml\n# Unbound resolver config snippet\nforward-zone:\n  name: \".\"\n  forward-tls-upstream: yes\n  forward-addr: 1.1.1.1@853\n  forward-addr: 8.8.8.8@853\n```\n\n## How to pick your DNS provider\n\n| Need | Provider |\n| --- | --- |\n| Developer simplicity | Cloudflare DNS (free tier generous) |\n| AWS-native health routing | Route 53 |\n| Advanced traffic shaping | NS1 / IBM NS1 |\n| Enterprise + DNSSEC SLA | Akamai Edge DNS |\n| Internal / zero-trust | NextDNS, Cloudflare Gateway |\n\n## Common mistakes\n\n**Setting TTL to 0 or 1 in production.** Many resolvers floor TTL at 30–60 s regardless. Setting it lower wastes queries and can trigger rate limiting at the resolver tier.\n\n**Using CNAME at the zone apex.** A CNAME on the bare domain (`example.com`) violates RFC 1034 — it cannot coexist with SOA/NS records. Use ALIAS or ANAME records if your provider supports them, or A records directly.\n\n**Forgetting to lower TTL before migration.** If your A record has a 24-hour TTL and you change it without pre-lowering, some users will see the old IP for up to 24 hours.\n\n**No CAA records.** Without CAA, any CA in the world can issue a certificate for your domain. Add `0 issue \"letsencrypt.org\"` (or your CA of choice) to prevent misissuance.\n\n**Ignoring negative TTL.** NXDOMAIN responses are also cached — set `negative-ttl` in your zone SOA to a reasonable value (300–600 s) or typo corrections take forever to propagate.\n\n## What to skip\n\n- **Running your own authoritative nameserver** unless you have a specific reason — hosted DNS (Cloudflare, Route 53) is more reliable than a self-managed BIND instance.\n- **Wildcard A records for everything** — they mask misconfigured subdomains and complicate certificate issuance.\n- **DNSSEC without automated key rotation** — DNSSEC misconfiguration can make your entire domain unresolvable; only enable it if you can automate the key rollover.\n\n## FAQ\n\n**Why does DNS propagation take \"24–48 hours\"?**\nIt does not, really. DNS changes propagate within seconds to minutes. The \"24–48 hours\" myth comes from old high-TTL records. With TTLs of 300 s, changes are visible worldwide in under 10 minutes.\n\n**What is the difference between a recursive resolver and an authoritative nameserver?**\nA recursive resolver (like 8.8.8.8) walks the delegation chain on your behalf and caches results. An authoritative nameserver holds the actual zone records and gives definitive answers for its domains.\n\n**Can I use multiple A records for load balancing?**\nYes — this is DNS round-robin. The resolver returns all A records and the client picks one. It is crude load balancing (no health checking), but useful for simple setups.\n\n**How do I test DNS changes before they go live?**\nQuery the authoritative nameserver directly, bypassing resolver caches: `dig @ns1.example.com api.example.com A`. You will see the authoritative answer immediately.\n\n## Where to go next\n\n- [CDNs explained in 2026](/blog/cdns-explained-2026)\n- [SSL/TLS explained in 2026](/blog/ssl-tls-explained-2026)\n- [Load balancers explained in 2026](/blog/load-balancers-explained-2026)","hue":310,"metaTitle":"DNS Explained in 2026: How Domain Name Resolution Works","metaDescription":"Plain-language guide to DNS in 2026. How the resolver chain works, record types, TTL strategy, DoH/DoT, and common misconfigurations to avoid.","keywords":["dns explained 2026","how dns works 2026","domain name resolution","dns record types 2026","dns over https doh","dns ttl strategy","dns failover 2026","authoritative nameserver","dns caching explained","dns best practices 2026"],"tldr":["**DNS translates human-readable names to IP addresses** — without it every URL would be a raw IP address like 104.21.88.23.","**Resolution is a chain of delegations** — root servers delegate to TLD servers which delegate to your authoritative nameserver.","**TTL controls caching** — a TTL of 300 s means resolvers cache the answer for 5 minutes; low TTL enables faster failover but increases query volume.","**DNS over HTTPS (DoH) and DNS over TLS (DoT) are now the default** in major browsers and mobile OSes, encrypting queries that were historically plaintext.","**Skip:** setting TTL to 1 second in production — it floods resolvers, trips rate limits, and provides negligible failover benefit over 30–60 seconds."],"readTime":"5 min read","wordCount":1081},"related":[{"slug":"what-is-dns-2026","title":"What is DNS in 2026? The internet phone book explained","excerpt":"DNS turns a name like example.com into the numeric address a computer needs to connect. Here is how that lookup works, why it matters, and where it breaks.","category":"code","date":"June 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":205},{"slug":"ssl-tls-explained-2026","title":"SSL/TLS explained in 2026: how HTTPS actually secures your connection","excerpt":"TLS 1.3 is now the minimum bar, certificate lifetimes are shrinking to 90 days, and post-quantum handshakes are shipping. Here is the full picture.","category":"code","date":"April 7, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":311},{"slug":"middleware-explained-2026","title":"Middleware explained in 2026: how request pipelines actually work","excerpt":"Middleware is the chain of functions between a request arriving and your route handler running. In 2026 it spans HTTP servers, message brokers, and AI inference pipelines.","category":"code","date":"March 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":318}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"dependency-injection-explained-2026","title":"Dependency injection explained in 2026: from concept to production","excerpt":"Dependency injection is the pattern behind every testable, maintainable service. This 2026 guide covers the concept, DI containers, and when to skip them entirely.","category":"code","date":"March 10, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":320},"older":{"slug":"dynamic-programming-explained-2026","title":"Dynamic programming explained in 2026: memoisation, tabulation, and patterns","excerpt":"Dynamic programming turns exponential brute-force into polynomial solutions by reusing overlapping subproblems. Here are the patterns you need in 2026.","category":"code","date":"March 10, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":315}}