DNS Deep Dive
How the internet's phone book works-and why it matters for system design.
1The Phone Book Analogy
DNS (Domain Name System) translates human-readable domain names into IP addresses. It's a distributed, hierarchical database that powers every internet request.
2DNS Resolution Flow
Full resolution takes 4 round trips. Caching at each level dramatically reduces this for popular domains.
3DNS Record Types
| Type | Purpose | Example |
|---|---|---|
| A | Domain to IPv4 | example.com → 93.184.216.34 |
| AAAA | Domain to IPv6 | example.com → 2606:2800:220:1:... |
| CNAME | Alias to another domain | www.example.com → example.com |
| MX | Mail server | example.com → mail.example.com |
| TXT | Text data (verification) | SPF, DKIM, domain verification |
| NS | Nameserver delegation | example.com → ns1.provider.com |
4TTL and Caching
300s (5 min)
Dynamic IPs, failover
More queries, faster propagation
3600s (1 hour)
Standard websites
Balanced caching and updates
86400s (1 day)
Stable services
Fewer queries, slow propagation
604800s (1 week)
Very stable infrastructure
Maximum caching, slowest updates
Migration Tip
Before migrating servers, lower TTL to 5 minutes days in advance. After migration, you can raise it again.
5DNS for Load Balancing
Round Robin
Return different IPs in rotation. Simple but no health awareness.
First query: 10.0.0.1, Second: 10.0.0.2, Third: 10.0.0.3Weighted Round Robin
Higher weight = more traffic. For heterogeneous servers.
Server A (weight 3) gets 3x traffic of Server B (weight 1)Geolocation
Return closest server based on client location.
US client → us-east.example.com, EU client → eu-west.example.comLatency-based
Route to lowest latency datacenter.
AWS Route 53 measures latency to each region6Common Issues
DNS Propagation Delay
After changing DNS, old records cached worldwide. Takes up to 48 hours for full propagation.
Fix: Lower TTL before changes, wait, then make changes.
DNS Cache Poisoning
Attacker injects fake records into resolver cache. Users redirected to malicious sites.
Fix: Use DNSSEC. Validate responses.
Single Point of Failure
All traffic depends on DNS. If DNS is down, nothing works.
Fix: Multiple nameservers, different providers.
7Key Takeaways
?Quiz
1. You're migrating to new servers. What should you do first?
2. CNAME record is used for: