DNS Explained: How a Name Becomes an Address (with nslookup)

Computers find each other by number (an IP addressIn plain words: A device’s street address on a network: four numbers separated by dots, like 192.168.1.37.Technical: A 32-bit number (IPv4), written as four octets. It combines which network the device is on and which device it is on that network.Click for the full glossary entry), but people remember names. DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry is the phone book that turns a name like stashgrid.ai into a number. It is also a bitIn plain words: A bit is one on-or-off switch. Eight of them make a byte.Technical: The smallest unit of data: 0 or 1. An IPv4 address is 32 bits, grouped as four 8-bit octets.Click for the full glossary entry like a street address: the name is what you tell people, and the number is what the mail carrier needs.

Here is the journey of one lookup:

1. Your computer checks its own memory first. If it recently looked up the name, it already knows.
2. If not, it asks a resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry (usually your routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry, which passes it to your internet provider’s DNS, or to a public one like 1.1.1.1 or 8.8.8.8).
3. If the resolver does not know, it asks a root server: “who handles .ai?”
4. Then it asks the .ai servers: “who handles stashgrid.ai?”
5. Then it asks that domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry’s own authoritative server: “what is the address?” and gets the final answer.
6. The answer is passed back to you, and remembered for a while so the next lookup is instant.

Why this matters. Almost everything you do online starts with a DNS lookup. If it fails, nothing loads, even though the connection itself is fine.

Open a command promptIn plain words: A window where you type instructions instead of clicking. The shortcut name is cmd.Technical: Windows’ text-mode shell (cmd.exe). PowerShell is a newer one. On a Mac the equivalent is Terminal.Click for the full glossary entry and type:

> nslookup stashgrid.ai

Read the answer in two parts:

• The first lines show which DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry server answered: its name (often “UnKnown” on home networks, which is normal) and its address. That is your resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry, usually your routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry.
• Then a line saying Non-authoritative answer followed by Name and Address. That is the answer. “Non-authoritative” only means the resolver gave you a remembered answer instead of asking the domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry’s own server just now.

If you see several addresses, the site uses more than one server for the same name. That is normal for busy sites.

Why this matters. This is how you prove a name points where you think it does. It is the first thing to check when a site is “down for you but up for everyone else.”

DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry stores more than addresses. Each kind of answer is a record type. Try these:

> nslookup -type=A example.com
> nslookup -type=AAAA example.com
> nslookup -type=NS example.com
> nslookup -type=MX gmail.com
> nslookup -type=TXT gmail.com

• A — the IPv4In plain words: The original kind of internet address: four numbers with dots, like 192.168.1.37. There are only about 4.3 billion of them, and they ran out.Technical: 32-bit addresses (about 4.3 billion). The free pools of the regional registries ran out between 2011 and 2015, which is why NAT is everywhere.Click for the full glossary entry address for a name.
• AAAA — the IPv6In plain words: The newer kind of internet address, long enough that we will never run out. It looks like 2001:db8::1, with letters and colons. Windows has it switched on already.Technical: 128-bit addresses written as eight groups of hex, defined in RFC 8200 and RFC 4291. Devices usually run IPv4 and IPv6 side by side (dual-stack).Click for the full glossary entry address (see the IPv6 lesson).
• CNAME — “this name is really another name.” Used a lot for websites hosted by someone else.
• NS — which servers are in charge of the domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry.
• MX — which servers receive the domain’s email. Lower numbers are tried first.
• TXT — free text. Among other things it holds the email rules called SPFIn plain words: Three checks that ask: did this email really come from the company it says it did? A “fail” is a warning sign.Technical: SPF lists servers allowed to send for a domain, DKIM is a digital signature on the message, and DMARC says what to do if either fails. Shown as pass or fail in the header.Click for the full glossary entry, which you may see as a line starting v=spf1 (see the email headers lesson).

Why this matters. Email that does not arrive is usually an MX problem. Websites that do not load after a move are usually an A or CNAME problem. Knowing the record typesIn plain words: The different kinds of answer DNS can give: an address, a mail server, who is in charge, or a note.Technical: A maps a name to an IPv4 address, AAAA to an IPv6 address, CNAME to another name, MX to mail servers, NS to the zone’s name servers, TXT to free text such as SPF policies.Click for the full glossary entry tells you where to look.

Your computer remembers answers so the next lookup is instant. Each answer comes with its own TTLIn plain words: A countdown stamped on every packet so it cannot wander the internet forever.Technical: A counter that drops by one at every router. At zero the router discards the packet and replies with an ICMP time-exceeded message. Traceroute uses this to make each router identify itself. (DNS records have a different TTL: how long an answer may be remembered.)Click for the full glossary entry, the number of seconds it may be remembered. (This is a different TTL from the one traceroute uses, and the names are a coincidence.)

To see what your computer currently remembers, and then forget it:

> ipconfig /displaydns
> ipconfig /flushdns

The first prints a long list of remembered names. The second clears it, and Windows says it succeeded. Your next lookups are slower for a moment as DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry is asked again.

Why this matters. When a site moves and you still reach the old one, or a fixed record does not take effect, stale memory is why. Flushing is the fix on your side. The TTL tells you how long everyone else may take to catch up.

Try these two, one after the other:

> ping 1.1.1.1
> ping example.com

• Both work — the internet and DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry are fine.
• The first works, the second says it could not find the host — your connection is fine, but DNS is not working. Try another resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry (below).
• Neither works — the problem is your connection, not DNS. Go to the Wi-Fi lesson or the DHCP lesson.

You can ask a specific resolver by adding its address at the end:

> nslookup stashgrid.ai 1.1.1.1
> nslookup stashgrid.ai 8.8.8.8

1.1.1.1 is Cloudflare’s public resolver and 8.8.8.8 is Google’s. If they answer but your own resolver does not, your routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry or provider’s DNS is the problem, and you can set your computer or router to use a public one instead.

Why this matters. This two-line test saves hours. It separates “no connection” from “no names” immediately.

DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry was written down in 1987 in two documents that are still the foundation: RFC 1034 (concepts and facilities) explains the ideas (the tree of names, zones, resolversIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry), and RFC 1035 (implementation and specification) defines the exact message format and record typesIn plain words: The different kinds of answer DNS can give: an address, a mail server, who is in charge, or a note.Technical: A maps a name to an IPv4 address, AAAA to an IPv6 address, CNAME to another name, MX to mail servers, NS to the zone’s name servers, TXT to free text such as SPF policies.Click for the full glossary entry.

• DNS normally uses UDP port 53 for quick questions and TCP port 53 for large answers. The original limit for a UDP answer was 512 bytes, later extended (RFC 6891 (EDNS)).
• Every record has a TTLIn plain words: A countdown stamped on every packet so it cannot wander the internet forever.Technical: A counter that drops by one at every router. At zero the router discards the packet and replies with an ICMP time-exceeded message. Traceroute uses this to make each router identify itself. (DNS records have a different TTL: how long an answer may be remembered.)Click for the full glossary entry, a name, a type and the data.
• Plain DNS is not encrypted. Anyone on the path (your Wi-Fi, your provider) can see which names you look up, and in principle alter the answers. Two fixes exist: DNS over HTTPS (RFC 8484) and DNS over TLS (RFC 7858) encrypt the question and answer. A third, DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry, adds signatures so answers cannot be forged. They solve different problems, and the next lesson explains which.

The attacker’s view. Whoever controls your DNS answers controls where you go: a fake answer can send you to a fake site. That is DNS spoofing, and it is why DNS security matters.