What Does DNS Stand For? How It Works, Types & Examples

DNS stands for Domain Name System, defined in RFC 1034 and RFC 1035 back in 1987. It is the internet service that translates human-readable domain names, like copahost.com, into the machine-readable IP addresses that computers actually use to find each other — such as 185.15.43.160.

The DNS holds much more than just the address of a website. The same system stores the mail servers that receive your email (MX records), the validation protocols that prove your messages are legitimate (SPF, DKIM and DMARC), domain ownership verification, and even SSH fingerprints.

DNS definition: What does DNS stand for in networking

You’ll see it called Domain Name System, Domain Name Server and occasionally Domain Name Service. The first is the formal name of the system, as defined in the RFCs. The second usually refers to an individual machine running it — a specific server rather than the system as a whole. And the third is a loose variant that appears in older documentation and in some vendor material; it isn’t wrong exactly, but it isn’t the formal name either.

The reason it exists comes down to a mismatch. The TCP/IP protocol that carries virtually all internet traffic only understands numbers: every connection is made from one IP address to another. People, on the other hand, remember names. DNS is the layer in between — it lets you type a name while the network works with an address.

One structural detail explains a lot about how that lookup works. Domain names are read right to left, getting more specific as they go: in blog.copahost.com, the .com is the broadest part, copahost narrows it down, and blog is the most specific. That hierarchy is not decorative — it’s the path the lookup actually follows, one level at a time.

How does DNS work?

The DNS protocol works just like querying a specific domain name for its IP address. This is called “DNS Lookup”. Whenever you try to open a URL in your web browser, it will query the DNS records for the IP address of the domain name (with a DNS Lookup). These queries travel over port 53, using both UDP and TCP depending on the response.

Then, the DNS server tells your browser the IP address of the web server. And finally, the browser establishes a connection with the webserver using this IP and asks for the specific content of the file and path of the requested URL.

For example, imagine if there weren’t DNS Servers in the world. Every store would give you a business card with their IP address just like: “185.15.43.160”.

The four servers behind every DNS lookup

A DNS query isn’t answered by one machine — it passes through four, each with a different job. Understanding them makes every DNS problem easier to place.

The resolver is the starting point. It’s the server your device asks, usually run by your ISP or a public provider like Cloudflare (1.1.1.1) or Google (8.8.8.8). It doesn’t know the answer, but it knows how to find it — and it checks its own cache first, which is why most lookups never go further than this step.

The root nameservers sit at the top of the hierarchy. There are 13 root server addresses worldwide, operated by different organisations. They don’t know where any specific website is, but they know which server handles each extension — .com, .org, .br — and point the resolver there.

The TLD nameservers handle one top-level domain each. The .com servers know which nameservers are responsible for every .com domain registered, and pass that on.

The authoritative nameserver holds the actual records for the domain. This is where your hosting provider’s DNS lives, and it returns the final answer: the IP address.

Recursive and iterative: the query from your device to the resolver is recursive — you ask once and expect a complete answer. Everything after that is iterative — each server in the chain either answers or says who to ask next, and the resolver does the walking.

If you want to run one of these yourself, our guide on how to create a DNS server covers the setup — and why mixing the recursive and authoritative roles on one machine is dangerous.

DNS Record Types Explained

DNS records are instructions stored in DNS servers that tell the internet how to handle requests for your domain. Each record type serves a specific purpose. Here are the most common ones:

A Record (Address Record) The most basic DNS record. It maps a domain name to an IPv4 address. For example, it tells the browser that copahost.com points to 185.15.43.160. Every domain needs at least one A record to be accessible on the internet.

AAAA Record (IPv6 Address Record) Works exactly like the A record, but maps a domain to an IPv6 address instead. IPv6 addresses are longer and look like 2001:0db8:85a3:0000:0000:8a2e:0370:7334. As the internet transitions to IPv6, this record becomes increasingly important. For a full guide, see what an AAAA record is and how IPv6 DNS works.

CNAME Record (Canonical Name Record) Points one domain name to another domain name instead of an IP address. It is commonly used for subdomains. For example, www.copahost.com can be set as a CNAME pointing to copahost.com, so both addresses lead to the same site.

MX Record (Mail Exchange Record) Defines which mail servers are responsible for receiving emails for your domain. Without a properly configured MX record, emails sent to your domain will not be delivered. Most domains have more than one MX record, with priority values that determine which server is tried first.

TXT Record Stores arbitrary text information. It is widely used for domain verification, SPF, DKIM and DMARC records — all essential for email security. Worth knowing: these don’t all sit at the same hostname, which is why a TXT lookup on your domain often seems to be missing records. Our guide on DNS TXT lookups shows where each one lives and how to query it.

NS Record (Name Server Record) Indicates which DNS servers are authoritative for your domain — in other words, which servers hold the official DNS records for it. When you register a domain and point it to a hosting provider, you are updating the NS records.

PTR Record (Pointer Record) Works in the opposite direction of an A record: it maps an IP address back to a hostname, enabling what’s called a reverse DNS lookup. Unlike the records above, a PTR doesn’t live in your domain’s DNS — it belongs to whoever owns the IP block, which is why you won’t find it in your control panel. Mail servers rely on it to verify sender identity, so a missing PTR is a common cause of deliverability problems. See our full guide on reverse DNS lookup.

What is DNS Propagation?

DNS propagation is the time it takes for a DNS change to spread across all servers on the internet. When you update a DNS record, the change does not take effect instantly — it can take anywhere from a few hours to 48 hours for everyone worldwide to see the updated version.

We have a complete guide explaining how DNS propagation works and how to monitor it: What is DNS Propagation and how long does it take?

How to Check DNS Records

Checking DNS records is useful when troubleshooting email delivery issues, verifying domain configuration or confirming that a DNS change has propagated. There are several ways to do it:

Using an online tool

The easiest method is to use a web-based DNS lookup tool. Some reliable options are:

• MXToolbox — checks all record types with detailed output
• DNSChecker.org — shows propagation status from multiple locations worldwide
• whatsmydns.net — useful for checking if a DNS change has propagated globally

Simply enter your domain name, select the record type you want to check and run the lookup.

Using the command line

For more technical users, DNS records can be checked directly from the terminal:

On Linux or macOS:

dig copahost.com A
dig copahost.com MX
dig copahost.com TXT

On Windows (Command Prompt):

nslookup copahost.com
nslookup -type=MX copahost.com

These commands return the current DNS records directly from the authoritative name server, which is useful for verifying changes before they fully propagate.

What is DNS Cache?

DNS cache is a temporary storage of DNS lookup results kept by your browser, operating system or internet provider. Its purpose is to speed up browsing — instead of querying the DNS server every time you visit a website, your device reuses the result it already has stored locally.

Every cached record has a TTL (Time to Live) that determines how long it stays valid. Once the TTL expires, the cache is cleared and a fresh DNS lookup is performed.

Why does DNS cache matter? DNS cache is usually invisible and helpful. However, it can cause problems when DNS records change — for example, when migrating a website to a new server. Your device may keep loading the old IP address from cache even after the DNS has been updated globally.

How to clear DNS cache:

On Windows:

ipconfig /flushdns

On macOS:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

On Linux:

sudo systemd-resolve --flush-caches

On Google Chrome, you can also clear the browser DNS cache by visiting:

chrome://net-internals/#dns

DNS Security: What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a set of security protocols designed to protect the DNS system from attacks. It adds a layer of cryptographic verification to DNS responses, ensuring that the answer your browser receives actually comes from the legitimate authoritative DNS server — and has not been tampered with in transit.

Why is DNS security important? Without DNSSEC, DNS is vulnerable to a type of attack called DNS spoofing (or DNS cache poisoning), where a malicious actor injects fake DNS records into a resolver’s cache. This can redirect users from a legitimate website to a fraudulent one without them knowing — a technique commonly used in phishing attacks.

How does DNSSEC work? DNSSEC works by digitally signing DNS records using public-key cryptography. When a DNS resolver receives a response, it verifies the digital signature against a public key stored in the DNS. If the signature does not match, the response is rejected.

Should you enable DNSSEC for your domain? Yes, if your domain registrar and hosting provider support it. DNSSEC adds a meaningful layer of protection, especially for domains used for business email or e-commerce transactions where impersonation attacks are a real risk.

DNSSEC is not privacy

This distinction gets muddled constantly, and it matters. DNSSEC proves a DNS answer wasn’t tampered with. It does not encrypt anything.

Every DNS query you make travels in plain text by default, which means your internet provider — and anyone else on the path — can see every domain you look up, even on an HTTPS site. DNSSEC does nothing about that; it only guarantees the answer you got is authentic.

The privacy layer is separate, and it has two forms:

DNS over HTTPS (DoH) wraps your queries in ordinary HTTPS traffic on port 443, making them indistinguishable from normal browsing. Chrome, Firefox and Edge all support it, and Firefox enables it by default in several countries.

DNS over TLS (DoT) encrypts queries on a dedicated port, 853. It’s cleaner architecturally but easier for a network to block, precisely because the port identifies it.

In short: DNSSEC is about integrity — is this answer real? DoH and DoT are about confidentiality — who can see what I’m asking? They solve different problems and are often used together. Our guide on encrypted DNS covers how to enable each.

How to Change DNS Servers

Changing DNS servers can improve your internet speed, security or reliability. You may want to switch from your ISP’s default DNS to a faster public DNS server, or update your domain’s DNS to point to a new hosting provider.

For a full comparison of the best public DNS servers and step-by-step instructions to change your DNS on any device, see our dedicated guide: best DNS servers (and how to change yours).

Changing DNS servers for your domain (pointing to a new host)

This is done through your domain registrar’s control panel. The process updates your NS records to point to a different hosting provider:

1. Log in to your domain registrar account
2. Find your domain and access its DNS settings
3. Locate the Name Servers (NS) section
4. Replace the current name servers with the ones provided by your new hosting provider (e.g. ns1.copahost.com and ns2.copahost.com)
5. Save the changes and wait for DNS propagation (up to 48 hours)

Changing DNS servers on your computer or router

This changes which DNS server your device uses to resolve domain names — useful for improving speed or bypassing restrictions:

On Windows:

1. Go to Control Panel → Network and Internet → Network Connections
2. Right-click your connection and select Properties
3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties
4. Select Use the following DNS server addresses and enter your preferred DNS (e.g. Google’s 8.8.8.8 and 8.8.4.4)
5. Click OK to save

On macOS:

1. Go to System Settings → Network
2. Select your active connection and click Details
3. Go to the DNS tab
4. Click + to add a new DNS server address
5. Click OK and then Apply

Popular public DNS servers to consider:

What is a dynamic DNS server

Dynamic DNS (or DDNS) is a service that automatically updates your hostname with the current IP address of a server or a computer. This way, the dynamic DNS keeps on monitoring the IP addresses of your connection. Then, if the DDNS server detects any changes in your IP, then it automatically updates your DNS’s A (IPv4) or AAAA (IPv6) records.

This is useful for people who have an internet connection with a dynamic IP address (which changes every week, month or so..). By using a dynamic DNS server (or DDNS Server), you can have a permanent subdomain, always pointing to your current IP address. The dynamic DNS services stand for a system where the IP is often updated, where you use your subdomain whenever you need, and it will always point to your current IP… So, no matter if it changes!

There are some dynamic DNS services like No-ip.com and Dynu.com.

Frequently Asked Questions about DNS

What does DNS stand for?

DNS stands for Domain Name System, defined in RFC 1034 and RFC 1035 in 1987. It’s the system that translates human-readable domain names like copahost.com into the numerical IP addresses computers use to find each other, such as 185.15.43.160.

Does DNS stand for Domain Name System or Domain Name Server?

The formal name is Domain Name System — the whole distributed system. Domain Name Server refers to an individual machine running it. You’ll also see Domain Name Service in older documentation, which isn’t wrong but isn’t the formal term either. All three describe the same thing at different levels of scope.

Is DNS the same as an IP address?

No. An IP address is the actual numerical address of a server, such as 185.15.43.160. DNS is the system that translates domain names into those addresses. Think of DNS as the translator and the IP address as the destination.

Is DNS the same as a domain name?

No. A domain name is the human-readable address of a website, like copahost.com. DNS is the infrastructure that makes domain names work — the system that translates them into IP addresses so browsers can reach the right server.

How long does a DNS lookup take?

A cached lookup is under 1 millisecond, since the answer is already stored locally. A fresh lookup from a fast public resolver typically takes 8 to 20 ms. Most lookups never leave the resolver’s cache, which is why DNS is usually invisible.

What happens if DNS fails?

Your browser can’t translate domain names into IP addresses, so websites become unreachable even when the servers hosting them work perfectly. You’ll see errors like “DNS server not responding” or “This site can’t be reached”. Switching to a public resolver like Cloudflare (1.1.1.1) or Google (8.8.8.8) often resolves it.

What is the default DNS server?

By default your device uses the resolver provided by your internet provider, which varies by ISP and country. They work, but they’re often slower and less private than public alternatives like Cloudflare (1.1.1.1), Google (8.8.8.8) or Quad9 (9.9.9.9).

Can I use any DNS server I want?

Yes, on your device or on your router. Popular options include Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9), each with different strengths in speed, privacy and filtering. One exception: on a corporate network, the assigned resolver usually also resolves internal hostnames, so switching to a public one breaks access to intranet resources.

Does changing DNS make my internet faster?

It can make the first visit to each new site slightly faster, since DNS resolution is one of the first steps in loading a page. It won’t increase your bandwidth or speed up sites you already visited. If your ISP’s resolver answers in 150 ms and a public one answers in 15, the gain is real but measured in milliseconds — our guide on slow DNS lookups covers how to measure it.

Does DNSSEC protect my privacy?

No, and this is a common misunderstanding. DNSSEC verifies that a DNS answer wasn’t tampered with — it proves authenticity, not confidentiality. Your queries still travel in plain text, so your provider can see every domain you look up. Privacy requires DNS over HTTPS (DoH) or DNS over TLS (DoT), which are separate technologies and often used alongside DNSSEC.

How many DNS record types are there?

Dozens exist in the specifications, but seven cover almost everything in practice: A and AAAA for IP addresses, CNAME for aliases, MX for mail, TXT for verification and email authentication, NS for authoritative servers, and PTR for reverse lookups.

Why does a DNS change take up to 48 hours?

Because resolvers worldwide cache the previous answer for the duration of its TTL, and they won’t ask again until it expires. Lowering the TTL a day before a planned change shortens that window considerably. See our guide on DNS propagation.

What is a DNS resolver?

The server your device asks first — usually run by your ISP or a public provider. It doesn’t hold the answers, but it knows how to find them: it queries the root servers, then the TLD servers, then the domain’s authoritative nameserver. It also caches results, which is why most lookups are answered instantly.