Query any record type yourself on /dns-lookup, and check which resolver your traffic actually reaches on /dns-leak-test.
One lookup, step by step
The protocol is defined by RFC 1034 and RFC 1035 from 1987. The current vocabulary is collected in RFC 9499.
Suppose nothing is cached anywhere and your browser needs www.example.com:
- Your device asks its configured resolver. That address came from DHCP, from a VPN, or from your own settings.
- The resolver asks a root server. There are 13 root server identities, operated by 12 organisations and served from more than a thousand anycast instances. The root does not know the answer. It replies with the servers for
.com. - The resolver asks a
.comserver. Verisign operates those. They reply with the authoritative name servers forexample.com. - The resolver asks the authoritative server. It returns the A and AAAA records.
- The resolver caches the answer for its TTL and returns it to you.
That is four round trips for a cold lookup and zero for a warm one. In practice the first two steps are cached almost permanently, so a real lookup is usually one query to the authoritative server, or none.
The record types you will meet
| Type | Holds | Example value |
|---|---|---|
| A | An IPv4 address | 203.0.113.10 |
| AAAA | An IPv6 address | 2001:db8::10 |
| CNAME | An alias to another name | www to example.com |
| MX | Mail servers, with a priority | 10 mail.example.com |
| TXT | Free text, used for SPF, DKIM, and domain verification | v=spf1 include:_spf.example.com -all |
| NS | The authoritative servers for the zone | ns1.example.com |
| SOA | Zone metadata: serial, refresh, and negative caching TTL | one per zone |
| PTR | The name for an address, used in reverse DNS | 203.0.113.42 to host.example.com |
| CAA | Which certificate authorities may issue for the domain | 0 issue "letsencrypt.org" |
| SRV | The host and port for a named service | _sip._tcp |
| HTTPS | Connection parameters, including HTTP/3 and IP hints | used by modern browsers |
A CNAME cannot coexist with other records at the same name, which is why the apex of a domain usually needs an A record or a provider-specific alias type rather than a CNAME.
TTL, and why a change does not take effect immediately
Every record carries a time to live in seconds. A resolver may serve the cached answer until the TTL expires, and it is not obliged to check with you before then.
| TTL | Reasonable use |
|---|---|
| 60 to 300 | An address that changes, such as a dynamic DNS host or a failover target |
| 3600 | A general default for records you might edit |
| 86400 | Stable records: NS, MX, a domain verification TXT |
The practical procedure for a planned migration is to lower the TTL to 300 at least one full old-TTL period before the change, make the change, watch traffic move, then raise the TTL again. “DNS propagation” is not a push. It is the old cache entries expiring at different times.
Negative answers are cached too, using the last field of the SOA record. If you query a name before you create it, the not-found answer sticks for that duration.
Which resolver you use, and what it sees
Your resolver sees every hostname you look up, in order, with timestamps. That is a meaningful record even though it does not include the page contents.
| Resolver | Addresses | Notes |
|---|---|---|
| Your ISP | From DHCP | Closest, often best for CDN routing. Logs vary by ISP and jurisdiction |
| Cloudflare | 1.1.1.1, 2606:4700:4700::1111 |
Published privacy policy, audited retention |
8.8.8.8, 2001:4860:4860::8888 |
Large cache, wide anycast footprint | |
| Quad9 | 9.9.9.9, 2620:fe::fe |
Blocks known malicious domains |
Switching resolvers changes who holds that record. It does not change your IP address, and it does not encrypt anything on its own.
Encrypted DNS: DoH, DoT, and DoQ
Classic DNS runs in cleartext on UDP port 53, so anyone on the path can read the names you request and can forge a reply.
- DNS over TLS, RFC 7858, wraps queries in TLS on port 853. It is easy for a network operator to see and block as a category, because the port is distinct.
- DNS over HTTPS, RFC 8484, sends queries as HTTPS requests on port 443, indistinguishable from other web traffic.
- DNS over QUIC, RFC 9250, does the same over QUIC, with lower connection setup cost.
Firefox, Chrome, and Edge can run DoH inside the browser, independently of the operating system. That is worth knowing when you debug: the browser may be using a different resolver from ping, and a leak test that runs in the browser measures the browser’s path.
Encryption hides the query from the network. It does not hide it from the resolver you chose, and DNSSEC is a separate mechanism that signs answers for authenticity without hiding anything.
Checking your own setup
Query a specific record and a specific server:
dig AAAA example.com
dig @1.1.1.1 MX example.com
dig +trace example.com
+trace performs the walk from the root yourself, one step at a time, which is the fastest way to see where a broken delegation sits. On Windows, nslookup -type=MX example.com covers the basic case, and Resolve-DnsName in PowerShell covers the rest.
To see which resolver actually answers for you, rather than which one is configured, run /dns-leak-test. How DNS leak tests work explains the method, which matters when you are checking whether a VPN carries your DNS traffic as well as your packets.
Questions people ask
- What is the difference between a recursive resolver and an authoritative server?
- A recursive resolver takes your question and does the work of finding the answer, then caches it. An authoritative server holds the actual records for a zone and answers only for that zone. Your ISP and 8.8.8.8 run resolvers; the domain owner's provider runs the authoritative servers.
- Does changing my DNS server change my IP address?
- No. The resolver only answers name questions. Your public IP address comes from your ISP and is unaffected.
- Is a public resolver faster than my ISP's?
- Sometimes, and it depends on where you are. A large anycast resolver has a bigger cache, while your ISP's is physically closer and often better placed to return a nearby CDN answer. Measure before switching.
- Why do DNS changes take time to appear?
- Resolvers cache each answer for its TTL. Until that expires, they serve the old value. Lower the TTL a day before a planned change, then raise it afterwards.
Related
Last reviewed 2026-09-04. Reviewed quarterly, or sooner when a vendor changes something.