KiwiVPN
Privacy & networking · 3 min

DNS Explained in Plain Language

Learn how DNS turns domain names into IP addresses, what A, AAAA, CNAME, MX, and TXT records do, and how to troubleshoot common DNS problems.

The Domain Name System (DNS) is the internet’s distributed naming system. People use names such as example.com; computers use network addresses to route connections. DNS helps connect the two. It is not one central list: different servers manage different parts of the name hierarchy, and answers are cached to make repeat visits faster.

How a DNS lookup works

When you visit a domain, your device usually asks a recursive resolver for the answer. If it already has a valid cached record, it can respond quickly. Otherwise, the resolver follows referrals through the DNS hierarchy until it reaches a server responsible for the domain. That authoritative server provides the record, and the resolver caches it for the record’s time to live (TTL).

Most users do not need to perform each step manually. Your browser, operating system, router, ISP, or a configured DNS provider may each have a cache or role in the process.

Common DNS record types

  • A: maps a name to an IPv4 address.
  • AAAA: maps a name to an IPv6 address.
  • CNAME: makes one name an alias of another name.
  • MX: identifies mail servers responsible for receiving email for a domain.
  • TXT: stores text values used for domain verification and email-security policies, among other purposes.
  • NS: identifies authoritative name servers for a DNS zone.

A website may depend on multiple records. Email can fail even when the website works because web hosting and mail routing use different DNS records.

Why DNS changes seem slow

Every record has a TTL that influences how long resolvers may cache it. If you change a record, some users can continue to receive the old answer until caches expire. Lowering the TTL before a planned migration may reduce the waiting period, but lowering it at the last minute cannot instantly erase answers already cached by resolvers with longer TTLs.

DNS and privacy

Traditional DNS queries are not encrypted between every point on the path, so the local network or resolver may be able to observe them. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the connection to a chosen resolver. They do not make you anonymous, and they move trust to the resolver that handles the queries. The destination website may still learn the IP address that connects to it.

Troubleshoot a DNS problem

  1. Check whether the problem affects one website or many.
  2. Try another network or device to separate local problems from a wider outage.
  3. Confirm that the domain’s A and AAAA records point to the intended service.
  4. If you manage the domain, verify the authoritative name servers and TTL before changing records.
  5. Clear a local DNS cache only when you understand the effect; it will not fix an incorrect authoritative record.

Common questions

Is DNS the same as a search engine?

No. A search engine helps find content; DNS maps domain names to records used by network services.

Does changing DNS change my public IP?

Usually not. It changes which resolver answers your domain queries, not the address assigned to your connection.

Can a VPN change which DNS resolver I use?

It can, depending on its configuration. Check the VPN’s documentation and test the actual DNS path if that distinction matters.

Read DNS leaks, What a VPN changes, and IPv4 vs. IPv6.

Further reading

Browse all KiwiVPN guides or return to the public IP checker.