DNS — turning a name into an address

Routers only understand IP addresses, not names — example.com means nothing to any router along the path. DNS (Domain Name System) is the lookup that turns a human-readable name into the IP address routing actually needs, and it's the very first thing that happens before any HTTP request can even be attempted.

No single server holds every domain's IP address. Instead, DNS is a hierarchy, and answering api.example.com means asking increasingly specific servers:

In practice this whole chain usually takes single-digit milliseconds and is invisible — but it's a real network round trip (or several) before your actual request can even begin, which is exactly why caching (next section) matters so much for perceived speed.

Every DNS record has a TTL (time to live) — how long a resolver is allowed to cache the answer before asking again. A record with TTL 3600 can be cached for up to an hour; anyone who looked it up 5 minutes ago will keep using the old answer for up to 55 more minutes, even after you change it.

This is why "I updated my DNS but nothing changed" is almost always just caching, not a mistake — and why a real migration plan lowers the TTL in advance (hours or a day before the actual cutover) so the old, short TTL is already what's cached everywhere by the time you flip the record, letting the change actually propagate quickly instead of waiting out the old long TTL.

A slow or repeatedly-uncached DNS lookup adds real, visible latency before a request can even start — this is why browsers, operating systems, and public resolvers like Cloudflare's 1.1.1.1 all cache aggressively, and why some sites intentionally use very short-lived subdomains sparingly (each first lookup costs a fresh round trip).

nslookup/dig timing something like this reveals it directly:

Because everything starts with DNS, it's also a single point of failure and a target: DNS spoofing/cache poisoning attacks try to trick a resolver into caching a wrong (attacker-controlled) IP for a real domain — the reason HTTPS (covered later in this domain) matters even when DNS itself is compromised, since a spoofed IP still can't produce a valid certificate for the real domain. On the reliability side, a DNS provider outage (these happen to major providers a few times a year) can take down sites that are otherwise perfectly healthy — their servers are fine, but nobody can find their address anymore.