Cybersecurity glossary
What is the Domain Name System (DNS)?
Learn what the Domain Name System (DNS) is, how recursive and authoritative servers resolve names to addresses, which record types matter, and how security controls protect resolution integrity.
Definition
The Domain Name System (DNS) is the Internet’s distributed naming system that translates human-readable domain names into data such as IP addresses, mail routers, and service locations so applications can connect to the correct hosts.
Why DNS matters
People remember names. Computers connect with numbers and service data. The Domain Name System (DNS) bridges that gap for nearly every Internet activity: loading websites, sending email, discovering APIs, validating certificates, and finding software updates.
When DNS works, it is invisible. When it fails or is attacked, healthy applications look offline, users are redirected, and security controls that depend on names break. That is why DNS is both critical infrastructure and a security control plane.
How DNS resolution works
A typical lookup walks from a stub resolver on a device through a recursive resolver to authoritative servers that hold the official answers.
Application asks a question
A browser or service requests data for a name, such as the A/AAAA records for www.example.com.
Stub resolver queries recursively
The device usually asks a configured recursive resolver rather than walking the tree itself.
Recursive resolver finds authority
Starting from root hints, it follows NS delegations to the TLD and then the domain’s authoritative servers.
Authoritative server answers
The zone’s name servers return signed or unsigned resource records for the queried name.
Caches speed future lookups
Resolvers cache answers according to TTL, reducing latency and load.
Client connects using the data
The application uses returned addresses or records to communicate with the target service.
Important DNS building blocks
Domain names and labels
Names are hierarchical labels read right to left: host, domain, top-level domain, and the implied root.
Resource records
Typed data objects—A, AAAA, MX, TXT, CNAME, NS, SRV, and more—publish different facts about a name.
Zones and delegation
Organizations run zones and delegate subtrees with NS records to other name servers.
TTL
Time-to-live values control how long resolvers may reuse cached answers before refreshing.
Recursive vs authoritative DNS
| Role | Responsibility | Security focus |
|---|---|---|
| Recursive resolver | Find and cache answers for clients | Poisoning resistance, validation, privacy, abuse controls |
| Authoritative server | Publish official zone data | Access control, DNSSEC signing, integrity of changes |
| Registrar / registry | Domain registration and parent delegation | Account security, locks, transfer protections |
Security essentials for DNS
DNS integrity and availability deserve the same attention as identity systems.
- Protect registrar and DNS hosting accounts with phishing-resistant MFA and change monitoring.
- Deploy DNSSEC for critical zones and enable validation on enterprise resolvers.
- Use resilient authoritative architecture (anycast, secondary providers) for availability.
- Inventory domains and records; remove stale entries that enable subdomain takeover.
- Restrict who can modify NS, DS, MX, and security-sensitive TXT records.
- Monitor resolution from multiple vantage points for unexpected address changes.
- Block or tightly control open resolvers and direct outbound DNS where policy requires.
- Treat DNS logs as security telemetry for tunneling, malware, and beaconing detection.
DNS and everyday products
Email authenticity frameworks (SPF, DKIM, DMARC) live in DNS. Certificate issuance often proves domain control through DNS records. Zero-trust and SaaS onboarding frequently require TXT verification. Product launches depend on low TTLs and careful cutovers. In every case, DNS mistakes become customer-facing incidents.
The practical takeaway
The Domain Name System (DNS) is the Internet’s distributed directory for names. Recursive resolvers discover answers; authoritative servers publish them; applications trust the result to find services.
Operate DNS as critical infrastructure: authenticate data with DNSSEC, protect control planes, design for outages, and monitor changes. If the name is wrong, every security control above it starts from a false premise.
Related security terms
DNSSEC (Domain Name System Security Extensions)
Cryptographic authenticity extensions that protect DNS answers from forgery.
Anycast DNS
A resilient deployment pattern that advertises DNS service from many locations.
DNS Spoofing / Cache Poisoning
Attacks that inject false DNS answers into resolvers or clients.
Top-Level Domain (TLD)
The rightmost DNS label such as .com or .org in a domain name.
Subdomain
A DNS name under a parent domain used to organize services and hosts.
Frequently asked questions
What is DNS in simple terms?
DNS is the Internet’s phone book for names. When you type a website name, DNS helps find the IP address your device should contact.
What is the difference between a recursive resolver and an authoritative server?
A recursive resolver finds answers on behalf of clients, often caching results. An authoritative server publishes the official data for a zone it controls.
What are common DNS record types?
A and AAAA map names to IPv4/IPv6 addresses. MX routes mail. CNAME aliases names. TXT carries text such as verification tokens. NS delegates zones to name servers.
Why is DNS a security concern?
If resolution is wrong, users and systems connect to the wrong place. Spoofing, hijacking, tunneling, and insecure DNS control planes are major risk areas.
Does DNS encrypt queries by default?
Traditional DNS is unencrypted. DNS over TLS or HTTPS can add confidentiality to the resolver path, while DNSSEC authenticates data rather than encrypting queries.
What is a DNS zone?
A zone is an administrative slice of the DNS namespace for which an organization is authoritative, such as example.com and selected subdomains.
Who operates DNS?
Many parties: root and TLD operators, registrars, authoritative DNS providers, recursive resolver operators (ISPs/public DNS), and every organization that publishes records.
References
Explore authoritative guidance and frameworks related to domain name system (dns).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.