DNS: The Invisible System Behind Every Click

The 30-second explanation

Think of DNS as the internet's phonebook. Type google.com, and DNS looks up the address behind that name.

How it works

1. 1

   1. You type a name

   Your browser asks: where does example.com actually live?

2. 2

   2. Resolver checks

   It checks its own cache first, then asks other servers if it doesn't already know.

3. 3

   3. Authoritative answer

   The domain's official name server hands back the current address.

4. 4

   4. You connect

   Your browser connects straight to that address.

Computers address each other with numbers, but people remember words far better than strings of digits. DNS is the translation layer in between. Type a website's name and your device asks a DNS server where that name lives; within a fraction of a second it gets an answer and connects. Because nearly everything online starts with a DNS lookup, it's also one of the most useful places for a defender to watch — a domain nobody on the network has ever asked for before is often the earliest sign something is wrong.

Real-world example

How to spot it

• A name that looks almost right

  Lookalike domains swap a letter or add a word to a trusted name.

• A brand-new domain

  Domains registered within the last day or two show up disproportionately in scams.

• Unusually long subdomains

  A long, random-looking prefix in front of a familiar name can signal hidden traffic.

• A padlock that means less than it looks

  A secure connection only proves the traffic is encrypted, not that the site is trustworthy.

What to do

1. 1Type addresses you trust directly rather than following a link, especially for anything sensitive.
2. 2Check a domain letter by letter before entering a password on it; a swapped character is easy to miss.
3. 3If a device asks for a domain nobody recognises, treat that as worth investigating, not ignoring.