dns.jelia.nyc

Names into numbers, all the way down

Every time you open a website, send an email or tap an app, your device first asks a question: what is the address behind this name? The Domain Name System answers it billions of times a day, through a tree of servers that no single company runs, in a few milliseconds, usually from a cache you never knew was there.

This site goes past the basics. It takes a DNS message apart byte by byte, follows one question from the root down, shows how caches and TTLs decide what you see, how zones are run and signed, how mail and CDNs lean on DNS, how attackers abuse it and how defenders stop them. If you are new to DNS, start with the DHCP & DNS chapter on networks.jelia.nyc, then come back here.

13root server identities, a.root-servers.net to m.root-servers.net, each one answered by many anycast machines around the world
1987RFC 1034 and RFC 1035, the two documents that still define how DNS works
63 / 255bytes: the longest a single label and a whole name may be on the wire
How it works
WatchEach chapter opens with a short narrated walkthrough. Press play.
PlayLive instruments: a resolver you can step through, a packet you can decode bit by bit, a cache whose clock you can run, a chain of trust you can break.
ReadPlain-English sections, with "go deeper" panels for the RFC detail when you want it.
Start here · chapter 01The namespace & delegation One upside-down tree for the whole internet, and who is allowed to answer for which branch.
The core · chapter 03Follow one question all the way down Step a recursive resolver through referrals, glue and CNAME chains yourself.
Trust · chapter 11DNSSEC & the chain of trust How a signature made at the root vouches for an answer three levels down, and what happens when one link breaks.
In the field · chapter 14Debugging DNS with dig Read real answers line by line and tell NXDOMAIN, NODATA and SERVFAIL apart.
Contents

Fourteen chapters, a history and a glossary