What Is DNS and How Does It Work? DNS Records Explained

Published October 24, 2026 · Last updated October 24, 2026 · By the WebSolutions LLC team

DNS is the part of the internet that turns a name like example.com into the address of the server that answers for it. It runs quietly in the background, so most business owners only meet it when they launch a site, move to a new host or set up email, and suddenly need to edit "records" in a control panel. This guide explains what DNS is, how a lookup works step by step, which DNS records a business website and email actually need, why changes take time to show, and how to keep your DNS secure.

What is DNS?

DNS stands for Domain Name System. Computers find each other on the internet by numeric IP addresses, but people remember names. DNS is the distributed directory that translates domain names into IP addresses and other information, so that when someone types your domain, their device knows where to connect (MDN: DNS). The system was defined by the IETF in RFC 1034 and RFC 1035, which still describe how names, zones and records work today (RFC 1034, RFC 1035).

It helps to separate three things that are often bought from the same company but are not the same:

• The domain registration, held with a registrar. Our guide on how to choose a domain name covers registering it in your business's name.
• The DNS hosting, which is wherever your domain's nameservers point. This is where the records live.
• The web hosting, the server that stores and serves your website. See our types of web hosting guide.

How DNS works, step by step

When a visitor types www.example.com into a browser for the first time, a lookup happens in a fraction of a second:

1. Local check. The device looks in its own cache. If it already knows the answer, it uses it.
2. Recursive resolver. If not, the device asks a recursive resolver, usually run by the internet provider, the company network or a public DNS service.
3. Root servers. If the resolver has no cached answer, it asks a root server where to find the .com servers. The root zone lists 13 named root server authorities, each served by many machines around the world (IANA: root servers). As of 24 October 2026, root-servers.org reports more than 2,000 operational instances run by 12 independent operators (root-servers.org).
4. TLD servers. The .com servers reply with the nameservers responsible for example.com.
5. Authoritative nameserver. The resolver asks your DNS host's nameserver, which holds your records and returns the answer, for example the IP address of your web server.
6. Caching. The resolver passes the answer to the device and keeps a copy for as long as the record's TTL (time to live) allows, so the next visitor gets a faster reply.

The browser then connects to that IP address and, for an HTTPS site, checks the server's certificate. Our guide what is an SSL certificate explains that next step.

DNS records explained

A DNS zone is a list of records. Each record has a name (such as www), a type, a value and a TTL. These are the types most business sites use:

A record vs CNAME

An A record points directly at an IP address. A CNAME points at another name, and the resolver then looks up that name. RFC 1034 says that if a CNAME is present at a name, no other data should be present there (RFC 1034). Because the bare domain (example.com) must also hold NS and SOA records, a standard CNAME cannot be used at the root of the domain. That is why the bare domain normally uses an A record, while www and other subdomains can use a CNAME. Some DNS providers offer their own "ALIAS", "ANAME" or "flattening" feature to get CNAME-like behaviour at the root; these are provider features, not a standard record type, so check your provider's documentation.

DNS records for business email

Email depends on DNS as much as the website does. MX records tell other mail servers where to deliver your email, and three TXT-based standards help receiving servers decide whether a message claiming to be from your domain is genuine:

• SPF lists the servers allowed to send email for your domain (RFC 7208).
• DKIM adds a cryptographic signature to outgoing messages, with the public key published in DNS (RFC 6376).
• DMARC tells receivers what to do when SPF or DKIM checks fail and where to send reports (RFC 7489).

These records are no longer optional extras. Google's email sender guidelines require everyone who sends to Gmail accounts to set up SPF or DKIM, and require senders of more than 5,000 messages a day to set up SPF, DKIM and DMARC (Google: email sender guidelines). Your email provider gives you the exact values to add.

TTL and "DNS propagation"

People often say DNS changes need time to "propagate". What actually happens is caching: resolvers around the world keep the old answer until its TTL runs out, then fetch the new one. A record with a TTL of a few minutes changes quickly; one with a TTL of a day can keep sending some visitors to the old server for up to a day. If you plan to move a site, lower the TTL well before the move, make the change, then raise it again afterwards. Our website migration checklist includes this step.

Keeping your DNS secure

Whoever controls your DNS controls where your website and email go, so treat the DNS and registrar accounts like your bank login:

• Use strong, unique passwords and multi-factor authentication on the registrar and DNS host accounts.
• Turn on registrar lock so the domain cannot be transferred without your approval.
• Keep the account in your business's name, with a contact email you check.
• Consider DNSSEC, which adds digital signatures to DNS data so resolvers can detect forged answers (ICANN: DNSSEC). It must be supported by both your registrar and your DNS host.
• Remove records for services you no longer use. A forgotten subdomain that still points at a cancelled service can sometimes be taken over by someone else.

Our small business website security checklist covers the domain and email protections alongside the website itself.

How to check your DNS records

• Your DNS host's control panel shows the records it is serving. Check which nameservers your registrar lists first, so you know you are editing the right zone.
• On Windows, macOS or Linux, the nslookup command shows what a resolver returns, for example nslookup -type=mx example.com. On macOS and Linux, dig gives more detail.
• ICANN's lookup tool shows a domain's registration data, including its registrar and nameservers (ICANN Lookup).

Common DNS mistakes

• Editing records at the registrar when the nameservers point to a different DNS host, so the changes never take effect.
• Deleting MX or TXT records when moving the website, which breaks email.
• Creating two SPF records instead of one combined record.
• Forgetting the www name, so one version of the address works and the other does not.
• Changing nameservers without first copying every existing record to the new DNS host.

If you are moving hosts, launching a new site or setting up business email and want someone to check your DNS first, see our hosting and domain services or get in touch.