DNS
- Pradeep P
- 4 days ago
- 4 min read
Layer 1 · Post 7 of 15
← Previous: API Gateways → Next: CDNs
Layer 1 — The building blocks · Post 7 of 88
DNS turns a name people can remember into an address machines can reach. It is also how traffic is steered across regions and failovers.
What you'll learn
What happens between typing a URL and opening a TCP connection
Records you actually use: A/AAAA, CNAME, NS, MX, TXT
Why TTL, caching, and DNS failover are slower and messier than they sound
The idea in one minute
Humans use names: www.example.com. Machines use addresses: 93.184.216.34 or an IPv6 equivalent.
DNS (Domain Name System) is the lookup: name → record.
It is a global, hierarchical, heavily cached database. That is why it is fast most of the time, and why changing it is never instant.
Why it matters
Every user request starts with where is this host? If DNS is wrong, slow, or points at a dead region, nothing else in your beautiful architecture matters.
DNS is also a control plane for traffic:
Point the name at a load balancer.
Point it at a CDN.
Answer different IPs in different parts of the world (latency-based routing).
Change the answer when a region fails (failover) — with caveats.
Treat DNS as part of the design, not as the intern sets this up later.
How it works
A simplified lookup for api.example.com:
The browser asks a resolver (often your ISP or 8.8.8.8 / 1.1.1.1).
If the resolver has a cached answer that is still within TTL, it returns it. Done.
Otherwise the resolver walks the hierarchy: root → .com nameservers → example.com nameservers → the record for api.
The answer (an IP, or a CNAME to another name) is cached for TTL seconds.
Records you will actually touch
A: Name → IPv4 address
AAAA: Name → IPv6 address
CNAME: Name is an alias of another name (www → lb.example.com)
NS: These servers are in charge of this zone
MX: Where email goes
TXT: Arbitrary text — SPF, DKIM, domain verification
Load balancers and CDNs often ask you to CNAME www to a hostname they own, so they can change IPs without your help.
TTL is a promise with slack
TTL of 60 means caches may keep this for about a minute. Some resolvers ignore very low TTLs or cache longer. Mobile networks and corporate DNS can be sticky.
So we will fail over in DNS means minutes, not milliseconds, and some users will keep the old IP until their cache expires. Fast failover is usually health checks inside a load balancer or anycast, with DNS as a coarse backup.
A simple example
You launch shop.example.com.
shop is a CNAME to a CDN or AWS ALB hostname.
The CDN/LB has A records that change as their edge IPs change.
TTL on your CNAME might be 300 seconds. You rarely need to touch it.
Region disaster: you flip shop from us-east-1-lb to eu-west-1-lb. Some customers switch in a minute. Others are still on the US IP for the rest of their TTL. If the US load balancer is dead, those users error until cache expires — unless the old name was anycast or the LB failed over internally without a DNS change.
That is why mature designs do not rely on DNS alone for the site must move now.
Common mistakes
TTL of 86400 and a failover runbook that says update DNS. You chose a one-day wait.
Apex CNAME problems. Some DNS hosts still cannot CNAME the root (example.com, not www). Use ALIAS/ANAME features the provider offers, or put the apex on A records you can update.
Using DNS as a load balancer with multiple A records and no health checks. Resolvers pick somewhat randomly. They will not reliably skip a dead IP.
Forgetting that DNS is cached everywhere. Your laptop flushed DNS. Your user's phone did not. Your health dashboard looks fine.
How this shows up in real systems
Route 53, Cloudflare DNS, NS1, Google Cloud DNS: programmable DNS with health checks and geo routing.
Service discovery (Layer 5): inside a cluster, you often use DNS too (orders.svc.cluster.local) or skip it for a proxy that already knows endpoints.
Certificate issuance: Let's Encrypt and others prove you own a name via DNS TXT or HTTP — DNS is part of HTTPS, not only routing.
When you draw users → site, the first hop after the user is often DNS, then the CDN or LB IP you returned.
Recap
DNS maps names to records, mostly IPs, with heavy caching.
TTL controls how fast the world notices a change — loosely.
Use DNS to aim traffic at an LB or CDN; use those systems for fast health-aware failover.
Once the name points at the edge, you often hit a CDN before you ever touch your origin servers.
Layer 1 · Post 7 of 15
← Previous: API Gateways → Next: CDNs
Comments