The Short Answer
DNS stands for Domain Name System. When you type a domain name into your browser, DNS converts that name into the numeric IP address of the server hosting the site. Without DNS, you'd need to memorize IP addresses like 104.21.43.56 to visit websites.
DNS is what makes the human-readable web possible. It's also one of the most overlooked factors in site speed, uptime, and security — especially for founders setting up their first infrastructure.
Why DNS matters for your business: Your DNS provider affects how fast your site resolves for visitors worldwide, whether attackers can hijack your domain, and how quickly you can recover if you move servers. A bad DNS setup can make a perfectly good server appear offline.
How DNS Works: Step by Step
When someone visits your site, DNS resolution happens in milliseconds across a chain of servers. Here's what actually happens:
-
Browser checks its local cache Your browser stores recent DNS lookups. If it has seen "mysevenstars.com" recently, it skips the rest and uses the cached IP. Most DNS records expire (TTL) in 5 minutes to 24 hours.
-
OS checks its resolver cache If the browser cache is cold, the operating system checks its own DNS cache and then asks your configured DNS resolver (usually your ISP's or a public resolver like 8.8.8.8).
-
Recursive resolver queries the root nameservers The resolver asks one of the 13 root nameserver clusters which server handles ".com" (or ".net", ".io", etc.) domains. The root server responds with the address of the TLD nameserver.
-
Resolver queries the TLD nameserver The TLD nameserver (run by Verisign for .com) doesn't know your site's IP, but it knows which authoritative nameserver is responsible for "mysevenstars.com" — typically your domain registrar or DNS provider (e.g., Cloudflare, Route 53).
-
Authoritative nameserver returns the IP Your DNS provider's authoritative server looks up the A record (or CNAME) for the requested domain and returns the IP address. This is the answer.
-
Browser connects to your server With the IP in hand, the browser opens a TCP connection to your web server, the TLS handshake happens, and your page begins to load. The full DNS resolution typically takes 20–120ms on a cold cache.
DNS Record Types You Actually Need to Know
Your DNS zone is a collection of records that tell the internet where to send different types of traffic. You'll encounter these most often:
| Record | What It Does | Example |
|---|---|---|
| A | Maps a domain/subdomain to an IPv4 address. The most common record. | @ → 104.21.43.56 |
| AAAA | Maps a domain/subdomain to an IPv6 address. | @ → 2606:4700::6812:2b38 |
| CNAME | Aliases one domain name to another. Used for subdomains pointing to services (e.g., a Vercel deployment or Shopify store). | shop → mystore.myshopify.com |
| MX | Specifies mail servers for your domain. Required to send/receive email at @yourdomain.com. | @ → aspmx.l.google.com (priority 1) |
| TXT | Stores text data. Used for domain verification, SPF email authentication, DKIM keys, and Google Search Console verification. | @ → "v=spf1 include:_spf.google.com ~all" |
| NS | Specifies which nameservers are authoritative for your domain. Set at your registrar; points to your DNS provider. | @ → ns1.cloudflare.com |
| SOA | Start of Authority — contains zone metadata. Usually managed automatically by your DNS provider. | Auto-generated |
What is TTL?
TTL (Time to Live) is how long DNS resolvers cache your records before re-querying your authoritative nameserver. It's set in seconds. A TTL of 300 means resolvers cache your record for 5 minutes.
Practical rule: Lower your TTL to 60–300 seconds a few hours before any DNS change (like moving servers). Once the change propagates and is confirmed, you can raise it back to 3600 (1 hour) or 86400 (24 hours) for better caching performance.
Authoritative DNS vs. Recursive DNS
These are two different roles in the DNS system that are frequently confused:
- Authoritative DNS is the server that actually holds your DNS records — the final source of truth. This is your DNS provider (Cloudflare, Route 53, your registrar). When you edit an A record in your dashboard, you're editing the authoritative DNS.
- Recursive DNS (Resolver) is the server that does the legwork of tracking down an answer on a user's behalf. Public resolvers like Cloudflare's 1.1.1.1 or Google's 8.8.8.8 are recursive resolvers. Your ISP runs one too. These cache answers to speed up repeat lookups.
As a site owner, you control your authoritative DNS. You don't control which recursive resolver visitors use, but you can encourage faster resolution by using a fast authoritative DNS provider with a global anycast network.
Domain Registrar vs. DNS Provider: Are They the Same?
Not necessarily — though they can be.
Your domain registrar (GoDaddy, Namecheap, Google Domains/Squarespace) is where you registered and pay for your domain. They're listed in ICANN's registry as the domain owner.
Your DNS provider runs the authoritative nameservers that answer DNS queries for your domain. By default, registrars point your NS records to their own nameservers — so they act as both registrar and DNS provider.
But you can (and often should) delegate DNS to a faster third-party provider like Cloudflare without moving your domain registration. You update your NS records at your registrar to point to Cloudflare's nameservers, and Cloudflare takes over answering DNS queries for your domain.
Recommendation: Keep your domain registration at a registrar you trust (Namecheap, Cloudflare Registrar, or Google Domains), and use Cloudflare's free plan for authoritative DNS. You get faster global resolution, DDoS protection, and a clean dashboard — for free.
Best DNS Providers in 2026
These are the providers worth considering depending on your scale and use case:
→ See the full DNS provider comparison with speed benchmarks
DNS Security: What You Need to Know
DNS is an attack surface. The three threats most relevant to small and mid-size sites:
DNS Hijacking
An attacker gains access to your registrar account and changes your NS records to point to nameservers they control. Visitors to your domain are then directed to a malicious server. Defense: use a registrar with 2FA and registrar lock (also called domain lock or transfer lock), which prevents unauthorized NS record changes.
DNS Cache Poisoning
An attacker corrupts a recursive resolver's cache with a forged record, redirecting visitors even though your authoritative DNS is intact. DNSSEC (DNS Security Extensions) protects against this by cryptographically signing your zone. Cloudflare makes enabling DNSSEC a one-click toggle.
DDoS Against Your Nameservers
If your nameservers go offline, your domain goes offline — even if your web server is fine. Anycast DNS providers like Cloudflare absorb volumetric attacks across their global network, making this attack impractical against their free tier.
DNS Propagation: Why Changes Take Time
When you change a DNS record, the update doesn't appear instantly worldwide. It has to propagate across all recursive resolvers, and existing caches have to expire based on TTL. This is called DNS propagation.
In practice: with a TTL of 3600 (1 hour), most of the world will see your new record within 1–2 hours. Some older ISP resolvers with aggressive caching can take up to 48 hours — which is where the commonly cited "up to 48 hours" figure comes from. With a TTL of 300 (5 minutes), propagation is essentially complete in under an hour.
Pro tip: Use dnschecker.org or whatsmydns.net to see your DNS records as seen from nameservers around the world in real time.
DNS and Site Speed
DNS lookup time is included in every page load. For a cold cache (first-ever visit or TTL expired), the DNS lookup typically adds 20–150ms before the browser can even open a TCP connection to your server.
Factors that improve DNS performance:
- Anycast routing: Your DNS query goes to the nearest point of presence in the DNS provider's global network. Cloudflare has 300+ PoPs; a registrar's DNS might have 3.
- Low SOA TTLs for negative caching: Reduce the time a "not found" response is cached if you're migrating records.
- Minimizing DNS lookups per page: Each third-party resource (fonts, analytics, ad scripts) from a different domain triggers a DNS lookup. Hosting fonts locally, using a single CDN domain, and lazy-loading third-party scripts all reduce lookup overhead.
- DNS prefetching: Add
<link rel="dns-prefetch" href="//cdn.yourdomain.com">in your HTML head to kick off DNS lookups for known third-party domains before the browser needs them.
Explore the DNS & Hosting Cluster
These guides go deeper on the topics founders ask about most:
The Bottom Line
DNS is invisible when it works and catastrophic when it doesn't. As a founder running a web business, the two things worth doing right now:
- Move your DNS to Cloudflare if you haven't already. It's free, faster, and gives you DDoS protection and DNSSEC in two clicks.
- Enable domain lock and 2FA at your registrar. DNS hijacking via compromised registrar accounts is one of the most common ways legitimate sites get taken over.
Everything else — record types, TTLs, propagation — you'll learn as you need it. The guides below have you covered when you get there.