DNS (Domain Name System)

DNS (Domain Name System) is the hierarchical, distributed naming service that translates human-readable domain names like example.com into the numerical IP addresses machines actually connect to. It operates primarily on port 53, using UDP for ordinary lookups and TCP for larger responses and zone transfers. Without DNS, every connection would require memorizing raw addresses; with it, names become portable — the address behind a name can change while the name stays constant. For anyone self-hosting a node, dashboard, or personal services, DNS is the layer that decides whether the outside world can find you by name.

Record types

DNS zones hold typed records. An A record maps a name to an IPv4 address; an AAAA record maps it to IPv6. A CNAME aliases one name to another, so many names can follow a single canonical target. MX records direct a domain's email to its mail servers, and TXT records carry arbitrary text — the workhorse for domain-ownership verification and email authentication (SPF, DKIM, DMARC). Every record carries a TTL (time to live) that tells caches how long to keep it; low TTLs make changes propagate fast at the cost of more queries, a knob that matters when your home IP changes.

Resolvers and authoritative servers

Two very different roles share the name "DNS server." A recursive resolver — typically run by your ISP or a public provider — does the legwork on your behalf: starting from the root servers, it walks the hierarchy (root, then the top-level domain's servers, then the domain's own) until it obtains an answer, then caches it for the TTL. An authoritative nameserver holds the definitive records for a zone and answers from its own data. When you point a domain at your home node, you edit records at the authoritative level; resolvers worldwide pick up the change as their caches expire. Home connections whose public address changes frequently pair this with Dynamic DNS, which automates the record update whenever the IP moves, and often put a reverse proxy behind the name to route many services through one entry point.

Sovereignty considerations

DNS was designed in a trusting era, and it leaks. Plaintext queries reveal every service you contact to whoever operates or observes your resolver — a complete browsing-and-services log by default. Privacy-minded operators respond by running their own recursive resolver, using encrypted transports (DNS over TLS or HTTPS) to a resolver they trust, or both. DNS is also a censorship point: blocking a name is far easier than blocking an address, which is why resilient architectures avoid depending on a single name or provider. Tor's onion services sidestep the system entirely — the cryptographic address is the identity, with no registry to seize. Bitcoin itself treats DNS as a convenience, not a dependency: nodes bootstrap from DNS seeds but thereafter rely on their own peer database.

Practical first steps

Caching explains most of what confuses newcomers about DNS "propagation." There is no broadcast that pushes your change to the world; resolvers simply keep serving their cached answer until its TTL expires, so a record edited with a day-long TTL looks inconsistent for up to a day depending on who asks. The professional cutover pattern follows directly: lower the TTL to a few minutes well ahead of a planned change, make the change, confirm, then restore a longer TTL to keep query load sane. Testing against the authoritative server directly — rather than your own resolver's cache — tells you whether the change itself landed.

Owning a personal domain that points at infrastructure you run is one of the cheapest, most instructive moves in self-hosting: it teaches records, TTLs, and propagation with real stakes but low risk. DNS names ride on the addressing and transport described in TCP/IP — resolve the name, then connect to the address; two systems, cleanly separated, and both worth understanding.