APPLICATION LAYER · NAME RESOLUTION

Follow a name until it becomes an address.

DNS is not one central table. Observe cache, delegation and a chain of questions from an application through a recursive resolver to root, TLD and authoritative name servers.

ITERATIVE RESOLUTION SIMULATOR

Who knows the answer—and who only knows where to ask next?

No real DNS query leaves this page. The simulation isolates protocol behavior and failure semantics.

Domain nameRecord typeScenarioTTL (s)

Applicationstub resolverlab.warin.me?

Recursive resolvercache + recursion192.0.2.53

Rootdelegates .me.

.me TLDdelegates warin.meme.

Authoritativeowns the zonewarin.me.

READY · Choose a scenario and start the lookup.

IDLENo query has been sent.

DNS messages0

Simulated latency0 ms

Remaining TTL—

QUERY ANATOMY

One question, structured evidence

Header

ID, flags, question/answer/authority/additional counts

Question

QNAME + QTYPE + QCLASS

Resource record

NAME TTL TYPE RDATA

Response code

NOERROR · NXDOMAIN · SERVFAIL

Recursive is not iterative. The client asks the recursive resolver to finish the job. The resolver then follows referrals iteratively and returns one final response.

CACHE · TTL · NEGATIVE ANSWERS

Fast answers come from remembering—with an expiry date

Positive cache

Stores an RRset until TTL reaches zero; it avoids repeating the hierarchy.

Negative cache

NXDOMAIN can be cached using the zone SOA policy. “Not found” is still useful evidence.

Propagation

A record change does not push itself everywhere. Old cached answers disappear when their TTL expires.

TRANSPORT AND PRIVACY

UDP, TCP, DoT and DoH

Mode	Transport	What changes
Classic DNS	UDP/53; TCP when needed	Usually visible to the network; low overhead.
DoT	TLS over TCP/853	Encrypts the DNS channel to a resolver.
DoH	HTTPS/443	Carries DNS messages inside HTTP semantics.

CLASSROOM TASKS

Investigate rather than memorize

Compare cold and warm cache message counts.
Explain why CNAME cannot coexist with other data at the same owner name.
Distinguish NXDOMAIN, NODATA, SERVFAIL and timeout.
Observe a TTL countdown and predict when a changed address appears.
Trace an MX answer and its additional address records.
Explain what DoH hides and what the resolver still learns.