DNS (Domain Name System)

DNS is not hosting and not the domain itself. It is the set of instructions attached to a domain that says where each service lives: the website at one address, the email at another, a booking tool on a subdomain somewhere else. Those instructions are stored as records on the domain's nameservers, and changing a record is how you point a domain at a new host without changing the domain at all.

Because DNS sits in front of everything, it can fail on its own. If the provider running your DNS has an outage, your site is unreachable even though the server holding it is working perfectly. For that reason larger sites often choose a DNS provider with a strong reliability record, and keep a written copy of their records so they could rebuild the zone elsewhere if they ever had to.

How it works

When a browser needs a site, it asks a resolver, usually run by your internet provider or a public DNS service. The resolver works down the chain from the root servers to the servers for the ending (.com, .de) to the domain's own nameservers, which return the answer. The resolver then caches it for as long as the record's TTL (time to live) allows, so later visitors get a fast answer.

The common record types are A (an IPv4 address), AAAA (an IPv6 address), CNAME (an alias pointing to another name), MX (where email goes) and TXT (free text used for verification and email security such as SPF and DKIM).

Plain DNS answers are not signed, so a resolver cannot prove an answer really came from your nameservers. DNSSEC adds cryptographic signatures that let resolvers reject forged answers; it must be supported by your DNS provider, your registrar and your domain ending. A separate record type, CAA, lets you list which certificate authorities may issue certificates for your domain, which narrows one route for attackers.

Example

A restaurant moves its site to a new host. Instead of transferring the domain, the owner changes the A record to the new server's address and leaves the MX records alone. Over the following hours, resolvers around the world pick up the new address as their cached copies expire. The website moves; the email never stops.

Anyone can check DNS without logging in. A web-based DNS lookup tool, or a command such as nslookup on Windows and dig on Mac or Linux, shows the A, MX and TXT records the world currently sees. Comparing that output with what your host or email provider asked you to set is the fastest way to find a mistyped record.

Why it matters for your business

Most "the website is down" or "email stopped arriving" emergencies after a change trace back to one wrong DNS record. Knowing who can edit your DNS, and keeping a copy of the current records before anyone touches them, turns a frightening outage into a five-minute fix. DNS is also where you prove ownership to Google Search Console and add the email authentication records that keep your messages out of spam. None of this needs technical skill to check; it needs someone to know where the login is.

Common mistakes

• Deleting or overwriting MX records while changing website settings, which silently breaks email.
• Changing several records at once with no copy of the old values to restore.
• Leaving a long TTL in place right before a migration, so the switch takes longer to reach everyone.
• Keeping old records that point at servers or services you no longer use.

Questions people ask

How long does a DNS change take?

Often minutes, sometimes longer. Resolvers keep cached answers until the record's TTL expires, so a record with a long TTL can take hours to update everywhere, and changes to nameservers commonly take up to a day or two. Lowering the TTL a day before a planned change makes the switch faster.

What does DNS propagation mean?

Propagation is the period after a change while resolvers around the world still hold the old cached answer. Some visitors see the new server, others the old one, until every cache has expired. Nothing needs to be pushed; you simply wait for the TTL to run out.

Where do I edit my DNS records?

Wherever your nameservers point. That may be your domain registrar, your web host or a service such as a CDN. Check the nameservers listed for your domain, log into that provider, and you will find the DNS zone editor there.