🌐Developer

DNS Explained: What Actually Happens When You Type a URL

DNS is one of the most important parts of the internet and most people have no idea how it works. Here's the actual sequence of events.

6 min readFebruary 5, 2026By FreeToolKit TeamFree to read

You type 'freetoolkit.io' into a browser. Half a second later, a page loads. That half-second contains a surprisingly elaborate sequence of requests, databases, and infrastructure. Understanding it helps debug connection problems, understand how CDNs work, and make sense of why 'clearing your DNS cache' fixes certain issues.

Step 1: The Browser Cache

Your browser keeps a local DNS cache. If you visited freetoolkit.io recently and the TTL hasn't expired, it already knows the IP and skips the lookup entirely. This is why changing a DNS record doesn't immediately affect your machine — you might be using a cached answer.

Step 2: The Operating System

If the browser doesn't have the answer, the OS checks its own cache and the hosts file (/etc/hosts on Unix, C:\Windows\System32\drivers\etc\hosts on Windows). The hosts file lets you manually override DNS — useful for development (pointing a domain to localhost) or blocking specific sites.

Step 3: The Recursive Resolver

If neither cache has the answer, your OS sends a query to a recursive resolver — usually your ISP's DNS server, or a public one like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare). The resolver is the workhorse that does the actual lookup on your behalf.

Step 4: Walking the DNS Tree

The resolver starts at the root: 13 sets of root servers know who handles each TLD (.io, .com, .org). The root says 'for .io, ask this TLD nameserver.' The TLD server says 'for freetoolkit.io, ask this authoritative nameserver.' The authoritative nameserver finally answers with the actual IP address.

This takes milliseconds. The resolver caches the answer for the duration of the TTL, so subsequent requests are fast.

Why 1.1.1.1 Is Faster Than Your ISP

Cloudflare's 1.1.1.1 is typically faster than ISP resolvers because it has extensive infrastructure, caches aggressively, and was built specifically for DNS performance. It also doesn't log your queries for advertising purposes, unlike many ISP resolvers. Setting it as your DNS resolver (in your router or network settings) speeds up every domain lookup and adds a privacy layer.

Debugging tip

On Mac/Linux, 'dig freetoolkit.io' shows the full DNS resolution chain. 'nslookup freetoolkit.io' works on Windows. If you're troubleshooting why a site isn't loading, these show whether the DNS lookup itself is failing or if the problem is elsewhere.

Frequently Asked Questions

What is a DNS server?+
A DNS server is a database that translates domain names into IP addresses. When you type 'google.com', your computer doesn't know where that is — it asks a DNS server, which looks up the IP address (like 142.250.80.46) associated with that name. Your computer then connects to that IP address. DNS servers exist in a hierarchy, with root servers at the top maintaining records for every top-level domain.
Why does DNS change propagation take up to 48 hours?+
DNS records are cached. When you update a DNS record, old values are cached at various resolvers around the world and won't refresh until the TTL (Time to Live) expires. TTL is set by the domain owner — it could be 5 minutes or 24 hours. The '48 hours' estimate is conservative; with short TTL values, propagation can happen in minutes. Long TTLs (common for stability) extend propagation time.
What is a DNS leak?+
When you use a VPN, DNS queries should go through the VPN's DNS servers so your ISP can't see what sites you're visiting. A DNS leak happens when those queries bypass the VPN and go to your regular ISP's DNS server instead. Your ISP then knows your browsing pattern even though you thought you were private. DNSleaktest.com checks whether your VPN is leaking.
What's the difference between a domain and a URL?+
A domain is the name part: 'google.com' or 'freetoolkit.io'. A URL is the full address: 'https://freetoolkit.io/tools/json-formatter'. The URL includes the protocol (https), the domain, and the path (/tools/json-formatter). DNS only handles the domain-to-IP translation — once the browser knows the IP, it connects and sends the full URL path to the web server.

🔧 Free Tools Used in This Guide

FT

FreeToolKit Team

FreeToolKit Team

We build free browser-based tools and write practical guides that skip the fluff.

Tags:

developerdnsnetworkingweb