DNS stands for Domain Name System. It translates human-friendly domain names into the IP addresses that computers use to communicate. Without DNS, you'd need to memorize a number like 142.250.72.14 just to visit Google.
Simple definition: DNS is the internet's phonebook.
How Does DNS Work? (Step-by-Step)
This entire process typically happens in milliseconds:
google.com into your browser"What is the IP for google.com?"142.250.72.14What Is a DNS Server?
A DNS server is a system that stores and provides domain name → IP address mappings. Most home routers automatically assign a DNS server via DHCP. Common public DNS servers you'll see on the A+ exam:
Common DNS Problems (A+ Exam Clues)
DNS failures produce a specific, recognizable pattern — websites fail even though the connection itself works:
If you can ping 8.8.8.8 but NOT google.com — it's a DNS problem.
The internet connection itself works (you can reach an IP), but name resolution is broken. This specific scenario appears frequently in A+ troubleshooting questions.
How to Troubleshoot DNS Issues
ipconfig /flushdns8.8.8.8 (Google) to bypass a broken ISP or router DNSDNS and DHCP — How They Work Together
These two protocols are closely linked and are often tested together on the A+ exam:
Gives your device an IP address, subnet mask, gateway, and DNS server — automatically.
Translates domain names into IP addresses so your browser knows where to connect.
Without DHCP, your device may not get an IP. Without DNS, your device can't resolve website names. Both need to work for normal internet access.
DNS Record Types
DNS record types are heavily tested on Network+. Each record type stores a different kind of information about a domain. Know every type below — the exam will describe a scenario and ask which record type is needed.
| Record | Full name | What it maps / stores | Exam scenario |
|---|---|---|---|
| A | Address | Hostname → IPv4 address | "What record maps a domain name to an IPv4 address?" |
| AAAA | IPv6 Address | Hostname → IPv6 address | "Which record resolves a hostname to an IPv6 address?" |
| CNAME | Canonical Name | Alias → another hostname (not an IP directly) | "www.example.com pointing to example.com" — classic CNAME use |
| MX | Mail Exchanger | Domain → mail server responsible for receiving email | "Email to @company.com isn't delivering — which record would you check?" |
| PTR | Pointer | IP address → hostname (reverse lookup) | "Which record is used for reverse DNS lookups?" |
| NS | Name Server | Identifies the authoritative name servers for a domain | "Which DNS servers are authoritative for this domain?" |
| SOA | Start of Authority | Zone metadata — primary NS, admin email, serial number, refresh/retry/expire timers | "Which record contains zone transfer timing information?" |
| TXT | Text | Arbitrary text — used for SPF, DKIM, DMARC email authentication records | "Which record type is used to publish SPF email sender policy?" |
| SRV | Service | Specifies hostname and port for specific services (SIP, XMPP, etc.) | Less commonly tested — know it exists and what it does |
A record = hostname to IPv4. AAAA record = hostname to IPv6. PTR record = IP to hostname (reverse — the opposite of A/AAAA). CNAME = alias to another name, never directly to an IP.
The MX record is the one to check whenever an email delivery scenario appears. The TXT record is what SPF, DKIM, and DMARC email security policies use.
DNS Hierarchy
DNS is a distributed, hierarchical system — no single server knows every domain. Resolution works by walking down the hierarchy from the top until an authoritative answer is found.
Recursive query: Your device asks the resolver — the resolver does all the work and returns a final answer. Most client-to-resolver queries are recursive.
Iterative query: The resolver asks a root server — the root server says "ask this TLD server" — the resolver asks the TLD server — and so on. Resolver-to-server queries are iterative.
DNS Zones
A DNS zone is an administrative portion of the DNS namespace — essentially the set of DNS records a particular name server is responsible for managing.
Primary zone → The read/write master copy of DNS records for a domain Changes are made here and replicated to secondary zones Secondary zone → Read-only copy of a primary zone — provides redundancy Updated via zone transfers from the primary Stub zone → Contains only NS records — used to find authoritative servers Lighter than a full secondary zone Forward lookup zone → Resolves hostnames → IP addresses (standard direction) Reverse lookup zone → Resolves IP addresses → hostnames (uses PTR records)
When a secondary DNS server requests an updated copy of records from a primary, this is called a zone transfer. Zone transfers use TCP port 53 (not UDP). Regular DNS queries use UDP port 53 — this distinction is tested.
Zone transfers should be restricted to authorised secondary servers only — unrestricted zone transfers are a security vulnerability that can expose your entire DNS record set.
DNSSEC
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records to protect against DNS spoofing and cache poisoning attacks — where an attacker injects false DNS responses to redirect traffic to malicious servers.
Without DNSSEC, nothing stops a malicious DNS server from returning a forged IP address for a domain. DNSSEC lets resolvers verify that responses are authentic and haven't been tampered with, using a chain of trust from the root servers down to the authoritative name server.
What it protects against: DNS cache poisoning / DNS spoofing — where attackers feed false DNS records to redirect users to malicious sites.
How it works: Cryptographic signatures (using public key cryptography) are added to DNS records. Resolvers validate signatures using a chain of trust anchored at the root.
What it does NOT do: DNSSEC does not encrypt DNS queries — it only authenticates them. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are what provide encryption.
nslookup — The DNS Troubleshooting Tool
nslookup is the primary tool for DNS diagnostics and is tested on both A+ and Network+. It queries DNS servers directly and shows what records are returned — letting you pinpoint exactly where DNS resolution is failing.
# Basic lookup — find the IP for a hostname nslookup google.com # Query a specific DNS server (bypass your default) nslookup google.com 8.8.8.8 # Look up a specific record type nslookup -type=MX gmail.com → Find mail servers nslookup -type=TXT example.com → Find SPF/DKIM records nslookup -type=NS example.com → Find authoritative name servers # Reverse lookup — find hostname for an IP nslookup 8.8.8.8 → Returns dns.google
"A technician can ping 8.8.8.8 successfully but websites will not load. Which tool should they use to verify DNS resolution is working?" → nslookup
"An administrator runs nslookup and gets a response from 192.168.1.1 but the IP returned for google.com is incorrect. What does this indicate?" → The local DNS server (192.168.1.1) has a corrupted or poisoned cache — try querying a known-good server like 8.8.8.8 directly.
Final Summary
Test Your Networking Knowledge
Practice exams and structured review make DNS troubleshooting scenarios automatic.
Related Networking Articles
Preparing for the A+ Exam?
See the books, practice exams, and free resources that actually work.