DNS explained: how your domain points to the right place

What is DNS — and what are nameservers?

DNS stands for Domain Name System and works as the internet’s address book. People remember domains like webits.dk, but servers find each other via IP addresses such as 192.0.2.10. DNS translates one into the other. Every time someone opens your website or sends an email to your domain, their system quietly looks up DNS in the background to work out which server to contact.

The lookup itself happens through several stages. When a domain is registered, a set of nameservers is designated as the authoritative source for the domain’s records. A visitor’s computer asks a resolver, the resolver finds the correct nameservers, and the nameservers answer with the current records. The answer is cached temporarily along the way, so the next lookup is faster. The whole chain typically takes milliseconds.

The important thing to understand is that the nameservers decide everything. If you change nameservers, you move responsibility for the whole domain’s DNS to a new place, and the records the new place does not know about disappear. That is why nameservers are one of the most critical — and most overlooked — points in a website or email migration.

The most important record types

DNS consists of records — small rules that each tell where a particular part of the domain points. Most companies only need to deal with a handful of types, but those are decisive. An A record points the domain to an IPv4 address, that is, the server that serves your website. An AAAA record does the same for the newer IPv6. A CNAME is an alias that points one name at another, for example www at the main domain, so you only maintain the address in one place.

Email is controlled by MX records, which tell other mail servers where to deliver mail for your domain. If MX points the wrong way, incoming mail disappears silently, even though the website works perfectly. TXT records hold free text and are today used mainly to prove who is allowed to send mail on your behalf. SPF lists the permitted senders, DKIM signs your mail digitally, and DMARC tells the recipient what should happen if SPF or DKIM does not match. NS records specify the domain’s nameservers.

Together these records form the foundation beneath both web and email. Most operational problems with domains can be traced back to a single one of them pointing incorrectly, being missing or containing a typo.

• A and AAAA — point the domain to the website’s server (IPv4 and IPv6).
• CNAME — an alias that points one name at another, for example www at the main domain.
• MX — determines which server receives email for the domain.
• TXT with SPF, DKIM and DMARC — document and protect your permitted mail senders.
• NS — specify the nameservers that are authoritative for the whole domain.

TTL and propagation: why changes take time

Every record has a TTL — Time To Live — that tells resolvers how long they may cache the answer before asking again. A TTL of one hour means a change can take up to an hour to reach everyone, because some resolvers still serve the old value until their copy expires. This delayed rollout is what people call propagation.

In practice this means DNS changes have to be planned. If you are moving a website or switching mail provider, you can lower the TTL on the affected records a day in advance, so the old answer expires quickly when the switch happens. After the move, the TTL can be raised again for stable, fast lookups. Too high a TTL during a migration means a long wait; a very low TTL in everyday operation causes more lookups with no meaningful benefit.

Propagation is also why a change can look correct in one place and wrong in another for a while. This is rarely an error, but an expected in-between stage. Patience and a deliberate TTL strategy are therefore better than changing the same records repeatedly because the result does not take effect immediately.

DNSSEC and security

Ordinary DNS was designed to be fast and robust, not to prove that an answer is genuine. That opens the door to attacks where a forged resolver or a manipulated answer sends your visitors to a fake server without them noticing. DNSSEC closes that gap by signing the DNS answers cryptographically, so a resolver can verify that the answer really comes from the domain’s authoritative source and has not been altered in transit.

DNSSEC does not protect the content on your website or encrypt your traffic — that is what SSL does. It secures a different link: that the lookup itself, which tells where your domain lives, cannot be forged. For a domain that handles logins, payments or customer data, this is a meaningful extra layer of protection, and it is at the same time a requirement or an expectation in several industries and tenders.

Security in DNS, however, is not only about DNSSEC. Access to edit records should be protected, changes should be traceable, and the records that protect your email — SPF, DKIM and DMARC — should be set up correctly and kept up to date. A forgotten or too permissive SPF record is one of the most common reasons someone can abuse your domain as a sender.

Why correct DNS matters — and the value of managed DNS

DNS is one of the few places where a small mistake has large, immediate consequences. A wrong A record takes the website offline. A wrong MX record stops incoming mail. A missing or faulty SPF or DKIM record makes your outgoing mail land in recipients’ spam filters, even though everything else works. Precisely because DNS is invisible day to day, the errors are often only noticed when customers cannot find you or receive no reply.

Correct DNS is therefore as much a question of email deliverability as of website uptime. Modern mail servers increasingly reject or deprioritise senders without proper SPF, DKIM and DMARC. A domain where those records are set up correctly reaches the inbox; a domain without risks being marked as untrustworthy — regardless of how well the email itself is written.

This is where the value of managed DNS lies. Rather than records being scattered across several providers and edited by changing people with no overview, responsibility is gathered in one place with someone who monitors, documents and keeps track of nameservers, TTL, DNSSEC and mail records. During a migration this means changes are planned and carried out without downtime, and that website and mail keep working while the change takes effect. An operations partner who owns DNS is cheaper than the day a wrong lookup takes down both web and mail at once.