DNS, the Domain Name System, is the internet’s address book. It translates a name you can remember, such as a website address, into the numerical IP address a computer needs to connect. This post has DNS explained in plain terms, including why it matters for privacy and what you can change.
DNS explained: what it does
Computers find each other using numbers called IP addresses. People are better with names. Every time you type a website address or tap a link, your device asks, in effect, which number belongs to this name. DNS is the system that answers.
The same thing happens in the background constantly. A single web page can pull in resources from dozens of different domains, and an app on your phone may look up several names before you have even opened it. If you want to know more about the numbers themselves, our article on what an IP address is is a good companion.
How a DNS lookup works
The process sounds complicated, but the idea is simple: ask someone who knows, and remember the answer for a while.
- Your device checks its own memory (its cache) in case it already knows the answer.
- If not, it asks a DNS resolver. This is a server, usually run by your internet provider unless you have changed it, whose job is to find answers on your behalf.
- The resolver may have the answer cached. If not, it works through the global DNS hierarchy: it asks servers responsible for the top-level part of the name, then servers responsible for the specific domain, until it gets the address.
- The answer comes back to your device, which can now connect and which stores the result for a limited time.
All of this usually takes a tiny fraction of a second, which is why you never notice it when things work.
Why DNS matters for privacy and security
Your resolver sees your lookups
Because the resolver answers every question, it can see which domain names your device asks about. It does not see the pages you read or what you type on a secure site, but a list of domains still says a lot about your habits. Traditionally, DNS questions travel unencrypted, so someone on the same network, or your internet provider, could also observe them.
DNS can be tampered with
If an attacker controls the resolver, or can interfere with the answers, they can send you to a fake site that looks real. This is one reason the padlock and correct address matter in the browser, and why a modern HTTPS connection is a useful safety net: a fake server cannot easily present a valid certificate for the real name.
DNS is also used for filtering
Some resolvers block known malicious or unwanted domains, and some families and organisations use this for content controls. That can be helpful, but it also means a resolver can see and shape what you reach.
Encrypted DNS options
To stop casual snooping on lookups, there are two widely used standards. DNS over HTTPS wraps lookups inside normal HTTPS traffic. DNS over TLS encrypts them using TLS on a dedicated connection. Both prevent others on your network from reading the questions, although the resolver you chose still sees them.
Modern browsers and operating systems often let you turn these on in the settings. This is a privacy improvement against local snoopers, not a guarantee of anonymity. It simply moves trust from your network to the resolver you select.
Changing DNS, fixing problems and using a VPN
Should you change your DNS provider?
For many people the default is fine. Reasons to change include wanting encrypted lookups, malware filtering, family controls or simply a resolver you trust more. Reasons not to include a corporate or school network that requires its own settings, and the risk of choosing something you have not looked into.
If you do change it, you can usually do so on a single device or in your router so every device at home uses it. Before you start, note your current settings so you can revert. Choose a resolver whose privacy policy you have actually read, since it will see your lookups.
Common DNS problems
- A site will not load but others do. The domain may be down, or your device may hold a stale cached answer. Restarting the device or clearing its DNS cache often helps.
- Everything fails except by number. Your resolver may be unreachable. Try a different network to confirm.
- A site loads a strange page. Treat it with suspicion, check the address carefully and try another network.
DNS and VPNs
When a VPN is connected, your DNS questions should be sent through the encrypted tunnel to the VPN’s own resolver. If they travel outside it, your lookups remain visible to your network and internet provider, which is called a DNS leak. We cover how to test for this in how to check for DNS leaks.
Where to start
You do not have to change anything to benefit from knowing how DNS works. A sensible first step is to find out which resolver your device currently uses, then decide whether encrypted DNS or a different provider suits you. Keep your router and devices updated, and pay attention to browser warnings. For more explainers on the plumbing behind everyday browsing, see the rest of our Wi-Fi and networking guides.
Frequently asked questions
What does DNS stand for?
Domain Name System. It is the service that converts human-friendly domain names into the IP addresses computers use to connect.
Can my internet provider see my DNS lookups?
If you use its default resolver, yes, it can see which domain names you ask about. Encrypted DNS or a VPN can reduce what your provider sees, though the new resolver can see them instead.
Will changing DNS make my internet faster?
Sometimes lookups become slightly quicker, but the effect on overall speed is usually small. Privacy and filtering are better reasons to switch.
Does DNS over HTTPS make me anonymous?
No. It hides lookups from people on your network, but the resolver still sees them, and the sites you visit still see your IP address.
