DNS Resolver

Every computer on the internet has a number by which it can be reached. It’s called an IP address and looks something like this: 93.184.216.34. Humans prefer to remember names like “wikipedia.org”. The DNS resolver is the service that translates this name into the matching number. So it’s a bit like the internet’s directory assistance: you give the name, you get the number. DNS stands for Domain Name System, meaning the worldwide directory of these names and numbers.

No directory assistance, no page load

Without a resolver, practically nothing works on the web. The browser can’t establish a connection until it knows the numeric address. That’s why such a translation happens at the start of every page load, every app request, and every email. If the resolver fails, it feels to users like a total internet outage, even though the websites themselves are still running. This is exactly the cause of many major disruptions reported in the news.

The resolver is also a place with a lot of power. Whoever operates it sees which names you request. That’s not the content of your pages, but it is a very telling list. At the same time, an operator can refuse to answer. In many countries, blocks are implemented exactly here: the resolver simply returns no address, or a false one, for certain names.

Speed depends on it too. An answer often takes only a few milliseconds, but with a slow resolver it can also take half a second. Since modern websites load content from many different domains, this adds up noticeably.

The path from the root to the domain

The resolver doesn’t know the answers itself. It asks its way through step by step, which is why it’s also called a recursive resolver. First, it asks one of the globally distributed root servers who is responsible for names with the “.de” ending. Then it asks that responsible server who is responsible for “beispiel.de”. Finally, it asks there for the specific address. Three to four queries, and the number is settled.

So that this doesn’t happen every single time, the resolver remembers answers for a while. This buffer is called a cache. Each answer carries an expiry, the so-called TTL, often a few minutes up to several hours. That’s why, after a website moves, it can sometimes take hours until truly all users get the new address.

A well-known problem: in the past, these queries traveled unencrypted, so anyone on the same network could read along or inject fake answers. To counter this, there’s now DNS over HTTPS, DoH for short. Here, the queries are packaged like normal web traffic and thus encrypted. A common misconception, though, is that this makes you anonymous. The operator of the resolver still sees your queries — just no other eavesdroppers do.

Which resolver is running on your device

By default, you use your internet provider’s resolver. Your router is automatically assigned its address and passes it on to all devices in the household. You can change this in the network settings. Well-known alternatives are 8.8.8.8 from Google, 1.1.1.1 from Cloudflare, and 9.9.9.9 from Quad9, which blocks known malware addresses.

In practice, you usually encounter this topic when something goes wrong. The error message “Server IP address could not be found” almost always means a problem with name resolution. Ad blockers for the entire home network, such as Pi-hole, also work as their own resolver: they simply answer requests to known ad domains with a dead end.

In business news, the term comes up in connection with large-scale outages. If a major provider’s resolver goes down, millions of users are affected instantly. Many experts consider this concentration on a few large operators a risk to the stability of the internet.