IPv4 vs IPv6 Explained: Differences, Features, Address Format & How They Work

Every device that communicates across an IP network needs addressing information so that data can be delivered to the correct destination.

Two major versions of the Internet Protocol are used for this purpose: IPv4 and IPv6.

IPv4 has been the dominant version of IP for decades, while IPv6 was developed to provide a vastly larger address space and support the continued growth of internet-connected devices.

Simple Definition: IPv4 and IPv6 are versions of the Internet Protocol used to identify devices and deliver packets across IP networks. IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses.

In this guide, you will learn how IPv4 and IPv6 addresses work, their formats, important differences, private and public addressing, NAT, subnetting, IPv6 features, transition technologies, and practical commands for checking IP configuration.

What Is an IP Address?

An IP address is a logical network address used by the Internet Protocol to identify an interface and help deliver packets across an IP network.

A simplified communication model looks like this:

Computer A
IP: 192.0.2.10
      |
      | Network
      v
    Router
      |
      v
Computer B
IP: 192.0.2.20
  

The exact addressing and routing behavior depends on the network architecture.

What Is IPv4?

IPv4 stands for Internet Protocol version 4.

IPv4 uses 32-bit addresses.

Because 32 bits are available, IPv4 provides:

232 = 4,294,967,296 possible address values

Not all addresses are assignable as ordinary host addresses because certain ranges and values have special purposes.

What Does an IPv4 Address Look Like?

IPv4 addresses are normally written in dotted-decimal notation.

Example:

192.168.1.10
  

An IPv4 address contains four decimal octets separated by periods.

192 . 168 . 1 . 10
 |     |    |    |
 8-bit 8-bit 8-bit 8-bit
  

Each octet can represent a value from 0 to 255.

What Is IPv6?

IPv6 stands for Internet Protocol version 6.

IPv6 uses 128-bit addresses.

This provides an enormously larger address space than IPv4.

The total number of IPv6 address values is:

2128

The purpose of IPv6 is not merely to provide more addresses. It also introduces changes and capabilities to the IP protocol, including a redesigned address format and mechanisms such as SLAAC and Neighbor Discovery.

What Does an IPv6 Address Look Like?

IPv6 addresses are written using hexadecimal notation.

Example:

2001:db8:1234:5678:abcd:ef01:2345:6789
  

The address is divided into groups separated by colons.

There are up to eight groups, with each group representing 16 bits.

2001 : db8 : 1234 : 5678 : abcd : ef01 : 2345 : 6789
  

Why Was IPv6 Created?

The main reason for developing IPv6 was the limited address space of IPv4.

The growth of:

  • Computers
  • Smartphones
  • Cloud systems
  • Servers
  • IoT devices
  • Home routers
  • Industrial systems

created increasing demand for IP addresses.

IPv4 conservation mechanisms such as NAT extended the practical life of IPv4, but they did not increase the total IPv4 address space.

IPv4 vs IPv6 at a Glance

Feature IPv4 IPv6
Address size 32 bits 128 bits
Address notation Dotted decimal Colon-separated hexadecimal
Address space Much smaller Extremely large
Broadcast Supports broadcast No broadcast; uses multicast and other mechanisms
Address configuration Manual configuration and DHCP are common Manual configuration, DHCPv6, and SLAAC can be used
Header design IPv4 header Redesigned IPv6 base header

IPv4 Address Example

192.168.1.25
  

This is an example from the private IPv4 address space used in local networks.

IPv6 Address Example

2001:db8:abcd:1234::25
  

The 2001:db8::/32 range is reserved for documentation examples, so it should not be treated as a normal public internet address.

IPv6 Address Compression

IPv6 addresses can become long, so the notation provides shorthand rules.

Leading zeros in a hexadecimal group can be omitted.

For example:

2001:0db8:0000:0000:0000:0000:0000:0025
  

can be shortened to:

2001:db8:0:0:0:0:0:25
  

Consecutive groups of zeros can also be compressed using ::, but this notation can only be used once in a single IPv6 address.

2001:db8::25
  

IPv4 Address Classes

You may encounter the old IPv4 classful addressing system in textbooks and introductory networking courses.

Historically, IPv4 addresses were grouped into classes such as A, B, and C based on leading bits.

Modern IP networks generally use CIDR rather than relying on the old classful model.

Exam Tip: You may still be asked about Class A, B, and C in academic networking courses, but understand that modern routing uses CIDR and prefix lengths instead of the old classful model.

What Is a Private IPv4 Address?

Private IPv4 addresses are intended for use within private networks and are not globally routable on the public internet.

The commonly used private IPv4 ranges are:

Range CIDR
10.0.0.0 – 10.255.255.255 10.0.0.0/8
172.16.0.0 – 172.31.255.255 172.16.0.0/12
192.168.0.0 – 192.168.255.255 192.168.0.0/16

Your home router may assign a private IPv4 address such as:

192.168.1.20
  

What Is a Public IPv4 Address?

A public IPv4 address is an address that can be globally routed on the internet, subject to routing and allocation rules.

A home or office network commonly uses private addresses internally while a router or firewall may use a public address for internet connectivity.

Laptop
192.168.1.20
     |
     v
Home Router
Public IPv4
     |
     v
Internet
  

What Is NAT?

NAT stands for Network Address Translation.

NAT allows a network device to translate addresses between different network address spaces.

A common home-network configuration uses many private IPv4 addresses behind one public IPv4 address.

Laptop       192.168.1.10
Phone        192.168.1.11
Desktop      192.168.1.12
       \        |        /
        \       |       /
         v      v      v
          Home Router
          Public IPv4
               |
               v
            Internet
  

NAT helped conserve IPv4 addresses, although it also introduces architectural considerations and can complicate some types of direct connectivity.

Does IPv6 Need NAT?

IPv6 was designed with a vastly larger address space, which reduces the need for address conservation through NAT.

However, IPv6 networks can still use forms of address translation for specific architectural or compatibility requirements. NAT should therefore not be considered an absolute requirement or absolute impossibility for IPv6.

What Is Subnetting?

Subnetting divides an IP address space into smaller logical networks.

For example:

192.168.1.0/24

Can be divided into smaller networks
  

Subnetting can improve address management, routing organization, security segmentation, and network design.

What Is CIDR?

CIDR stands for Classless Inter-Domain Routing.

CIDR represents an IP network using an address followed by a prefix length.

Example:

192.168.1.0/24
  

The /24 indicates that the first 24 bits form the network prefix.

IPv6 also uses prefix lengths, for example:

2001:db8:1234::/48
  

IPv4 Header vs IPv6 Header

IPv6 redesigned the base IP header compared with IPv4.

IPv6 removes or changes certain fields and introduces a simpler fixed base header structure with optional information handled through extension headers.

This allows the protocol to support a very large address space while providing a cleaner architecture for certain functions.

IPv4 and IPv6 Fragmentation

Fragmentation is handled differently in the two protocols.

In IPv4, routers can fragment packets under certain circumstances.

In IPv6, routers do not fragment packets in transit. Fragmentation, when needed, is performed by the sending host using an IPv6 Fragment extension header.

IPv4 Broadcast vs IPv6 Multicast

IPv4 supports broadcast communication, where a packet can be sent to all hosts on a subnet.

IPv6 does not use broadcast. Instead, IPv6 relies on multicast and other mechanisms for functions that need group communication.

IPv6 Address Types

IPv6 includes several important address categories.

Unicast

A unicast address identifies a single interface for one-to-one communication.

Multicast

A multicast address identifies a group of interfaces.

Anycast

An anycast address can be assigned to multiple interfaces, with routing delivering traffic to an appropriate member of the set according to the routing system.

IPv6 Link-Local Addresses

IPv6 interfaces commonly use link-local addresses for communication on the local network link.

These addresses use the fe80::/10 range.

Example:

fe80::1234:5678:abcd:ef01
  

Link-local addresses are not globally routable.

IPv6 Global Unicast Addresses

Global unicast addresses are intended for globally routable IPv6 communication.

An example used in documentation is:

2001:db8:1234::10
  

Again, 2001:db8::/32 is reserved for documentation and examples.

IPv6 Unique Local Addresses

IPv6 also provides unique local addresses for private internal networking.

They are defined within the fc00::/7 range, with commonly generated local addresses using the fd00::/8 portion.

These addresses are not intended for global internet routing.

How Does IPv6 Configure an Address?

IPv6 supports multiple address-configuration mechanisms.

SLAAC

SLAAC stands for Stateless Address Autoconfiguration.

It allows hosts to configure IPv6 addresses using information advertised by routers on the local link.

DHCPv6

DHCPv6 can also be used to provide configuration information to IPv6 clients.

Networks can use different combinations of these mechanisms according to their requirements.

What Is Neighbor Discovery Protocol?

IPv6 uses the Neighbor Discovery Protocol (NDP), which operates through ICMPv6 messages.

NDP supports functions such as:

  • Neighbor discovery
  • Router discovery
  • Address resolution
  • Neighbor reachability detection
  • Router advertisements

This replaces several functions associated with ARP and router discovery in IPv4.

IPv4 ARP vs IPv6 Neighbor Discovery

IPv4 IPv6
Uses ARP for IPv4-to-link-layer address resolution Uses Neighbor Discovery through ICMPv6
Uses broadcast-based ARP requests Uses multicast-based Neighbor Discovery messages

IPv4 vs IPv6 Security

IPv6 was designed with support for modern IP security mechanisms, but using IPv6 does not automatically make a network secure.

Both IPv4 and IPv6 deployments require security controls such as:

  • Firewalls
  • Access controls
  • Secure routing practices
  • Network segmentation
  • Monitoring
  • Secure host configuration
  • Patch management

Security teams should also understand IPv6 specifically rather than assuming that IPv4-only security policies automatically cover IPv6 traffic.

IPv4 and IPv6 DNS

DNS can provide both IPv4 and IPv6 addressing information.

An A record provides an IPv4 address.

An AAAA record provides an IPv6 address.

example.com

A
203.0.113.10

AAAA
2001:db8::10
  

A hostname can have both record types.

What Is Dual Stack?

Dual stack means a device or network supports both IPv4 and IPv6.

                 Application
                      |
              +-------+-------+
              |               |
             IPv4            IPv6
              |               |
              v               v
           Network         Network
  

Dual-stack operation is one common way to support both protocols during IPv6 adoption.

What Is IPv6 Tunneling?

Tunneling can carry one protocol through another network infrastructure by encapsulating packets.

Historically, various IPv6 transition mechanisms used tunneling to support IPv6 connectivity across IPv4 infrastructure.

The exact transition approach depends on the deployment environment.

Why Can't We Simply Replace IPv4 With IPv6 Everywhere?

The transition is complex because the two protocols are not directly interchangeable at the packet level.

Internet service providers, organizations, operating systems, applications, network equipment, data centers, and security systems have all had to accommodate IPv6 alongside existing IPv4 infrastructure.

This is why IPv4 and IPv6 continue to coexist in many environments.

IPv4 vs IPv6: Practical Differences

Area IPv4 IPv6
Address length 32-bit 128-bit
Written as Decimal octets Hexadecimal groups
Private addressing RFC 1918 private ranges Unique local addressing
Broadcast Supported Not used
Neighbor resolution ARP NDP
Address configuration Manual/DHCP commonly used SLAAC/DHCPv6/manual configuration available
NAT dependency Widely used for address conservation Much less necessary for address conservation

How to Check Your IPv4 and IPv6 Address

Windows

Open Command Prompt or PowerShell and run:

ipconfig
  

The output can include IPv4 addresses, IPv6 addresses, gateways, and other interface configuration information.

Linux

Use:

ip addr
  

or:

ip -6 addr
  

How to Test IPv4 Connectivity

You can use ping to test basic network reachability.

ping 192.0.2.1
  

Use real addresses appropriate to your network when testing.

How to Test IPv6 Connectivity

An IPv6 destination can be tested using ping tools that support IPv6.

ping -6 example.com
  

On some systems, the command may be named ping6.

IPv6 and Websites

A website can support IPv4, IPv6, or both.

DNS can publish:

A
203.0.113.10

AAAA
2001:db8::10
  

Clients with IPv6 connectivity can potentially use the IPv6 destination, while other clients can use IPv4 according to the client's networking behavior and the service's configuration.

IPv6 and Cloud Computing

Cloud environments increasingly support IPv6 alongside IPv4.

Cloud engineers may need to understand:

  • IPv4 and IPv6 subnets
  • Security groups and firewall rules
  • Routing tables
  • Load balancers
  • DNS A and AAAA records
  • Address allocation
  • Dual-stack architectures

When designing a cloud application, IPv6 should be considered explicitly rather than assumed to behave exactly like IPv4.

IPv6 and Cybersecurity

Cybersecurity professionals need visibility into both IPv4 and IPv6 traffic.

An organization that monitors only IPv4 can miss IPv6 traffic paths and configuration issues.

Security testing should consider:

  • IPv6 firewall rules
  • Router advertisements
  • Neighbor Discovery
  • IPv6 DNS records
  • Dual-stack applications
  • IPv6 routing
  • IP-based access controls

Common IPv4 and IPv6 Mistakes

  1. Assuming every IP address is publicly reachable.
  2. Confusing private addresses with public addresses.
  3. Forgetting that IPv6 uses hexadecimal notation.
  4. Writing IPv6 addresses incorrectly.
  5. Applying IPv4-only firewall assumptions to IPv6.
  6. Ignoring AAAA DNS records.
  7. Misunderstanding NAT as a complete security solution.
  8. Assuming IPv6 automatically eliminates all security problems.

IPv4 vs IPv6 for Beginners

As a beginner, you do not need to memorize every IPv6 feature immediately.

Start by understanding these concepts:

IPv4
 ↓
32-bit address
 ↓
Dotted decimal
 ↓
Private/Public
 ↓
NAT
 ↓
CIDR
 ↓
Subnetting


IPv6
 ↓
128-bit address
 ↓
Hexadecimal
 ↓
Unicast / Multicast / Anycast
 ↓
Link-Local
 ↓
SLAAC / DHCPv6
 ↓
NDP
 ↓
CIDR / Prefixes
  

IPv4 vs IPv6 Interview Questions

What is IPv4?

IPv4 is version 4 of the Internet Protocol and uses 32-bit addresses.

What is IPv6?

IPv6 is version 6 of the Internet Protocol and uses 128-bit addresses.

Why was IPv6 introduced?

IPv6 was developed primarily to provide a much larger IP address space and to improve the IP protocol architecture.

What is the main difference between IPv4 and IPv6?

The most fundamental difference is the address size: IPv4 uses 32 bits, while IPv6 uses 128 bits.

Does IPv6 use broadcast?

No. IPv6 does not use broadcast. It uses multicast and other mechanisms instead.

What is NAT?

NAT stands for Network Address Translation. It translates addresses between network address spaces and is widely used in IPv4 networks.

What is SLAAC?

SLAAC stands for Stateless Address Autoconfiguration. It allows IPv6 hosts to configure addresses using router-advertised information.

What is NDP?

NDP stands for Neighbor Discovery Protocol. It is an IPv6 protocol suite function implemented using ICMPv6 messages.

What is an AAAA record?

An AAAA DNS record maps a hostname to an IPv6 address.

What is dual stack?

Dual stack means a host or network supports both IPv4 and IPv6.

Frequently Asked Questions

```

Which is bigger, IPv4 or IPv6?

IPv6 has a vastly larger address space because it uses 128-bit addresses compared with IPv4's 32-bit addresses.

How many IPv4 addresses are possible?

IPv4 has 232, or 4,294,967,296, possible address values, although not all are available for ordinary host assignment.

How many IPv6 addresses are possible?

IPv6 has 2128 possible address values, providing an enormously larger address space.

Is IPv6 faster than IPv4?

Neither protocol should be considered universally faster. Performance depends on network architecture, routing, connectivity, configuration, and the path between endpoints.

Is IPv6 more secure than IPv4?

IPv6 provides capabilities designed into the protocol, but neither IPv4 nor IPv6 is automatically secure. Both require proper firewalling, configuration, monitoring, authentication, and application security.

Can IPv4 and IPv6 work together?

Yes. Dual-stack networks can operate IPv4 and IPv6 simultaneously, and additional transition mechanisms can be used in other architectures.

What is the difference between A and AAAA records?

An A record provides an IPv4 address, while an AAAA record provides an IPv6 address.

What is a private IPv4 address?

A private IPv4 address belongs to one of the ranges reserved for private networks and is not directly globally routable on the public internet.

What is a link-local IPv6 address?

A link-local IPv6 address is used for communication on the local network link and comes from the fe80::/10 range.

What is the IPv6 loopback address?

The IPv6 loopback address is ::1. It is used by a host to refer to itself.

```

Final Thoughts

IPv4 and IPv6 are two versions of the Internet Protocol that provide addressing and packet-delivery functionality for IP networks.

The biggest difference is easy to remember:

IPv4 → 32-bit → 192.168.1.10

IPv6 → 128-bit → 2001:db8::10
  

However, becoming comfortable with networking requires more than knowing the address sizes. Learn CIDR, subnetting, private/public addressing, NAT, routing, DNS, IPv6 SLAAC, NDP, multicast, and dual-stack networking.

These concepts form an important foundation for cloud computing, DevOps, system administration, cybersecurity, and web development.

CodeWithAV Networking Tip:

When troubleshooting connectivity, check both protocol versions. A service can work over IPv4 while failing over IPv6 because of DNS, routing, firewall, application, or hosting configuration.

Related Articles on CodeWithAV

What Is DNS? Complete Domain Name System Guide

How DNS Resolution Works

HTTP vs HTTPS Explained

What Is the Internet and How Does It Work?

What Is Cloud Computing?

Explore More Networking and Cybersecurity Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

How DNS Resolution Works: Step-by-Step DNS Lookup Explained

You type a website address into your browser:

https://www.example.com
  

Within a short time, the browser displays the website.

But how does the computer know which server should receive the request?

The answer involves DNS resolution.

Simple Definition: DNS resolution is the process of finding the DNS information needed to locate a hostname, such as an IP address, so that a client can communicate with the corresponding service.

DNS resolution happens so frequently that most users never notice it. Understanding it, however, is extremely useful for web developers, cloud engineers, system administrators, network engineers, DevOps professionals, and cybersecurity learners.

What Is DNS Resolution?

DNS resolution is the process through which a DNS query is answered.

Suppose a browser needs to connect to:

www.example.com
  

The client may need an IPv4 or IPv6 address for the hostname.

A simplified process is:

Hostname
   ↓
Local Cache
   ↓
Recursive Resolver
   ↓
Root
   ↓
TLD
   ↓
Authoritative DNS
   ↓
DNS Answer
   ↓
Client
  

In practice, caching can eliminate some of these steps.

Why Does DNS Resolution Exist?

Humans prefer names such as:

example.com
github.com
codewithav.blogspot.com
  

Network communication ultimately uses addressing information such as IP addresses.

DNS provides a scalable naming system that connects human-readable names with machine-readable network information.

The Complete DNS Resolution Process

Let's examine what can happen when you enter a website address into a browser.

Step 1: You Enter the URL

Suppose you type:

https://www.example.com
  

The browser identifies the hostname:

www.example.com
  

The browser now needs to determine where that hostname should resolve.

Step 2: Browser Checks Its Cache

The browser may have previously resolved the hostname and stored the answer temporarily.

If the cached information is still usable, another DNS lookup may not be necessary.

Browser Cache
     |
     | Found?
   +---+---+
   |       |
  Yes      No
   |       |
   v       v
Use     Continue
Answer  Lookup
  

Step 3: Operating System Checks DNS Information

If the browser does not have a usable answer, the operating system may have DNS information available locally.

The exact caching behavior depends on the operating system and DNS configuration.

Step 4: DNS Query Goes to a Recursive Resolver

If no suitable local answer exists, the client usually sends a DNS query to a configured recursive resolver.

The recursive resolver may be:

  • Provided by an internet service provider
  • Provided by an organization
  • Configured manually
  • Provided by another DNS service

The resolver's job is to find the answer for the client.

Step 5: Resolver Checks Its Cache

The recursive resolver may already have the requested information cached from a previous query.

If the cached record is still valid according to its TTL and caching rules, the resolver can immediately return the answer.

Client
  |
  v
Resolver
  |
  +---- Cached Answer? ---- Yes ----> Return
  |
  No
  |
  v
Continue DNS Resolution
  

Step 6: Resolver Queries the DNS Hierarchy

If the resolver does not have a usable cached answer, it can query the DNS hierarchy.

The hierarchy can involve:

  1. Root DNS servers
  2. Top-level domain servers
  3. Authoritative DNS servers

Step 7: Resolver Contacts a Root Server

The root system is at the top of the DNS hierarchy.

Suppose the resolver needs information for:

www.example.com
  

The root does not normally return the final IP address of the website.

Instead, it can direct the resolver toward the appropriate top-level-domain infrastructure, such as the infrastructure responsible for .com.

Resolver
   |
   v
Root
   |
   v
.com TLD Servers
  

Step 8: Resolver Queries the TLD Infrastructure

Next, the recursive resolver can query the DNS servers responsible for the relevant top-level domain.

For:

www.example.com
  

the relevant TLD is:

.com
  

The TLD infrastructure can provide information about the authoritative nameservers for the relevant domain.

Resolver
   |
   v
.com TLD
   |
   v
Authoritative Nameserver
  

Step 9: Resolver Contacts the Authoritative DNS Server

The resolver can then query an authoritative nameserver for the domain.

The authoritative server contains the DNS information for the zone it serves.

For example, it may return an A record:

www.example.com
A
203.0.113.25
  

Or it may return an AAAA record for IPv6:

www.example.com
AAAA
2001:db8::25
  

Step 10: Resolver Returns the Answer

The recursive resolver sends the result back to the client.

Authoritative DNS
       |
       v
Recursive Resolver
       |
       v
Client
       |
       v
IP Address
  

The client can now use the returned network address to establish a connection to the destination server.

Step 11: Browser Connects to the Server

DNS resolution is only one step in loading a website.

After obtaining the relevant address, the browser still needs to establish the appropriate network and application connections.

For HTTPS, this involves establishing a secure TLS connection before protected HTTP communication takes place.

DNS Resolution
      ↓
IP Address
      ↓
Network Connection
      ↓
TLS (for HTTPS)
      ↓
HTTP Request
      ↓
HTTP Response
      ↓
Website
  

Full DNS Resolution Diagram

                  User
                   |
                   v
                Browser
                   |
                   v
            Local DNS Cache
                   |
              Cache Miss
                   |
                   v
          Recursive Resolver
                   |
              Cache Miss
                   |
                   v
                 Root
                   |
                   v
               TLD DNS
                   |
                   v
          Authoritative DNS
                   |
                   v
             DNS Record
                   |
                   v
          Recursive Resolver
                   |
                   v
                Browser
                   |
                   v
             Web Server
  

What Is Recursive DNS?

A recursive DNS query asks a resolver to obtain the answer on behalf of the client.

The resolver may perform multiple DNS queries before returning the final result.

This is why it is useful to distinguish between:

  • Stub resolver/client: software on the user's system that sends DNS queries.
  • Recursive resolver: DNS service that finds the requested answer.
  • Authoritative server: server that provides authoritative records for a zone.

Recursive Query vs Iterative Query

DNS terminology distinguishes between recursive and iterative query behavior.

Recursive Query

The client asks the recursive resolver to obtain the final answer.

Client
  |
  | "Find the answer for me."
  v
Recursive Resolver
  |
  v
Final Answer
  

Iterative Query

A DNS server can respond with the best information it currently has, such as a referral to another DNS server.

Resolver
   |
   | Query
   v
Root
   |
   | Referral
   v
TLD
   |
   | Referral
   v
Authoritative Server
  

What Is DNS Caching?

DNS caching stores DNS responses temporarily so that future queries can be answered faster without repeating the entire resolution process.

Caching can occur in different places:

  • Browser
  • Operating system
  • Local DNS infrastructure
  • Recursive resolver

Why DNS Caching Matters

Imagine that thousands of users repeatedly ask for the same domain.

Without caching, DNS infrastructure would need to repeatedly perform work to obtain the same information.

With caching:

First Query
Client → Resolver → DNS Hierarchy
                       |
                       v
                    Answer
                       |
                       v
                  Cache Result


Later Query
Client → Resolver → Cached Answer
  

This can reduce DNS traffic and improve response time.

What Is TTL in DNS?

TTL stands for Time to Live.

DNS records contain TTL information that helps caching systems determine how long a response can generally be retained.

For example:

example.com
A
203.0.113.25
TTL: 3600
  

A TTL value of 3600 seconds represents one hour.

What Happens When a DNS Record Changes?

Suppose a website changes from one server address to another.

Before the change:

example.com → 203.0.113.25
  

After the change:

example.com → 198.51.100.50
  

Different recursive resolvers may temporarily return different results because they can have cached copies of the previous record.

As caches expire, new queries retrieve the updated information.

Why DNS Changes Are Not Always Immediate

Suppose a DNS record has a TTL of several hours.

A resolver that cached the old answer may continue using that cached value until its permitted cache lifetime expires.

This is why DNS changes can appear gradually across different networks.

What Is DNS Negative Caching?

DNS systems can also cache negative responses, such as the fact that a particular name does not exist.

This can reduce repeated queries for names that are known not to exist.

Negative caching behavior is controlled by DNS standards and relevant record information.

DNS Resolution and Subdomains

Consider:

api.example.com
  

The DNS system resolves the complete hostname according to the records and delegation configured for the relevant zone.

Different subdomains can point to different destinations:

example.com       → Website
www.example.com   → Website
api.example.com   → API
mail.example.com  → Mail
  

DNS CNAME During Resolution

A hostname may resolve through a CNAME record.

For example:

www.example.com
       |
       | CNAME
       v
app.host.example
       |
       | A / AAAA
       v
IP Address
  

The recursive resolver follows the DNS records as required to obtain the relevant final answer.

DNS Resolution for IPv4

If a client needs an IPv4 address, the resolver can obtain an A record.

www.example.com
       |
       v
A Record
       |
       v
203.0.113.25
  

DNS Resolution for IPv6

If an IPv6 address is requested, an AAAA record can provide it.

www.example.com
       |
       v
AAAA Record
       |
       v
2001:db8::25
  

Modern hosts can use IPv4, IPv6, or both depending on their configuration and network connectivity.

What If DNS Returns Multiple IP Addresses?

A hostname can have multiple address records.

For example:

example.com
A
203.0.113.10

example.com
A
203.0.113.11

example.com
A
203.0.113.12
  

How clients and applications use multiple addresses depends on the operating system, resolver behavior, application, and network architecture.

Multiple records can be part of architectures designed for distribution or redundancy, but DNS alone is not a complete substitute for application-aware load balancing.

DNS Resolution and Web Performance

DNS lookup is one component of the overall time needed to load a website.

A simplified sequence is:

DNS Lookup
    ↓
Connection Establishment
    ↓
TLS Handshake
    ↓
HTTP Request
    ↓
Server Processing
    ↓
Response
  

Good caching and responsive DNS infrastructure can reduce lookup overhead.

DNS Resolution and CDN Architecture

Content delivery networks can use DNS and other routing mechanisms as part of their traffic-distribution architecture.

A simplified example:

User
  |
  v
www.example.com
  |
  v
DNS / CDN Infrastructure
  |
  +------ Edge Location A
  |
  +------ Edge Location B
  |
  +------ Edge Location C
  

The exact routing process depends on the CDN and its architecture.

What Happens When DNS Fails?

If DNS resolution fails, the browser may not be able to determine where to connect.

Possible symptoms include:

  • Website does not open
  • DNS-related browser errors
  • API requests fail
  • Applications cannot connect to services by hostname
  • Email delivery problems

Common DNS Errors

NXDOMAIN

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS infrastructure.

SERVFAIL

SERVFAIL indicates that the DNS server could not successfully complete the query.

Timeout

A timeout can occur when the expected DNS response does not arrive within the relevant period.

Wrong IP Address

A DNS record may exist but point to the wrong destination.

How to Troubleshoot DNS Resolution

DNS troubleshooting should proceed systematically.

Step 1: Check the Hostname

Make sure the domain or subdomain is spelled correctly.

Step 2: Use nslookup

nslookup example.com
  

Step 3: Use dig

dig example.com
  

Step 4: Query Specific Record Types

dig example.com A
dig example.com AAAA
dig example.com CNAME
dig example.com MX
dig example.com TXT
  

Step 5: Identify the Authoritative Nameservers

Check the NS records and query the authoritative servers where appropriate.

Step 6: Check Cached Information

A stale cached answer may explain why different networks see different results.

Step 7: Check the Destination

If DNS returns an address correctly but the website is still unavailable, the problem may be at the network, web server, application, TLS, firewall, or hosting layer instead.

DNS Resolution on Windows

Windows provides the nslookup command for DNS troubleshooting.

nslookup google.com
  

You can also inspect local DNS configuration with:

ipconfig /all
  

To clear the Windows DNS client cache, Windows provides:

ipconfig /flushdns
  

This clears the local DNS resolver cache maintained by the Windows DNS client.

DNS Resolution on Linux

Linux systems can use tools such as:

dig example.com
nslookup example.com
  

Modern Linux distributions can use different DNS resolution components depending on the distribution and configuration.

How to See DNS Resolution in a Browser

Modern browser developer tools can help you inspect network activity, although the exact interface differs by browser.

You can inspect:

  • Request hostname
  • Connection information
  • Timing information
  • Response details

Browser timing tools can help separate DNS lookup time from connection and server-response time.

DNS Resolution and Cybersecurity

DNS resolution is also important in cybersecurity.

Security teams can use DNS logs to investigate suspicious activity.

Examples include:

  • Unexpected domain lookups
  • Known malicious domains
  • Unusual query volumes
  • Suspicious newly registered domains
  • Unexpected external connections

DNS filtering can also block requests to categories of known malicious or unwanted domains.

DNS Resolution and DNSSEC

DNSSEC can allow validating resolvers to verify the authenticity and integrity of signed DNS data.

A simplified concept is:

DNS Data
   |
Cryptographic Signature
   |
   v
Resolver Validation
   |
   +---- Valid ----> Accept
   |
   +---- Invalid --> Reject / Error
  

DNSSEC does not encrypt normal DNS queries. Its purpose is different from transport encryption technologies such as DNS over HTTPS or DNS over TLS.

DNS Resolution vs DNS Propagation

These terms are related but should not be treated as identical.

DNS Resolution DNS Propagation
Process of obtaining DNS information Common term for the period during which caches around the internet may still contain previous information after a change
Happens for DNS queries Becomes noticeable after DNS changes

DNS Resolution Example

Imagine a user opens:

https://api.example.com/users
  

The hostname is:

api.example.com
  

A simplified resolution path could be:

api.example.com
      ↓
Browser Cache
      ↓
OS Cache
      ↓
Recursive Resolver
      ↓
Root
      ↓
.com TLD
      ↓
Authoritative DNS
      ↓
A / AAAA Record
      ↓
IP Address
      ↓
HTTPS Connection
      ↓
/users API Endpoint
  

This illustrates an important point: DNS resolves the hostname; DNS does not process the HTTP API request itself.

What DNS Does Not Do

DNS is sometimes misunderstood as a system that handles the entire internet connection.

DNS does not itself:

  • Render a website
  • Process your application's business logic
  • Replace HTTP
  • Replace HTTPS
  • Act as a database for application records
  • Guarantee that a website is secure

Its primary role is naming and DNS information resolution.

DNS Resolution Interview Questions

What is DNS resolution?

DNS resolution is the process of obtaining DNS information for a hostname, often an IP address.

What is a recursive DNS resolver?

A recursive resolver obtains DNS answers on behalf of clients, using cached information or querying other DNS infrastructure as necessary.

What is an authoritative DNS server?

An authoritative server provides the authoritative DNS records for a zone.

What is the role of a root DNS server?

The root DNS system helps direct DNS queries toward the appropriate top-level-domain infrastructure.

What is the role of a TLD DNS server?

TLD DNS infrastructure helps a resolver locate the authoritative nameservers for domains under a particular top-level domain.

What is DNS caching?

DNS caching temporarily stores DNS responses so they can be reused for future queries.

What is TTL?

TTL specifies how long DNS information can generally remain cached before needing refresh according to DNS caching behavior.

Why does DNS resolution sometimes take longer?

Resolution time can be affected by cache misses, network latency, resolver performance, DNS infrastructure availability, and the number of queries required.

What is NXDOMAIN?

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS system.

What is DNSSEC?

DNSSEC adds cryptographic signatures that allow validating resolvers to verify the authenticity and integrity of DNS data.

Frequently Asked Questions

```

How does DNS resolution work?

A client first checks available local information and then typically asks a recursive resolver. If necessary, the resolver queries the DNS hierarchy, including root, TLD, and authoritative DNS infrastructure, before returning the answer.

How long does DNS resolution take?

It varies. Cached responses can be very fast, while cache misses may require additional network queries.

What happens if DNS resolution fails?

The client may be unable to connect to the hostname. Depending on the failure, tools or browsers may report errors such as NXDOMAIN, SERVFAIL, or timeout-related failures.

What is the difference between recursive and authoritative DNS?

A recursive resolver finds answers for clients, while an authoritative server provides authoritative DNS records for the zones it serves.

Does DNS resolution happen every time I open a website?

Not necessarily. Browser, operating-system, local-network, and recursive-resolver caches can prevent a full DNS lookup from occurring every time.

Can DNS return more than one IP address?

Yes. A hostname can have multiple A or AAAA records.

Does DNS resolution use TCP or UDP?

Traditional DNS commonly uses UDP and can also use TCP. The exact transport depends on the query and DNS communication requirements.

Is DNS secure?

Traditional DNS does not encrypt ordinary queries. Security and privacy can be improved using technologies such as DNSSEC, DNS over HTTPS, or DNS over TLS, each serving different purposes.

```

Final Thoughts

DNS resolution is one of the hidden processes that happens whenever software needs to translate a hostname into useful network information.

The simplified path to remember is:

Hostname
   ↓
Local Cache
   ↓
Recursive Resolver
   ↓
Root
   ↓
TLD
   ↓
Authoritative DNS
   ↓
IP Address / DNS Answer
   ↓
Network Connection
  

The most important concepts are recursive resolvers, authoritative DNS, root servers, TLD servers, DNS records, caching, TTL, CNAME, A/AAAA records, and DNS troubleshooting.

Once you understand DNS resolution, many concepts in web hosting, cloud computing, APIs, cybersecurity, Linux administration, and DevOps become easier to understand.

CodeWithAV Networking Tip:

When a website is not opening, separate the problem into layers: DNS → network connectivity → TLS/HTTPS → web server → application → database. This makes troubleshooting much more systematic.

Related Articles on CodeWithAV

What Is DNS? Complete Beginner Guide

What Is the Internet and How Does It Work?

What Happens When You Type a URL?

HTTP vs HTTPS Explained

HTTP Status Codes Every Developer Should Know

Explore More Networking and Web Development Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

What Is DNS? Complete Domain Name System Guide for Beginners

Every time you open a website such as example.com, your browser eventually needs to communicate with a server identified by an IP address.

But humans generally prefer remembering names rather than numerical addresses.

This is where DNS comes in.

Simple Definition: DNS stands for Domain Name System. It translates domain names such as example.com into IP addresses and also provides other information used to locate and route services on the internet.

DNS is one of the fundamental systems behind the internet. Without it, users would have to remember IP addresses for many websites and online services.

What Does DNS Do?

At its simplest, DNS helps map a domain name to information needed to reach a service.

For example:

www.example.com
       |
       | DNS lookup
       v
203.0.113.25
  

The browser can then use the resulting address to establish network communication with the destination.

DNS can also provide other records, such as information about mail servers, aliases, and domain verification.

Why Do We Need DNS?

Computers communicate using network addresses, while websites are easier for humans to remember using domain names.

Imagine having to remember an IP address for every website you use:

Website A → 203.0.113.25
Website B → 198.51.100.42
Website C → 192.0.2.10
  

Remembering names is much easier:

example.com
blog.example.com
api.example.com
  

DNS provides the translation and service-discovery layer between human-friendly names and network infrastructure.

DNS in One Simple Diagram

User enters:

https://www.example.com

        |
        v

      Browser
        |
        v

    DNS Resolver
        |
        v

   DNS Infrastructure
        |
        v

    IP Address
        |
        v

   Web Server
        |
        v

   Website
  

What Is a Domain Name?

A domain name is a human-readable name used to identify a domain in the DNS namespace.

Examples include:

  • example.com
  • google.com
  • github.com
  • codewithav.blogspot.com

A domain name can contain multiple labels separated by dots.

Understanding a Domain Name

Consider:

www.example.com
  

It can be viewed as:

www      . example . com
 |            |       |
 |            |       +-- Top-Level Domain
 |            +---------- Domain label
 +----------------------- Subdomain
  

Subdomain

www can be a subdomain label.

Other examples include:

blog.example.com
api.example.com
mail.example.com
  

Domain

example is the domain label in this simplified breakdown.

Top-Level Domain

.com is the top-level domain, commonly called a TLD.

What Is a TLD?

TLD stands for Top-Level Domain.

Common examples include:

  • .com
  • .org
  • .net
  • .edu
  • .gov
  • .in

There are many other generic and country-code top-level domains.

What Is DNS Resolution?

DNS resolution is the process of finding DNS information associated with a domain name.

When your browser needs to connect to a hostname, the system may perform a DNS lookup to find the relevant address.

A simplified flow is:

Domain Name
     ↓
Local Cache
     ↓
DNS Resolver
     ↓
Root DNS
     ↓
TLD DNS
     ↓
Authoritative DNS
     ↓
DNS Answer
     ↓
Client
  

In real systems, caching can cause some of these steps to be skipped because the resolver may already know the answer.

What Happens During a DNS Lookup?

Let's imagine that you enter:

https://www.example.com
  

Your system needs to determine the network address for www.example.com.

Step 1: Browser Cache

The browser may have recently resolved the hostname and may have cached the result.

Step 2: Operating System Cache

The operating system may also have cached DNS information.

Step 3: DNS Resolver

If no usable cached answer is available locally, the query can be sent to a recursive DNS resolver.

Step 4: Resolver Finds the Answer

The resolver can query the DNS hierarchy when it needs to obtain the answer.

Step 5: Result Is Returned

The resolver returns the DNS response to the client and may cache it according to applicable caching rules.

What Is a DNS Resolver?

A DNS resolver, often called a recursive resolver, receives DNS queries from clients and works to find the requested DNS information.

It can communicate with other DNS servers on behalf of the client.

Your Computer
      |
      v
Recursive DNS Resolver
      |
      +---- Root
      |
      +---- TLD
      |
      +---- Authoritative DNS
      |
      v
Answer
  

Resolvers also commonly maintain caches to reduce repeated DNS lookups.

What Is an Authoritative DNS Server?

An authoritative DNS server is a DNS server that provides the authoritative information for a particular DNS zone.

For example, an authoritative server for a domain can hold records such as:

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS

When a recursive resolver reaches the authoritative source for a domain, it can obtain the relevant DNS record.

Recursive Resolver vs Authoritative DNS Server

Recursive Resolver Authoritative Server
Finds DNS answers for clients Provides authoritative DNS data
Uses caching Hosts zone data
May contact multiple DNS servers Answers for zones it serves

What Is the DNS Root?

At the top of the DNS hierarchy is the root.

The root DNS system helps direct queries toward the appropriate top-level domain infrastructure.

                    Root
                      |
          +-----------+-----------+
          |           |           |
         .com        .org        .in
          |           |           |
          v           v           v
       Domains     Domains     Domains
  

The root system does not normally contain the final IP address for every website. Instead, it helps resolvers discover where information for the relevant TLD can be found.

What Is a TLD DNS Server?

A TLD DNS server handles DNS information for domains under a particular top-level domain.

For example, .com DNS infrastructure helps resolvers locate authoritative nameservers for domains ending in .com.

What Is a DNS Zone?

A DNS zone is an administrative portion of the DNS namespace for which a set of authoritative records is maintained.

A zone can contain records describing how domain names should be resolved.

What Are DNS Records?

DNS records are pieces of information stored in DNS zones.

Different record types serve different purposes.

Important DNS Record Types

A Record

An A record maps a hostname to an IPv4 address.

example.com → 203.0.113.25
  

AAAA Record

An AAAA record maps a hostname to an IPv6 address.

example.com → 2001:db8::25
  

CNAME Record

A CNAME record creates an alias from one hostname to another hostname.

www.example.com
       ↓
example.com
  

CNAME records point to another domain name rather than directly to an IP address.

MX Record

MX records specify mail servers responsible for receiving email for a domain.

example.com
     |
     v
MX
     |
     v
mail.example.com
  

TXT Record

TXT records contain text data associated with a domain.

They are commonly used for purposes such as domain verification and email-related policies.

NS Record

NS records identify authoritative nameservers for a DNS zone.

PTR Record

PTR records are used for reverse DNS, mapping an IP address to a hostname.

DNS Record Comparison

Record Purpose
A Hostname → IPv4 address
AAAA Hostname → IPv6 address
CNAME Hostname alias → another hostname
MX Mail server information
TXT Text-based domain information
NS Authoritative nameservers
PTR Reverse DNS mapping

What Is a Nameserver?

A nameserver is a DNS server that answers DNS queries for a domain or zone.

When you register a domain, the domain's delegation includes nameserver information indicating which authoritative DNS servers are responsible for the domain.

A domain might use nameservers such as:

ns1.example-dns.com
ns2.example-dns.com
  

DNS Delegation

DNS delegation is the process through which responsibility for a portion of the DNS namespace is delegated to authoritative nameservers.

For example:

Root
  ↓
.com
  ↓
example.com
  ↓
Authoritative Nameservers
  

This hierarchical structure allows DNS information to be distributed rather than stored in one enormous database.

What Is DNS Caching?

DNS caching means temporarily storing DNS responses so they can be reused for future requests.

Caching can occur at multiple levels, including:

  • Browser
  • Operating system
  • Local network
  • Recursive resolver

Caching reduces repeated queries and can improve response time.

What Is TTL in DNS?

TTL stands for Time to Live.

In DNS, TTL specifies how long a cached DNS record can generally be retained before it needs to be refreshed according to DNS caching behavior.

For example:

example.com
A
203.0.113.25
TTL: 3600
  

A TTL of 3600 seconds represents one hour.

Why Does DNS Propagation Take Time?

When a DNS record changes, users may not immediately see the new result everywhere because different recursive resolvers can have cached versions of the previous record.

The time required for caches to refresh depends on factors such as the previous TTL and resolver behavior.

This is commonly described as DNS propagation, although DNS changes are essentially being observed as cached information expires and new information is obtained.

What Is Reverse DNS?

Normal DNS commonly maps a hostname to an IP address.

example.com
     ↓
203.0.113.25
  

Reverse DNS performs the opposite type of lookup:

203.0.113.25
     ↓
hostname.example.com
  

Reverse DNS commonly uses PTR records.

DNS and Email

DNS is not only used for websites.

Email systems rely heavily on DNS records.

MX records tell sending mail systems which servers are responsible for receiving mail for a domain.

TXT records can also be used for email-related authentication and policy mechanisms such as SPF, DKIM, and DMARC configurations.

DNS and Subdomains

A single domain can have multiple subdomains.

example.com

├── www.example.com
├── blog.example.com
├── api.example.com
├── mail.example.com
└── shop.example.com
  

Each hostname can have its own DNS records and can point to different services.

DNS and Cloud Computing

DNS plays an important role in cloud environments.

Applications may use DNS for:

  • Websites
  • APIs
  • Load balancers
  • Microservices
  • Cloud storage endpoints
  • Email systems
  • Service discovery

A production architecture might look like:

User
  |
  v
DNS
  |
  v
Load Balancer
  |
  +--------+--------+
  |        |        |
  v        v        v
App 1    App 2    App 3
  |
  v
Database
  

DNS and CDNs

DNS can also be part of how users are directed toward content delivery infrastructure.

Depending on the architecture, DNS can direct users to services that then route traffic through geographically distributed systems or edge infrastructure.

DNS and Cybersecurity

DNS is a major part of security monitoring because malicious infrastructure can use domains and DNS records to support phishing, malware distribution, command-and-control infrastructure, and other attacks.

Security teams may monitor:

  • Suspicious domains
  • Unexpected DNS changes
  • Abnormal DNS query patterns
  • Newly observed domains
  • Large volumes of DNS requests

DNS filtering can also be used as one layer of defensive security.

What Is DNS Spoofing?

DNS spoofing refers broadly to attacks in which false DNS information is supplied to redirect users or systems.

Depending on the attack, a victim may be directed toward an attacker-controlled destination instead of the intended service.

DNS security therefore depends on proper resolver configuration, DNS infrastructure protection, and additional security mechanisms.

What Is DNS Cache Poisoning?

DNS cache poisoning is an attack in which incorrect DNS information is placed into a resolver's cache so that users can receive a fraudulent DNS answer.

Modern DNS infrastructure incorporates mechanisms intended to make such attacks more difficult, and DNSSEC can provide additional authenticity protections for DNS data.

What Is DNSSEC?

DNSSEC stands for Domain Name System Security Extensions.

DNSSEC adds cryptographic signatures to DNS data so resolvers that perform validation can verify that the DNS response originated from the expected DNS data chain and was not improperly modified.

DNSSEC helps address the authenticity and integrity of DNS data.

It does not encrypt ordinary DNS queries or provide general website encryption. HTTPS serves a different purpose.

DNS vs HTTPS

DNS HTTPS
Resolves domain information Protects HTTP communication
Helps locate network services Provides TLS encryption and authentication for web communication
Uses DNS protocols and records Uses HTTP over TLS

What Is DNS over HTTPS?

DNS over HTTPS (DoH) is a method of sending DNS queries through HTTPS.

This can protect the DNS query from being exposed as ordinary plaintext to network observers on the path between the client and the DoH server.

It is different from DNSSEC:

  • DNSSEC focuses on authenticity and integrity of DNS data.
  • DoH transports DNS queries and responses through HTTPS.

What Is DNS over TLS?

DNS over TLS (DoT) is another approach for protecting DNS traffic in transit by sending DNS through a TLS connection.

DoH and DoT solve related transport-privacy problems using different protocols and deployment models.

DNS Ports

Traditional DNS commonly uses UDP port 53.

DNS can also use TCP port 53, including for cases where TCP is required by the protocol or DNS data exchange.

Other DNS-related technologies use different ports. For example, DNS over TLS commonly uses TCP port 853.

How to Check DNS Records

You can inspect DNS information using command-line tools.

Windows nslookup

nslookup example.com
  

Linux dig

dig example.com
  

You can also query specific record types.

dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com TXT
  

Example DNS Lookup Using nslookup

A simplified command is:

nslookup example.com
  

The response can contain information such as the DNS server used and the returned address records.

The exact output depends on the operating system and DNS environment.

Common DNS Problems

1. NXDOMAIN

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS system.

2. SERVFAIL

SERVFAIL indicates that the DNS server could not successfully complete the query.

Potential causes can include DNSSEC validation issues, upstream failures, or authoritative configuration problems.

3. DNS Timeout

A DNS timeout can occur when the client or resolver does not receive an expected response within the relevant period.

4. Incorrect A or AAAA Record

If an A or AAAA record points to the wrong destination, visitors may be directed to the wrong server.

5. Incorrect Nameservers

If domain delegation points to the wrong nameservers, the intended DNS zone may not be used.

6. Stale Cached Information

Resolvers may temporarily return previously cached information until it expires according to TTL and caching behavior.

How to Troubleshoot DNS Problems

A practical troubleshooting sequence is:

  1. Check the domain name for spelling mistakes.
  2. Query the domain using nslookup or dig.
  3. Check the authoritative nameservers.
  4. Inspect A, AAAA, CNAME, MX, and TXT records as appropriate.
  5. Check the TTL and whether cached information may be involved.
  6. Test using a different recursive resolver.
  7. Check DNSSEC configuration when relevant.
  8. Verify that the destination server is actually reachable.

DNS and Website Hosting

When you connect a domain name to a website, DNS is usually part of the configuration.

A simplified setup might be:

Domain
example.com
     |
     v
DNS A Record
     |
     v
Web Server IP
     |
     v
Website
  

For some hosting platforms, other DNS configurations such as CNAME records or provider-specific records may be required.

DNS and Custom Domains

Suppose you want to connect a custom domain to a blog or web application.

The hosting platform may tell you to create one or more DNS records.

Depending on the platform, these could include:

  • A records
  • AAAA records
  • CNAME records
  • TXT verification records

The exact records should always come from the hosting provider's current documentation.

DNS and Subdomain Architecture

A single domain can provide separate services through subdomains.

example.com
   |
   +-- www.example.com → Website
   |
   +-- api.example.com → Backend API
   |
   +-- app.example.com → Web Application
   |
   +-- mail.example.com → Mail Service
  

This is common in modern application architectures.

DNS and Load Balancing

DNS can participate in traffic distribution, although the actual load-balancing behavior depends on the architecture and service involved.

A DNS name may resolve to infrastructure such as a load balancer rather than directly to an individual application server.

api.example.com
       |
       v
Load Balancer
   /    |    \
  v     v     v
App1  App2  App3
  

Important DNS Concepts to Remember

Concept Simple Explanation
DNS System for resolving domain names and related DNS information
Resolver Finds DNS answers for clients
Authoritative Server Provides authoritative records for a DNS zone
A Record Hostname to IPv4 address
AAAA Record Hostname to IPv6 address
CNAME Alias from one hostname to another
MX Mail server information
TXT Text-based DNS information
TTL Caching lifetime for DNS information

Frequently Asked Questions

```

What is DNS in simple words?

DNS is the system that helps translate domain names into information such as IP addresses so computers can locate network services.

What does DNS stand for?

DNS stands for Domain Name System.

Why is DNS needed?

DNS lets people use memorable domain names instead of having to remember numerical network addresses for websites and other services.

What is DNS resolution?

DNS resolution is the process of finding the DNS information associated with a queried domain name.

What is a DNS resolver?

A DNS resolver receives queries from clients and works to find the appropriate DNS answer, often using cached information and other DNS servers.

What is an authoritative DNS server?

An authoritative DNS server provides the official DNS records for the zones it serves.

What is an A record?

An A record maps a hostname to an IPv4 address.

What is an AAAA record?

An AAAA record maps a hostname to an IPv6 address.

What is a CNAME record?

A CNAME record creates an alias from one hostname to another hostname.

What is an MX record?

An MX record identifies mail servers responsible for receiving email for a domain.

What is TTL in DNS?

TTL, or Time to Live, indicates how long DNS information can generally remain cached before it should be refreshed.

What is DNS propagation?

DNS propagation commonly refers to the time during which different DNS caches still contain previous information after a DNS change.

What is DNSSEC?

DNSSEC is a set of DNS extensions that uses cryptographic signatures to help validating resolvers verify the authenticity and integrity of DNS data.

What is the difference between DNS and HTTPS?

DNS helps resolve domain information, while HTTPS protects web communication using TLS.

What port does DNS use?

Traditional DNS commonly uses port 53 over UDP and can also use TCP. Other protected DNS methods use different transports and ports.

```

Final Thoughts

DNS is one of the most important systems behind the internet.

It provides the naming and discovery mechanism that allows people to use names such as example.com while network infrastructure works with addresses and other machine-readable information.

For developers, network engineers, system administrators, cloud engineers, and cybersecurity learners, DNS fundamentals are essential.

Start by understanding domains, resolvers, authoritative servers, DNS hierarchy, A and AAAA records, CNAME, MX, TXT, nameservers, TTL, caching, and DNS troubleshooting.

CodeWithAV Networking Learning Path:

Domain Names → DNS Resolution → Resolvers → Root → TLD → Authoritative DNS → A/AAAA → CNAME → MX/TXT → TTL & Caching → DNSSEC → DNS Troubleshooting.

Related Articles on CodeWithAV

What Is the Internet and How Does It Work?

What Happens When You Type a URL?

How a Website Works From Browser to Server

HTTP vs HTTPS Explained

HTTP Status Codes Every Developer Should Know

Explore More Networking and Web Development Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

HTTP vs HTTPS Explained: Difference, Security, Ports & How HTTPS Works

Whenever you open a website, your browser communicates with a server using network protocols. Two terms that frequently appear in web development and cybersecurity are HTTP and HTTPS.

You have probably noticed addresses such as:

http://example.com
https://example.com
  

They look almost identical, but the difference is extremely important.

HTTP stands for Hypertext Transfer Protocol, while HTTPS stands for Hypertext Transfer Protocol Secure.

HTTPS adds cryptographic protection to HTTP communication, helping protect data exchanged between the client and server.

Simple Definition: HTTP transfers web data without the transport encryption provided by HTTPS. HTTPS uses HTTP over a secure TLS connection to protect data in transit.


What Is HTTP?

HTTP is a protocol used for communication between web clients and servers.

When you open a website, your browser can send an HTTP request to a server. The server processes that request and sends an HTTP response.

Browser
   |
   | HTTP Request
   v
Web Server
   |
   | HTTP Response
   v
Browser
  

HTTP is the foundation for exchanging resources such as HTML documents, stylesheets, JavaScript files, images, and API responses.

What Is HTTPS?

HTTPS is HTTP carried over a secure TLS connection.

TLS stands for Transport Layer Security.

HTTPS is designed to provide important security properties for data sent between a client and server, including:

  • Encryption of data in transit
  • Integrity protection
  • Authentication of the server through certificates
Browser
   |
   | Encrypted TLS Connection
   v
Web Server
   |
   | Encrypted TLS Connection
   v
Browser
  

HTTP vs HTTPS at a Glance

Feature HTTP HTTPS
Protocol HTTP HTTP over TLS
Encryption in transit No TLS protection Yes, through TLS
Typical port 80 443
Server authentication No TLS certificate authentication Uses TLS certificates
Data integrity protection Not provided by TLS Provided by TLS

Why Is HTTPS Important?

When sensitive information travels across a network, an attacker who can observe network traffic should not be able to simply read or modify the protected contents.

HTTPS helps protect information such as:

  • Login credentials
  • Session cookies
  • Personal information
  • Payment-related information
  • API requests and responses
  • Private application data

HTTPS is therefore an important part of modern web security.

How Does HTTPS Work?

HTTPS uses TLS to create a protected communication channel between the client and server.

A simplified flow looks like this:

1. Browser connects to website
             ↓
2. Server presents its TLS certificate
             ↓
3. Browser validates the certificate
             ↓
4. Client and server establish cryptographic keys
             ↓
5. Secure TLS connection is established
             ↓
6. HTTP messages travel through that connection
  

The exact cryptographic process is more detailed, but this simplified model helps beginners understand the purpose of TLS.

What Is TLS?

TLS stands for Transport Layer Security.

TLS is a cryptographic protocol designed to secure communication over networks.

HTTPS uses TLS to protect HTTP traffic.

So the relationship can be visualized as:

HTTPS
  |
  +-- HTTP
  |
  +-- TLS protection
  |
  +-- Secure network connection
  

What Is an SSL Certificate?

You may often hear people say SSL certificate when discussing website security.

SSL stands for Secure Sockets Layer. SSL is an older protocol that has been replaced by TLS for modern secure web communication.

The term "SSL certificate" is still widely used to describe the digital certificates used with HTTPS, even though modern systems use TLS rather than the old SSL protocol.

What Is a TLS Certificate?

A TLS certificate is a digital certificate associated with a website's identity and public key.

It helps a browser verify that the server it is connecting to is associated with the requested domain, subject to the certificate validation process and trust model.

Certificates are issued by trusted certificate authorities within the browser or operating system trust ecosystem.

What Does a Browser Check in a Certificate?

Certificate validation involves several checks. Depending on the environment, the browser can verify items such as:

  • The certificate is valid for the requested domain.
  • The certificate is currently within its validity period.
  • The certificate chains to a trusted authority.
  • The certificate has not failed other required validation checks.

If a serious certificate validation problem exists, the browser can warn the user before establishing normal HTTPS trust.

What Is Encryption?

Encryption transforms readable information into a form that cannot be understood without the appropriate cryptographic information needed to decrypt or authenticate it.

For example, a message such as:

Hello Server
  

can be transmitted as protected ciphertext rather than as ordinary readable text.

Modern TLS uses established cryptographic algorithms to provide confidentiality and integrity protection.

What Is Data Integrity?

Integrity means detecting unauthorized modification of data during transmission.

Imagine sending:

amount=1000
  

An attacker should not be able to silently change it to:

amount=9000
  

without the communication endpoints detecting that something went wrong.

TLS provides integrity protection for the protected connection.

What Is Authentication in HTTPS?

HTTPS uses certificates to help authenticate the server.

This is important because encryption by itself is not enough.

Suppose an attacker creates a fake website that looks exactly like a legitimate website. A secure connection alone would not prove that the website is the correct site unless the authentication and certificate checks are also valid.

TLS certificate validation helps the browser establish that the server is associated with the requested domain according to the certificate trust system.

HTTP Port 80 vs HTTPS Port 443

HTTP is conventionally associated with TCP port 80.

HTTPS is conventionally associated with TCP port 443.

HTTP
Browser
   |
   +---- TCP 80 ----> Web Server


HTTPS
Browser
   |
   +---- TCP 443 ---> Web Server
          |
          +---- TLS
  

These are conventional ports, not absolute requirements. Network services can be configured differently.

HTTP Example

A simplified HTTP request could look like:

GET /index.html HTTP/1.1
Host: example.com
  

The server might return:

HTTP/1.1 200 OK
Content-Type: text/html
  

With ordinary HTTP, there is no TLS layer protecting the communication.

HTTPS Example

With HTTPS, HTTP messages are carried inside a TLS-protected connection.

Browser
   |
   | TLS-secured connection
   v
Server

Inside the protected connection:
HTTP Request
HTTP Response
  

The network does not simply see the HTTP application data as ordinary plaintext.

Does HTTPS Encrypt Everything?

No.

HTTPS protects the contents of the TLS connection, but it does not make every aspect of network activity invisible.

For example, information such as IP addresses and certain metadata can still be observable to parts of the network infrastructure.

HTTPS should therefore not be interpreted as complete anonymity.

Can HTTPS Stop All Cyberattacks?

No.

HTTPS protects data in transit, but it does not automatically protect the website from vulnerabilities in its own application or infrastructure.

A website can use HTTPS and still have problems such as:

  • Weak passwords
  • Broken access control
  • SQL injection
  • Cross-site scripting
  • Insecure file uploads
  • Server misconfiguration
  • Vulnerable dependencies
  • Compromised user accounts

HTTPS is one layer of security, not a complete security solution.

HTTPS and Public Wi-Fi

Public Wi-Fi networks can expose users to security risks when applications communicate without adequate transport protection.

HTTPS helps protect the content of web communication from network observers by encrypting the traffic between the client and server.

However, users should still be careful with suspicious websites, phishing pages, malicious downloads, and compromised accounts.

What Is a Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack occurs when an attacker places themselves between two communicating parties and attempts to observe, modify, or interfere with their communication.

TLS helps defend against network-level interception and modification by providing encryption, integrity, and server authentication.

Without Proper Transport Protection

Client <------> Attacker <------> Server
                 |
              Can attempt
             to observe or
              alter traffic


With Proper HTTPS

Client ======== TLS ========= Server
        Protected Connection
  

HTTPS does not protect against every form of attack, but it significantly improves the security of data in transit.

HTTP Redirect to HTTPS

Many websites configure HTTP traffic to redirect users to an HTTPS URL.

For example:

http://example.com
       |
       v
https://example.com
  

A redirect can help move users toward the secure version of a site.

However, the initial HTTP connection is not itself protected by TLS, so secure-site configurations often also use mechanisms such as HSTS to tell compatible browsers to use HTTPS for future connections.

What Is HSTS?

HSTS stands for HTTP Strict Transport Security.

HSTS is a browser security mechanism that allows a website to tell compatible browsers that it should only be accessed through HTTPS for a specified period.

A response can include a header such as:

Strict-Transport-Security: max-age=31536000
  

Real deployment should use HSTS deliberately and according to the site's infrastructure and domain configuration.

HTTPS and Cookies

HTTPS is especially important for applications that use authentication cookies or session information.

Websites can also configure cookie security attributes such as:

  • Secure — directs browsers to send the cookie over secure connections.
  • HttpOnly — helps prevent client-side scripts from directly reading the cookie.
  • SameSite — controls how cookies are sent in cross-site contexts.

These controls complement HTTPS rather than replacing it.

HTTPS and APIs

APIs often handle valuable information, making transport security extremely important.

A secure API might use:

https://api.example.com/users
  

Instead of:

http://api.example.com/users
  

When API requests contain authentication credentials or private information, transmitting them over an unprotected connection can expose those credentials and data to network attackers.

HTTPS in Mobile Applications

Mobile applications also communicate with remote APIs.

A mobile app might send:

POST https://api.example.com/login
  

The TLS connection helps protect the credentials and other application data in transit.

Does HTTPS Affect Website Speed?

Modern TLS implementations are designed to minimize connection overhead, and HTTPS is standard practice for modern websites.

The overall performance of a website depends on many factors, including:

  • Server response time
  • Network latency
  • HTTP protocol version
  • Image sizes
  • JavaScript and CSS
  • Caching
  • Content delivery architecture

Therefore, HTTPS should not be viewed simply as a feature that automatically makes a site slow.

HTTPS and SEO

Website security is important for users and modern web infrastructure. Search engines may also use HTTPS as a ranking-related signal in their systems.

However, switching a website to HTTPS does not guarantee higher search rankings. Content quality, relevance, technical health, user experience, and many other factors also matter.

How to Check Whether a Website Uses HTTPS

Look at the browser's address bar.

A website using HTTPS will generally begin with:

https://
  

Modern browsers may display security information differently, so the exact visual indicator can vary between browsers.

How to Inspect a Website Certificate

Most modern browsers provide certificate and connection details through the site's security information in the address bar or developer tools.

You can use this information to inspect details such as:

  • Certificate subject
  • Certificate issuer
  • Validity period
  • Connection security

HTTP vs HTTPS: Security Comparison

Security Property HTTP HTTPS
Confidentiality No TLS encryption Protected by TLS
Integrity No TLS integrity protection TLS provides integrity protection
Server Authentication No TLS certificate mechanism TLS certificates support authentication

Common HTTPS Misconceptions

Misconception 1: HTTPS Means the Website Is Completely Safe

Not necessarily. HTTPS protects transport between endpoints, but the website can still contain application vulnerabilities.

Misconception 2: HTTPS Means the Website Owner Is Trustworthy

A valid certificate primarily helps authenticate control of the relevant domain within the certificate trust system. It does not guarantee that the site's content, business practices, or offers are trustworthy.

Misconception 3: HTTPS Provides Complete Anonymity

No. HTTPS protects application data in the encrypted connection, but network metadata can still reveal information such as IP addresses and traffic patterns.

Misconception 4: HTTPS Is Only Needed for Payment Websites

HTTPS is useful for all kinds of websites and applications because even ordinary browsing can involve cookies, account credentials, personal data, and private application information.

How Developers Can Enable HTTPS

The exact process depends on the hosting environment, reverse proxy, platform, and certificate setup.

A typical deployment process can include:

  1. Configure the domain.
  2. Obtain a trusted TLS certificate.
  3. Configure the web server or hosting platform.
  4. Enable HTTPS.
  5. Test certificate validation.
  6. Redirect appropriate HTTP traffic to HTTPS.
  7. Configure secure cookies and application settings.
  8. Consider HSTS after the HTTPS configuration is correct.

HTTPS With Nginx

On Linux servers, Nginx is commonly used as a web server or reverse proxy.

A simplified configuration might look conceptually like:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /path/to/certificate.pem;
    ssl_certificate_key /path/to/private-key.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}
  

This is only a conceptual example. Production TLS configuration should follow current security guidance for the specific server and environment.

HTTPS for Bloggers and Website Owners

If you run a blog, portfolio, business website, or application, HTTPS should be treated as a basic security requirement.

Before publishing a website, check:

  • The site loads using HTTPS.
  • The certificate is valid.
  • Important pages do not expose sensitive data over HTTP.
  • Authentication cookies use appropriate security attributes.
  • Mixed-content issues are resolved.

What Is Mixed Content?

Mixed content occurs when an HTTPS page tries to load some resources using HTTP.

For example:

HTTPS page
   |
   +-- HTTPS image  ✓
   +-- HTTPS CSS    ✓
   +-- HTTP script  ✗
  

Modern browsers may block or restrict insecure resources because loading them over an unprotected connection can weaken the security of an HTTPS page.

HTTP/2 and HTTP/3

HTTPS should also be distinguished from HTTP versions.

HTTP/1.1, HTTP/2, and HTTP/3 are versions of the HTTP protocol or related transport architecture.

HTTPS describes the use of HTTP through a secure TLS-protected connection. HTTP/3 uses QUIC as its transport and incorporates TLS security as part of the protocol design.

Therefore:

HTTP vs HTTPS
     =
Security / transport protection concept

HTTP/1.1 vs HTTP/2 vs HTTP/3
     =
HTTP protocol versions
  

Frequently Asked Questions

```

What is the difference between HTTP and HTTPS?

HTTP is the standard web communication protocol, while HTTPS is HTTP carried over a TLS-protected connection that provides encryption, integrity protection, and server authentication.

What does HTTPS stand for?

HTTPS stands for Hypertext Transfer Protocol Secure.

What does HTTP stand for?

HTTP stands for Hypertext Transfer Protocol.

What port does HTTP use?

HTTP is conventionally associated with TCP port 80.

What port does HTTPS use?

HTTPS is conventionally associated with TCP port 443.

Is HTTPS encrypted?

Yes. HTTPS uses TLS to encrypt and protect application data sent through the secure connection.

What is SSL?

SSL stands for Secure Sockets Layer. It is an older security protocol that has been replaced by TLS. The term "SSL certificate" remains common in everyday usage.

What is TLS?

TLS stands for Transport Layer Security. It is the cryptographic protocol used by modern HTTPS connections.

Does HTTPS prevent hacking?

No. HTTPS protects data in transit but does not eliminate application vulnerabilities, compromised accounts, insecure configurations, or other security risks.

Can HTTPS protect passwords?

HTTPS helps protect passwords while they are transmitted between the browser or application and the server. The application must still securely store and process passwords.

Does HTTPS make a website trustworthy?

No. HTTPS helps authenticate the website's domain through the certificate system, but it does not guarantee the trustworthiness of the site's content, owner, products, or services.

What is an HTTPS certificate?

A TLS certificate is a digital certificate used as part of the HTTPS trust and authentication process.

```

Final Thoughts

The difference between HTTP and HTTPS is more than one extra letter in a website address.

HTTP provides the basic mechanism for transferring web resources, while HTTPS adds TLS protection to the communication channel.

HTTPS helps provide three important security properties: confidentiality, integrity, and server authentication.

For modern website owners, developers, and cybersecurity learners, understanding HTTPS is essential because secure transport is a fundamental layer of web security.

CodeWithAV Security Reminder:

Use HTTPS for websites and APIs, protect authentication credentials, validate certificates, configure secure cookies, remove mixed content, and remember that transport security is only one part of overall application security.

Related Articles on CodeWithAV

What Is JSON? Complete Beginner Guide

REST API Explained With Examples

What Is the Internet and How Does It Work?

How a Website Works From Browser to Server

Explore More Cybersecurity and Web Development Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.