IPv4 vs IPv6 Explained: Differences, Features, Address Format & How They Work

Every device that communicates across an IP network needs addressing information so that data can be delivered to the correct destination.

Two major versions of the Internet Protocol are used for this purpose: IPv4 and IPv6.

IPv4 has been the dominant version of IP for decades, while IPv6 was developed to provide a vastly larger address space and support the continued growth of internet-connected devices.

Simple Definition: IPv4 and IPv6 are versions of the Internet Protocol used to identify devices and deliver packets across IP networks. IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses.

In this guide, you will learn how IPv4 and IPv6 addresses work, their formats, important differences, private and public addressing, NAT, subnetting, IPv6 features, transition technologies, and practical commands for checking IP configuration.

What Is an IP Address?

An IP address is a logical network address used by the Internet Protocol to identify an interface and help deliver packets across an IP network.

A simplified communication model looks like this:

Computer A
IP: 192.0.2.10
      |
      | Network
      v
    Router
      |
      v
Computer B
IP: 192.0.2.20
  

The exact addressing and routing behavior depends on the network architecture.

What Is IPv4?

IPv4 stands for Internet Protocol version 4.

IPv4 uses 32-bit addresses.

Because 32 bits are available, IPv4 provides:

232 = 4,294,967,296 possible address values

Not all addresses are assignable as ordinary host addresses because certain ranges and values have special purposes.

What Does an IPv4 Address Look Like?

IPv4 addresses are normally written in dotted-decimal notation.

Example:

192.168.1.10
  

An IPv4 address contains four decimal octets separated by periods.

192 . 168 . 1 . 10
 |     |    |    |
 8-bit 8-bit 8-bit 8-bit
  

Each octet can represent a value from 0 to 255.

What Is IPv6?

IPv6 stands for Internet Protocol version 6.

IPv6 uses 128-bit addresses.

This provides an enormously larger address space than IPv4.

The total number of IPv6 address values is:

2128

The purpose of IPv6 is not merely to provide more addresses. It also introduces changes and capabilities to the IP protocol, including a redesigned address format and mechanisms such as SLAAC and Neighbor Discovery.

What Does an IPv6 Address Look Like?

IPv6 addresses are written using hexadecimal notation.

Example:

2001:db8:1234:5678:abcd:ef01:2345:6789
  

The address is divided into groups separated by colons.

There are up to eight groups, with each group representing 16 bits.

2001 : db8 : 1234 : 5678 : abcd : ef01 : 2345 : 6789
  

Why Was IPv6 Created?

The main reason for developing IPv6 was the limited address space of IPv4.

The growth of:

  • Computers
  • Smartphones
  • Cloud systems
  • Servers
  • IoT devices
  • Home routers
  • Industrial systems

created increasing demand for IP addresses.

IPv4 conservation mechanisms such as NAT extended the practical life of IPv4, but they did not increase the total IPv4 address space.

IPv4 vs IPv6 at a Glance

Feature IPv4 IPv6
Address size 32 bits 128 bits
Address notation Dotted decimal Colon-separated hexadecimal
Address space Much smaller Extremely large
Broadcast Supports broadcast No broadcast; uses multicast and other mechanisms
Address configuration Manual configuration and DHCP are common Manual configuration, DHCPv6, and SLAAC can be used
Header design IPv4 header Redesigned IPv6 base header

IPv4 Address Example

192.168.1.25
  

This is an example from the private IPv4 address space used in local networks.

IPv6 Address Example

2001:db8:abcd:1234::25
  

The 2001:db8::/32 range is reserved for documentation examples, so it should not be treated as a normal public internet address.

IPv6 Address Compression

IPv6 addresses can become long, so the notation provides shorthand rules.

Leading zeros in a hexadecimal group can be omitted.

For example:

2001:0db8:0000:0000:0000:0000:0000:0025
  

can be shortened to:

2001:db8:0:0:0:0:0:25
  

Consecutive groups of zeros can also be compressed using ::, but this notation can only be used once in a single IPv6 address.

2001:db8::25
  

IPv4 Address Classes

You may encounter the old IPv4 classful addressing system in textbooks and introductory networking courses.

Historically, IPv4 addresses were grouped into classes such as A, B, and C based on leading bits.

Modern IP networks generally use CIDR rather than relying on the old classful model.

Exam Tip: You may still be asked about Class A, B, and C in academic networking courses, but understand that modern routing uses CIDR and prefix lengths instead of the old classful model.

What Is a Private IPv4 Address?

Private IPv4 addresses are intended for use within private networks and are not globally routable on the public internet.

The commonly used private IPv4 ranges are:

Range CIDR
10.0.0.0 – 10.255.255.255 10.0.0.0/8
172.16.0.0 – 172.31.255.255 172.16.0.0/12
192.168.0.0 – 192.168.255.255 192.168.0.0/16

Your home router may assign a private IPv4 address such as:

192.168.1.20
  

What Is a Public IPv4 Address?

A public IPv4 address is an address that can be globally routed on the internet, subject to routing and allocation rules.

A home or office network commonly uses private addresses internally while a router or firewall may use a public address for internet connectivity.

Laptop
192.168.1.20
     |
     v
Home Router
Public IPv4
     |
     v
Internet
  

What Is NAT?

NAT stands for Network Address Translation.

NAT allows a network device to translate addresses between different network address spaces.

A common home-network configuration uses many private IPv4 addresses behind one public IPv4 address.

Laptop       192.168.1.10
Phone        192.168.1.11
Desktop      192.168.1.12
       \        |        /
        \       |       /
         v      v      v
          Home Router
          Public IPv4
               |
               v
            Internet
  

NAT helped conserve IPv4 addresses, although it also introduces architectural considerations and can complicate some types of direct connectivity.

Does IPv6 Need NAT?

IPv6 was designed with a vastly larger address space, which reduces the need for address conservation through NAT.

However, IPv6 networks can still use forms of address translation for specific architectural or compatibility requirements. NAT should therefore not be considered an absolute requirement or absolute impossibility for IPv6.

What Is Subnetting?

Subnetting divides an IP address space into smaller logical networks.

For example:

192.168.1.0/24

Can be divided into smaller networks
  

Subnetting can improve address management, routing organization, security segmentation, and network design.

What Is CIDR?

CIDR stands for Classless Inter-Domain Routing.

CIDR represents an IP network using an address followed by a prefix length.

Example:

192.168.1.0/24
  

The /24 indicates that the first 24 bits form the network prefix.

IPv6 also uses prefix lengths, for example:

2001:db8:1234::/48
  

IPv4 Header vs IPv6 Header

IPv6 redesigned the base IP header compared with IPv4.

IPv6 removes or changes certain fields and introduces a simpler fixed base header structure with optional information handled through extension headers.

This allows the protocol to support a very large address space while providing a cleaner architecture for certain functions.

IPv4 and IPv6 Fragmentation

Fragmentation is handled differently in the two protocols.

In IPv4, routers can fragment packets under certain circumstances.

In IPv6, routers do not fragment packets in transit. Fragmentation, when needed, is performed by the sending host using an IPv6 Fragment extension header.

IPv4 Broadcast vs IPv6 Multicast

IPv4 supports broadcast communication, where a packet can be sent to all hosts on a subnet.

IPv6 does not use broadcast. Instead, IPv6 relies on multicast and other mechanisms for functions that need group communication.

IPv6 Address Types

IPv6 includes several important address categories.

Unicast

A unicast address identifies a single interface for one-to-one communication.

Multicast

A multicast address identifies a group of interfaces.

Anycast

An anycast address can be assigned to multiple interfaces, with routing delivering traffic to an appropriate member of the set according to the routing system.

IPv6 Link-Local Addresses

IPv6 interfaces commonly use link-local addresses for communication on the local network link.

These addresses use the fe80::/10 range.

Example:

fe80::1234:5678:abcd:ef01
  

Link-local addresses are not globally routable.

IPv6 Global Unicast Addresses

Global unicast addresses are intended for globally routable IPv6 communication.

An example used in documentation is:

2001:db8:1234::10
  

Again, 2001:db8::/32 is reserved for documentation and examples.

IPv6 Unique Local Addresses

IPv6 also provides unique local addresses for private internal networking.

They are defined within the fc00::/7 range, with commonly generated local addresses using the fd00::/8 portion.

These addresses are not intended for global internet routing.

How Does IPv6 Configure an Address?

IPv6 supports multiple address-configuration mechanisms.

SLAAC

SLAAC stands for Stateless Address Autoconfiguration.

It allows hosts to configure IPv6 addresses using information advertised by routers on the local link.

DHCPv6

DHCPv6 can also be used to provide configuration information to IPv6 clients.

Networks can use different combinations of these mechanisms according to their requirements.

What Is Neighbor Discovery Protocol?

IPv6 uses the Neighbor Discovery Protocol (NDP), which operates through ICMPv6 messages.

NDP supports functions such as:

  • Neighbor discovery
  • Router discovery
  • Address resolution
  • Neighbor reachability detection
  • Router advertisements

This replaces several functions associated with ARP and router discovery in IPv4.

IPv4 ARP vs IPv6 Neighbor Discovery

IPv4 IPv6
Uses ARP for IPv4-to-link-layer address resolution Uses Neighbor Discovery through ICMPv6
Uses broadcast-based ARP requests Uses multicast-based Neighbor Discovery messages

IPv4 vs IPv6 Security

IPv6 was designed with support for modern IP security mechanisms, but using IPv6 does not automatically make a network secure.

Both IPv4 and IPv6 deployments require security controls such as:

  • Firewalls
  • Access controls
  • Secure routing practices
  • Network segmentation
  • Monitoring
  • Secure host configuration
  • Patch management

Security teams should also understand IPv6 specifically rather than assuming that IPv4-only security policies automatically cover IPv6 traffic.

IPv4 and IPv6 DNS

DNS can provide both IPv4 and IPv6 addressing information.

An A record provides an IPv4 address.

An AAAA record provides an IPv6 address.

example.com

A
203.0.113.10

AAAA
2001:db8::10
  

A hostname can have both record types.

What Is Dual Stack?

Dual stack means a device or network supports both IPv4 and IPv6.

                 Application
                      |
              +-------+-------+
              |               |
             IPv4            IPv6
              |               |
              v               v
           Network         Network
  

Dual-stack operation is one common way to support both protocols during IPv6 adoption.

What Is IPv6 Tunneling?

Tunneling can carry one protocol through another network infrastructure by encapsulating packets.

Historically, various IPv6 transition mechanisms used tunneling to support IPv6 connectivity across IPv4 infrastructure.

The exact transition approach depends on the deployment environment.

Why Can't We Simply Replace IPv4 With IPv6 Everywhere?

The transition is complex because the two protocols are not directly interchangeable at the packet level.

Internet service providers, organizations, operating systems, applications, network equipment, data centers, and security systems have all had to accommodate IPv6 alongside existing IPv4 infrastructure.

This is why IPv4 and IPv6 continue to coexist in many environments.

IPv4 vs IPv6: Practical Differences

Area IPv4 IPv6
Address length 32-bit 128-bit
Written as Decimal octets Hexadecimal groups
Private addressing RFC 1918 private ranges Unique local addressing
Broadcast Supported Not used
Neighbor resolution ARP NDP
Address configuration Manual/DHCP commonly used SLAAC/DHCPv6/manual configuration available
NAT dependency Widely used for address conservation Much less necessary for address conservation

How to Check Your IPv4 and IPv6 Address

Windows

Open Command Prompt or PowerShell and run:

ipconfig
  

The output can include IPv4 addresses, IPv6 addresses, gateways, and other interface configuration information.

Linux

Use:

ip addr
  

or:

ip -6 addr
  

How to Test IPv4 Connectivity

You can use ping to test basic network reachability.

ping 192.0.2.1
  

Use real addresses appropriate to your network when testing.

How to Test IPv6 Connectivity

An IPv6 destination can be tested using ping tools that support IPv6.

ping -6 example.com
  

On some systems, the command may be named ping6.

IPv6 and Websites

A website can support IPv4, IPv6, or both.

DNS can publish:

A
203.0.113.10

AAAA
2001:db8::10
  

Clients with IPv6 connectivity can potentially use the IPv6 destination, while other clients can use IPv4 according to the client's networking behavior and the service's configuration.

IPv6 and Cloud Computing

Cloud environments increasingly support IPv6 alongside IPv4.

Cloud engineers may need to understand:

  • IPv4 and IPv6 subnets
  • Security groups and firewall rules
  • Routing tables
  • Load balancers
  • DNS A and AAAA records
  • Address allocation
  • Dual-stack architectures

When designing a cloud application, IPv6 should be considered explicitly rather than assumed to behave exactly like IPv4.

IPv6 and Cybersecurity

Cybersecurity professionals need visibility into both IPv4 and IPv6 traffic.

An organization that monitors only IPv4 can miss IPv6 traffic paths and configuration issues.

Security testing should consider:

  • IPv6 firewall rules
  • Router advertisements
  • Neighbor Discovery
  • IPv6 DNS records
  • Dual-stack applications
  • IPv6 routing
  • IP-based access controls

Common IPv4 and IPv6 Mistakes

  1. Assuming every IP address is publicly reachable.
  2. Confusing private addresses with public addresses.
  3. Forgetting that IPv6 uses hexadecimal notation.
  4. Writing IPv6 addresses incorrectly.
  5. Applying IPv4-only firewall assumptions to IPv6.
  6. Ignoring AAAA DNS records.
  7. Misunderstanding NAT as a complete security solution.
  8. Assuming IPv6 automatically eliminates all security problems.

IPv4 vs IPv6 for Beginners

As a beginner, you do not need to memorize every IPv6 feature immediately.

Start by understanding these concepts:

IPv4
 ↓
32-bit address
 ↓
Dotted decimal
 ↓
Private/Public
 ↓
NAT
 ↓
CIDR
 ↓
Subnetting


IPv6
 ↓
128-bit address
 ↓
Hexadecimal
 ↓
Unicast / Multicast / Anycast
 ↓
Link-Local
 ↓
SLAAC / DHCPv6
 ↓
NDP
 ↓
CIDR / Prefixes
  

IPv4 vs IPv6 Interview Questions

What is IPv4?

IPv4 is version 4 of the Internet Protocol and uses 32-bit addresses.

What is IPv6?

IPv6 is version 6 of the Internet Protocol and uses 128-bit addresses.

Why was IPv6 introduced?

IPv6 was developed primarily to provide a much larger IP address space and to improve the IP protocol architecture.

What is the main difference between IPv4 and IPv6?

The most fundamental difference is the address size: IPv4 uses 32 bits, while IPv6 uses 128 bits.

Does IPv6 use broadcast?

No. IPv6 does not use broadcast. It uses multicast and other mechanisms instead.

What is NAT?

NAT stands for Network Address Translation. It translates addresses between network address spaces and is widely used in IPv4 networks.

What is SLAAC?

SLAAC stands for Stateless Address Autoconfiguration. It allows IPv6 hosts to configure addresses using router-advertised information.

What is NDP?

NDP stands for Neighbor Discovery Protocol. It is an IPv6 protocol suite function implemented using ICMPv6 messages.

What is an AAAA record?

An AAAA DNS record maps a hostname to an IPv6 address.

What is dual stack?

Dual stack means a host or network supports both IPv4 and IPv6.

Frequently Asked Questions

```

Which is bigger, IPv4 or IPv6?

IPv6 has a vastly larger address space because it uses 128-bit addresses compared with IPv4's 32-bit addresses.

How many IPv4 addresses are possible?

IPv4 has 232, or 4,294,967,296, possible address values, although not all are available for ordinary host assignment.

How many IPv6 addresses are possible?

IPv6 has 2128 possible address values, providing an enormously larger address space.

Is IPv6 faster than IPv4?

Neither protocol should be considered universally faster. Performance depends on network architecture, routing, connectivity, configuration, and the path between endpoints.

Is IPv6 more secure than IPv4?

IPv6 provides capabilities designed into the protocol, but neither IPv4 nor IPv6 is automatically secure. Both require proper firewalling, configuration, monitoring, authentication, and application security.

Can IPv4 and IPv6 work together?

Yes. Dual-stack networks can operate IPv4 and IPv6 simultaneously, and additional transition mechanisms can be used in other architectures.

What is the difference between A and AAAA records?

An A record provides an IPv4 address, while an AAAA record provides an IPv6 address.

What is a private IPv4 address?

A private IPv4 address belongs to one of the ranges reserved for private networks and is not directly globally routable on the public internet.

What is a link-local IPv6 address?

A link-local IPv6 address is used for communication on the local network link and comes from the fe80::/10 range.

What is the IPv6 loopback address?

The IPv6 loopback address is ::1. It is used by a host to refer to itself.

```

Final Thoughts

IPv4 and IPv6 are two versions of the Internet Protocol that provide addressing and packet-delivery functionality for IP networks.

The biggest difference is easy to remember:

IPv4 → 32-bit → 192.168.1.10

IPv6 → 128-bit → 2001:db8::10
  

However, becoming comfortable with networking requires more than knowing the address sizes. Learn CIDR, subnetting, private/public addressing, NAT, routing, DNS, IPv6 SLAAC, NDP, multicast, and dual-stack networking.

These concepts form an important foundation for cloud computing, DevOps, system administration, cybersecurity, and web development.

CodeWithAV Networking Tip:

When troubleshooting connectivity, check both protocol versions. A service can work over IPv4 while failing over IPv6 because of DNS, routing, firewall, application, or hosting configuration.

Related Articles on CodeWithAV

What Is DNS? Complete Domain Name System Guide

How DNS Resolution Works

HTTP vs HTTPS Explained

What Is the Internet and How Does It Work?

What Is Cloud Computing?

Explore More Networking and Cybersecurity Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

How DNS Resolution Works: Step-by-Step DNS Lookup Explained

You type a website address into your browser:

https://www.example.com
  

Within a short time, the browser displays the website.

But how does the computer know which server should receive the request?

The answer involves DNS resolution.

Simple Definition: DNS resolution is the process of finding the DNS information needed to locate a hostname, such as an IP address, so that a client can communicate with the corresponding service.

DNS resolution happens so frequently that most users never notice it. Understanding it, however, is extremely useful for web developers, cloud engineers, system administrators, network engineers, DevOps professionals, and cybersecurity learners.

What Is DNS Resolution?

DNS resolution is the process through which a DNS query is answered.

Suppose a browser needs to connect to:

www.example.com
  

The client may need an IPv4 or IPv6 address for the hostname.

A simplified process is:

Hostname
   ↓
Local Cache
   ↓
Recursive Resolver
   ↓
Root
   ↓
TLD
   ↓
Authoritative DNS
   ↓
DNS Answer
   ↓
Client
  

In practice, caching can eliminate some of these steps.

Why Does DNS Resolution Exist?

Humans prefer names such as:

example.com
github.com
codewithav.blogspot.com
  

Network communication ultimately uses addressing information such as IP addresses.

DNS provides a scalable naming system that connects human-readable names with machine-readable network information.

The Complete DNS Resolution Process

Let's examine what can happen when you enter a website address into a browser.

Step 1: You Enter the URL

Suppose you type:

https://www.example.com
  

The browser identifies the hostname:

www.example.com
  

The browser now needs to determine where that hostname should resolve.

Step 2: Browser Checks Its Cache

The browser may have previously resolved the hostname and stored the answer temporarily.

If the cached information is still usable, another DNS lookup may not be necessary.

Browser Cache
     |
     | Found?
   +---+---+
   |       |
  Yes      No
   |       |
   v       v
Use     Continue
Answer  Lookup
  

Step 3: Operating System Checks DNS Information

If the browser does not have a usable answer, the operating system may have DNS information available locally.

The exact caching behavior depends on the operating system and DNS configuration.

Step 4: DNS Query Goes to a Recursive Resolver

If no suitable local answer exists, the client usually sends a DNS query to a configured recursive resolver.

The recursive resolver may be:

  • Provided by an internet service provider
  • Provided by an organization
  • Configured manually
  • Provided by another DNS service

The resolver's job is to find the answer for the client.

Step 5: Resolver Checks Its Cache

The recursive resolver may already have the requested information cached from a previous query.

If the cached record is still valid according to its TTL and caching rules, the resolver can immediately return the answer.

Client
  |
  v
Resolver
  |
  +---- Cached Answer? ---- Yes ----> Return
  |
  No
  |
  v
Continue DNS Resolution
  

Step 6: Resolver Queries the DNS Hierarchy

If the resolver does not have a usable cached answer, it can query the DNS hierarchy.

The hierarchy can involve:

  1. Root DNS servers
  2. Top-level domain servers
  3. Authoritative DNS servers

Step 7: Resolver Contacts a Root Server

The root system is at the top of the DNS hierarchy.

Suppose the resolver needs information for:

www.example.com
  

The root does not normally return the final IP address of the website.

Instead, it can direct the resolver toward the appropriate top-level-domain infrastructure, such as the infrastructure responsible for .com.

Resolver
   |
   v
Root
   |
   v
.com TLD Servers
  

Step 8: Resolver Queries the TLD Infrastructure

Next, the recursive resolver can query the DNS servers responsible for the relevant top-level domain.

For:

www.example.com
  

the relevant TLD is:

.com
  

The TLD infrastructure can provide information about the authoritative nameservers for the relevant domain.

Resolver
   |
   v
.com TLD
   |
   v
Authoritative Nameserver
  

Step 9: Resolver Contacts the Authoritative DNS Server

The resolver can then query an authoritative nameserver for the domain.

The authoritative server contains the DNS information for the zone it serves.

For example, it may return an A record:

www.example.com
A
203.0.113.25
  

Or it may return an AAAA record for IPv6:

www.example.com
AAAA
2001:db8::25
  

Step 10: Resolver Returns the Answer

The recursive resolver sends the result back to the client.

Authoritative DNS
       |
       v
Recursive Resolver
       |
       v
Client
       |
       v
IP Address
  

The client can now use the returned network address to establish a connection to the destination server.

Step 11: Browser Connects to the Server

DNS resolution is only one step in loading a website.

After obtaining the relevant address, the browser still needs to establish the appropriate network and application connections.

For HTTPS, this involves establishing a secure TLS connection before protected HTTP communication takes place.

DNS Resolution
      ↓
IP Address
      ↓
Network Connection
      ↓
TLS (for HTTPS)
      ↓
HTTP Request
      ↓
HTTP Response
      ↓
Website
  

Full DNS Resolution Diagram

                  User
                   |
                   v
                Browser
                   |
                   v
            Local DNS Cache
                   |
              Cache Miss
                   |
                   v
          Recursive Resolver
                   |
              Cache Miss
                   |
                   v
                 Root
                   |
                   v
               TLD DNS
                   |
                   v
          Authoritative DNS
                   |
                   v
             DNS Record
                   |
                   v
          Recursive Resolver
                   |
                   v
                Browser
                   |
                   v
             Web Server
  

What Is Recursive DNS?

A recursive DNS query asks a resolver to obtain the answer on behalf of the client.

The resolver may perform multiple DNS queries before returning the final result.

This is why it is useful to distinguish between:

  • Stub resolver/client: software on the user's system that sends DNS queries.
  • Recursive resolver: DNS service that finds the requested answer.
  • Authoritative server: server that provides authoritative records for a zone.

Recursive Query vs Iterative Query

DNS terminology distinguishes between recursive and iterative query behavior.

Recursive Query

The client asks the recursive resolver to obtain the final answer.

Client
  |
  | "Find the answer for me."
  v
Recursive Resolver
  |
  v
Final Answer
  

Iterative Query

A DNS server can respond with the best information it currently has, such as a referral to another DNS server.

Resolver
   |
   | Query
   v
Root
   |
   | Referral
   v
TLD
   |
   | Referral
   v
Authoritative Server
  

What Is DNS Caching?

DNS caching stores DNS responses temporarily so that future queries can be answered faster without repeating the entire resolution process.

Caching can occur in different places:

  • Browser
  • Operating system
  • Local DNS infrastructure
  • Recursive resolver

Why DNS Caching Matters

Imagine that thousands of users repeatedly ask for the same domain.

Without caching, DNS infrastructure would need to repeatedly perform work to obtain the same information.

With caching:

First Query
Client → Resolver → DNS Hierarchy
                       |
                       v
                    Answer
                       |
                       v
                  Cache Result


Later Query
Client → Resolver → Cached Answer
  

This can reduce DNS traffic and improve response time.

What Is TTL in DNS?

TTL stands for Time to Live.

DNS records contain TTL information that helps caching systems determine how long a response can generally be retained.

For example:

example.com
A
203.0.113.25
TTL: 3600
  

A TTL value of 3600 seconds represents one hour.

What Happens When a DNS Record Changes?

Suppose a website changes from one server address to another.

Before the change:

example.com → 203.0.113.25
  

After the change:

example.com → 198.51.100.50
  

Different recursive resolvers may temporarily return different results because they can have cached copies of the previous record.

As caches expire, new queries retrieve the updated information.

Why DNS Changes Are Not Always Immediate

Suppose a DNS record has a TTL of several hours.

A resolver that cached the old answer may continue using that cached value until its permitted cache lifetime expires.

This is why DNS changes can appear gradually across different networks.

What Is DNS Negative Caching?

DNS systems can also cache negative responses, such as the fact that a particular name does not exist.

This can reduce repeated queries for names that are known not to exist.

Negative caching behavior is controlled by DNS standards and relevant record information.

DNS Resolution and Subdomains

Consider:

api.example.com
  

The DNS system resolves the complete hostname according to the records and delegation configured for the relevant zone.

Different subdomains can point to different destinations:

example.com       → Website
www.example.com   → Website
api.example.com   → API
mail.example.com  → Mail
  

DNS CNAME During Resolution

A hostname may resolve through a CNAME record.

For example:

www.example.com
       |
       | CNAME
       v
app.host.example
       |
       | A / AAAA
       v
IP Address
  

The recursive resolver follows the DNS records as required to obtain the relevant final answer.

DNS Resolution for IPv4

If a client needs an IPv4 address, the resolver can obtain an A record.

www.example.com
       |
       v
A Record
       |
       v
203.0.113.25
  

DNS Resolution for IPv6

If an IPv6 address is requested, an AAAA record can provide it.

www.example.com
       |
       v
AAAA Record
       |
       v
2001:db8::25
  

Modern hosts can use IPv4, IPv6, or both depending on their configuration and network connectivity.

What If DNS Returns Multiple IP Addresses?

A hostname can have multiple address records.

For example:

example.com
A
203.0.113.10

example.com
A
203.0.113.11

example.com
A
203.0.113.12
  

How clients and applications use multiple addresses depends on the operating system, resolver behavior, application, and network architecture.

Multiple records can be part of architectures designed for distribution or redundancy, but DNS alone is not a complete substitute for application-aware load balancing.

DNS Resolution and Web Performance

DNS lookup is one component of the overall time needed to load a website.

A simplified sequence is:

DNS Lookup
    ↓
Connection Establishment
    ↓
TLS Handshake
    ↓
HTTP Request
    ↓
Server Processing
    ↓
Response
  

Good caching and responsive DNS infrastructure can reduce lookup overhead.

DNS Resolution and CDN Architecture

Content delivery networks can use DNS and other routing mechanisms as part of their traffic-distribution architecture.

A simplified example:

User
  |
  v
www.example.com
  |
  v
DNS / CDN Infrastructure
  |
  +------ Edge Location A
  |
  +------ Edge Location B
  |
  +------ Edge Location C
  

The exact routing process depends on the CDN and its architecture.

What Happens When DNS Fails?

If DNS resolution fails, the browser may not be able to determine where to connect.

Possible symptoms include:

  • Website does not open
  • DNS-related browser errors
  • API requests fail
  • Applications cannot connect to services by hostname
  • Email delivery problems

Common DNS Errors

NXDOMAIN

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS infrastructure.

SERVFAIL

SERVFAIL indicates that the DNS server could not successfully complete the query.

Timeout

A timeout can occur when the expected DNS response does not arrive within the relevant period.

Wrong IP Address

A DNS record may exist but point to the wrong destination.

How to Troubleshoot DNS Resolution

DNS troubleshooting should proceed systematically.

Step 1: Check the Hostname

Make sure the domain or subdomain is spelled correctly.

Step 2: Use nslookup

nslookup example.com
  

Step 3: Use dig

dig example.com
  

Step 4: Query Specific Record Types

dig example.com A
dig example.com AAAA
dig example.com CNAME
dig example.com MX
dig example.com TXT
  

Step 5: Identify the Authoritative Nameservers

Check the NS records and query the authoritative servers where appropriate.

Step 6: Check Cached Information

A stale cached answer may explain why different networks see different results.

Step 7: Check the Destination

If DNS returns an address correctly but the website is still unavailable, the problem may be at the network, web server, application, TLS, firewall, or hosting layer instead.

DNS Resolution on Windows

Windows provides the nslookup command for DNS troubleshooting.

nslookup google.com
  

You can also inspect local DNS configuration with:

ipconfig /all
  

To clear the Windows DNS client cache, Windows provides:

ipconfig /flushdns
  

This clears the local DNS resolver cache maintained by the Windows DNS client.

DNS Resolution on Linux

Linux systems can use tools such as:

dig example.com
nslookup example.com
  

Modern Linux distributions can use different DNS resolution components depending on the distribution and configuration.

How to See DNS Resolution in a Browser

Modern browser developer tools can help you inspect network activity, although the exact interface differs by browser.

You can inspect:

  • Request hostname
  • Connection information
  • Timing information
  • Response details

Browser timing tools can help separate DNS lookup time from connection and server-response time.

DNS Resolution and Cybersecurity

DNS resolution is also important in cybersecurity.

Security teams can use DNS logs to investigate suspicious activity.

Examples include:

  • Unexpected domain lookups
  • Known malicious domains
  • Unusual query volumes
  • Suspicious newly registered domains
  • Unexpected external connections

DNS filtering can also block requests to categories of known malicious or unwanted domains.

DNS Resolution and DNSSEC

DNSSEC can allow validating resolvers to verify the authenticity and integrity of signed DNS data.

A simplified concept is:

DNS Data
   |
Cryptographic Signature
   |
   v
Resolver Validation
   |
   +---- Valid ----> Accept
   |
   +---- Invalid --> Reject / Error
  

DNSSEC does not encrypt normal DNS queries. Its purpose is different from transport encryption technologies such as DNS over HTTPS or DNS over TLS.

DNS Resolution vs DNS Propagation

These terms are related but should not be treated as identical.

DNS Resolution DNS Propagation
Process of obtaining DNS information Common term for the period during which caches around the internet may still contain previous information after a change
Happens for DNS queries Becomes noticeable after DNS changes

DNS Resolution Example

Imagine a user opens:

https://api.example.com/users
  

The hostname is:

api.example.com
  

A simplified resolution path could be:

api.example.com
      ↓
Browser Cache
      ↓
OS Cache
      ↓
Recursive Resolver
      ↓
Root
      ↓
.com TLD
      ↓
Authoritative DNS
      ↓
A / AAAA Record
      ↓
IP Address
      ↓
HTTPS Connection
      ↓
/users API Endpoint
  

This illustrates an important point: DNS resolves the hostname; DNS does not process the HTTP API request itself.

What DNS Does Not Do

DNS is sometimes misunderstood as a system that handles the entire internet connection.

DNS does not itself:

  • Render a website
  • Process your application's business logic
  • Replace HTTP
  • Replace HTTPS
  • Act as a database for application records
  • Guarantee that a website is secure

Its primary role is naming and DNS information resolution.

DNS Resolution Interview Questions

What is DNS resolution?

DNS resolution is the process of obtaining DNS information for a hostname, often an IP address.

What is a recursive DNS resolver?

A recursive resolver obtains DNS answers on behalf of clients, using cached information or querying other DNS infrastructure as necessary.

What is an authoritative DNS server?

An authoritative server provides the authoritative DNS records for a zone.

What is the role of a root DNS server?

The root DNS system helps direct DNS queries toward the appropriate top-level-domain infrastructure.

What is the role of a TLD DNS server?

TLD DNS infrastructure helps a resolver locate the authoritative nameservers for domains under a particular top-level domain.

What is DNS caching?

DNS caching temporarily stores DNS responses so they can be reused for future queries.

What is TTL?

TTL specifies how long DNS information can generally remain cached before needing refresh according to DNS caching behavior.

Why does DNS resolution sometimes take longer?

Resolution time can be affected by cache misses, network latency, resolver performance, DNS infrastructure availability, and the number of queries required.

What is NXDOMAIN?

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS system.

What is DNSSEC?

DNSSEC adds cryptographic signatures that allow validating resolvers to verify the authenticity and integrity of DNS data.

Frequently Asked Questions

```

How does DNS resolution work?

A client first checks available local information and then typically asks a recursive resolver. If necessary, the resolver queries the DNS hierarchy, including root, TLD, and authoritative DNS infrastructure, before returning the answer.

How long does DNS resolution take?

It varies. Cached responses can be very fast, while cache misses may require additional network queries.

What happens if DNS resolution fails?

The client may be unable to connect to the hostname. Depending on the failure, tools or browsers may report errors such as NXDOMAIN, SERVFAIL, or timeout-related failures.

What is the difference between recursive and authoritative DNS?

A recursive resolver finds answers for clients, while an authoritative server provides authoritative DNS records for the zones it serves.

Does DNS resolution happen every time I open a website?

Not necessarily. Browser, operating-system, local-network, and recursive-resolver caches can prevent a full DNS lookup from occurring every time.

Can DNS return more than one IP address?

Yes. A hostname can have multiple A or AAAA records.

Does DNS resolution use TCP or UDP?

Traditional DNS commonly uses UDP and can also use TCP. The exact transport depends on the query and DNS communication requirements.

Is DNS secure?

Traditional DNS does not encrypt ordinary queries. Security and privacy can be improved using technologies such as DNSSEC, DNS over HTTPS, or DNS over TLS, each serving different purposes.

```

Final Thoughts

DNS resolution is one of the hidden processes that happens whenever software needs to translate a hostname into useful network information.

The simplified path to remember is:

Hostname
   ↓
Local Cache
   ↓
Recursive Resolver
   ↓
Root
   ↓
TLD
   ↓
Authoritative DNS
   ↓
IP Address / DNS Answer
   ↓
Network Connection
  

The most important concepts are recursive resolvers, authoritative DNS, root servers, TLD servers, DNS records, caching, TTL, CNAME, A/AAAA records, and DNS troubleshooting.

Once you understand DNS resolution, many concepts in web hosting, cloud computing, APIs, cybersecurity, Linux administration, and DevOps become easier to understand.

CodeWithAV Networking Tip:

When a website is not opening, separate the problem into layers: DNS → network connectivity → TLS/HTTPS → web server → application → database. This makes troubleshooting much more systematic.

Related Articles on CodeWithAV

What Is DNS? Complete Beginner Guide

What Is the Internet and How Does It Work?

What Happens When You Type a URL?

HTTP vs HTTPS Explained

HTTP Status Codes Every Developer Should Know

Explore More Networking and Web Development Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

What Is DNS? Complete Domain Name System Guide for Beginners

Every time you open a website such as example.com, your browser eventually needs to communicate with a server identified by an IP address.

But humans generally prefer remembering names rather than numerical addresses.

This is where DNS comes in.

Simple Definition: DNS stands for Domain Name System. It translates domain names such as example.com into IP addresses and also provides other information used to locate and route services on the internet.

DNS is one of the fundamental systems behind the internet. Without it, users would have to remember IP addresses for many websites and online services.

What Does DNS Do?

At its simplest, DNS helps map a domain name to information needed to reach a service.

For example:

www.example.com
       |
       | DNS lookup
       v
203.0.113.25
  

The browser can then use the resulting address to establish network communication with the destination.

DNS can also provide other records, such as information about mail servers, aliases, and domain verification.

Why Do We Need DNS?

Computers communicate using network addresses, while websites are easier for humans to remember using domain names.

Imagine having to remember an IP address for every website you use:

Website A → 203.0.113.25
Website B → 198.51.100.42
Website C → 192.0.2.10
  

Remembering names is much easier:

example.com
blog.example.com
api.example.com
  

DNS provides the translation and service-discovery layer between human-friendly names and network infrastructure.

DNS in One Simple Diagram

User enters:

https://www.example.com

        |
        v

      Browser
        |
        v

    DNS Resolver
        |
        v

   DNS Infrastructure
        |
        v

    IP Address
        |
        v

   Web Server
        |
        v

   Website
  

What Is a Domain Name?

A domain name is a human-readable name used to identify a domain in the DNS namespace.

Examples include:

  • example.com
  • google.com
  • github.com
  • codewithav.blogspot.com

A domain name can contain multiple labels separated by dots.

Understanding a Domain Name

Consider:

www.example.com
  

It can be viewed as:

www      . example . com
 |            |       |
 |            |       +-- Top-Level Domain
 |            +---------- Domain label
 +----------------------- Subdomain
  

Subdomain

www can be a subdomain label.

Other examples include:

blog.example.com
api.example.com
mail.example.com
  

Domain

example is the domain label in this simplified breakdown.

Top-Level Domain

.com is the top-level domain, commonly called a TLD.

What Is a TLD?

TLD stands for Top-Level Domain.

Common examples include:

  • .com
  • .org
  • .net
  • .edu
  • .gov
  • .in

There are many other generic and country-code top-level domains.

What Is DNS Resolution?

DNS resolution is the process of finding DNS information associated with a domain name.

When your browser needs to connect to a hostname, the system may perform a DNS lookup to find the relevant address.

A simplified flow is:

Domain Name
     ↓
Local Cache
     ↓
DNS Resolver
     ↓
Root DNS
     ↓
TLD DNS
     ↓
Authoritative DNS
     ↓
DNS Answer
     ↓
Client
  

In real systems, caching can cause some of these steps to be skipped because the resolver may already know the answer.

What Happens During a DNS Lookup?

Let's imagine that you enter:

https://www.example.com
  

Your system needs to determine the network address for www.example.com.

Step 1: Browser Cache

The browser may have recently resolved the hostname and may have cached the result.

Step 2: Operating System Cache

The operating system may also have cached DNS information.

Step 3: DNS Resolver

If no usable cached answer is available locally, the query can be sent to a recursive DNS resolver.

Step 4: Resolver Finds the Answer

The resolver can query the DNS hierarchy when it needs to obtain the answer.

Step 5: Result Is Returned

The resolver returns the DNS response to the client and may cache it according to applicable caching rules.

What Is a DNS Resolver?

A DNS resolver, often called a recursive resolver, receives DNS queries from clients and works to find the requested DNS information.

It can communicate with other DNS servers on behalf of the client.

Your Computer
      |
      v
Recursive DNS Resolver
      |
      +---- Root
      |
      +---- TLD
      |
      +---- Authoritative DNS
      |
      v
Answer
  

Resolvers also commonly maintain caches to reduce repeated DNS lookups.

What Is an Authoritative DNS Server?

An authoritative DNS server is a DNS server that provides the authoritative information for a particular DNS zone.

For example, an authoritative server for a domain can hold records such as:

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS

When a recursive resolver reaches the authoritative source for a domain, it can obtain the relevant DNS record.

Recursive Resolver vs Authoritative DNS Server

Recursive Resolver Authoritative Server
Finds DNS answers for clients Provides authoritative DNS data
Uses caching Hosts zone data
May contact multiple DNS servers Answers for zones it serves

What Is the DNS Root?

At the top of the DNS hierarchy is the root.

The root DNS system helps direct queries toward the appropriate top-level domain infrastructure.

                    Root
                      |
          +-----------+-----------+
          |           |           |
         .com        .org        .in
          |           |           |
          v           v           v
       Domains     Domains     Domains
  

The root system does not normally contain the final IP address for every website. Instead, it helps resolvers discover where information for the relevant TLD can be found.

What Is a TLD DNS Server?

A TLD DNS server handles DNS information for domains under a particular top-level domain.

For example, .com DNS infrastructure helps resolvers locate authoritative nameservers for domains ending in .com.

What Is a DNS Zone?

A DNS zone is an administrative portion of the DNS namespace for which a set of authoritative records is maintained.

A zone can contain records describing how domain names should be resolved.

What Are DNS Records?

DNS records are pieces of information stored in DNS zones.

Different record types serve different purposes.

Important DNS Record Types

A Record

An A record maps a hostname to an IPv4 address.

example.com → 203.0.113.25
  

AAAA Record

An AAAA record maps a hostname to an IPv6 address.

example.com → 2001:db8::25
  

CNAME Record

A CNAME record creates an alias from one hostname to another hostname.

www.example.com
       ↓
example.com
  

CNAME records point to another domain name rather than directly to an IP address.

MX Record

MX records specify mail servers responsible for receiving email for a domain.

example.com
     |
     v
MX
     |
     v
mail.example.com
  

TXT Record

TXT records contain text data associated with a domain.

They are commonly used for purposes such as domain verification and email-related policies.

NS Record

NS records identify authoritative nameservers for a DNS zone.

PTR Record

PTR records are used for reverse DNS, mapping an IP address to a hostname.

DNS Record Comparison

Record Purpose
A Hostname → IPv4 address
AAAA Hostname → IPv6 address
CNAME Hostname alias → another hostname
MX Mail server information
TXT Text-based domain information
NS Authoritative nameservers
PTR Reverse DNS mapping

What Is a Nameserver?

A nameserver is a DNS server that answers DNS queries for a domain or zone.

When you register a domain, the domain's delegation includes nameserver information indicating which authoritative DNS servers are responsible for the domain.

A domain might use nameservers such as:

ns1.example-dns.com
ns2.example-dns.com
  

DNS Delegation

DNS delegation is the process through which responsibility for a portion of the DNS namespace is delegated to authoritative nameservers.

For example:

Root
  ↓
.com
  ↓
example.com
  ↓
Authoritative Nameservers
  

This hierarchical structure allows DNS information to be distributed rather than stored in one enormous database.

What Is DNS Caching?

DNS caching means temporarily storing DNS responses so they can be reused for future requests.

Caching can occur at multiple levels, including:

  • Browser
  • Operating system
  • Local network
  • Recursive resolver

Caching reduces repeated queries and can improve response time.

What Is TTL in DNS?

TTL stands for Time to Live.

In DNS, TTL specifies how long a cached DNS record can generally be retained before it needs to be refreshed according to DNS caching behavior.

For example:

example.com
A
203.0.113.25
TTL: 3600
  

A TTL of 3600 seconds represents one hour.

Why Does DNS Propagation Take Time?

When a DNS record changes, users may not immediately see the new result everywhere because different recursive resolvers can have cached versions of the previous record.

The time required for caches to refresh depends on factors such as the previous TTL and resolver behavior.

This is commonly described as DNS propagation, although DNS changes are essentially being observed as cached information expires and new information is obtained.

What Is Reverse DNS?

Normal DNS commonly maps a hostname to an IP address.

example.com
     ↓
203.0.113.25
  

Reverse DNS performs the opposite type of lookup:

203.0.113.25
     ↓
hostname.example.com
  

Reverse DNS commonly uses PTR records.

DNS and Email

DNS is not only used for websites.

Email systems rely heavily on DNS records.

MX records tell sending mail systems which servers are responsible for receiving mail for a domain.

TXT records can also be used for email-related authentication and policy mechanisms such as SPF, DKIM, and DMARC configurations.

DNS and Subdomains

A single domain can have multiple subdomains.

example.com

├── www.example.com
├── blog.example.com
├── api.example.com
├── mail.example.com
└── shop.example.com
  

Each hostname can have its own DNS records and can point to different services.

DNS and Cloud Computing

DNS plays an important role in cloud environments.

Applications may use DNS for:

  • Websites
  • APIs
  • Load balancers
  • Microservices
  • Cloud storage endpoints
  • Email systems
  • Service discovery

A production architecture might look like:

User
  |
  v
DNS
  |
  v
Load Balancer
  |
  +--------+--------+
  |        |        |
  v        v        v
App 1    App 2    App 3
  |
  v
Database
  

DNS and CDNs

DNS can also be part of how users are directed toward content delivery infrastructure.

Depending on the architecture, DNS can direct users to services that then route traffic through geographically distributed systems or edge infrastructure.

DNS and Cybersecurity

DNS is a major part of security monitoring because malicious infrastructure can use domains and DNS records to support phishing, malware distribution, command-and-control infrastructure, and other attacks.

Security teams may monitor:

  • Suspicious domains
  • Unexpected DNS changes
  • Abnormal DNS query patterns
  • Newly observed domains
  • Large volumes of DNS requests

DNS filtering can also be used as one layer of defensive security.

What Is DNS Spoofing?

DNS spoofing refers broadly to attacks in which false DNS information is supplied to redirect users or systems.

Depending on the attack, a victim may be directed toward an attacker-controlled destination instead of the intended service.

DNS security therefore depends on proper resolver configuration, DNS infrastructure protection, and additional security mechanisms.

What Is DNS Cache Poisoning?

DNS cache poisoning is an attack in which incorrect DNS information is placed into a resolver's cache so that users can receive a fraudulent DNS answer.

Modern DNS infrastructure incorporates mechanisms intended to make such attacks more difficult, and DNSSEC can provide additional authenticity protections for DNS data.

What Is DNSSEC?

DNSSEC stands for Domain Name System Security Extensions.

DNSSEC adds cryptographic signatures to DNS data so resolvers that perform validation can verify that the DNS response originated from the expected DNS data chain and was not improperly modified.

DNSSEC helps address the authenticity and integrity of DNS data.

It does not encrypt ordinary DNS queries or provide general website encryption. HTTPS serves a different purpose.

DNS vs HTTPS

DNS HTTPS
Resolves domain information Protects HTTP communication
Helps locate network services Provides TLS encryption and authentication for web communication
Uses DNS protocols and records Uses HTTP over TLS

What Is DNS over HTTPS?

DNS over HTTPS (DoH) is a method of sending DNS queries through HTTPS.

This can protect the DNS query from being exposed as ordinary plaintext to network observers on the path between the client and the DoH server.

It is different from DNSSEC:

  • DNSSEC focuses on authenticity and integrity of DNS data.
  • DoH transports DNS queries and responses through HTTPS.

What Is DNS over TLS?

DNS over TLS (DoT) is another approach for protecting DNS traffic in transit by sending DNS through a TLS connection.

DoH and DoT solve related transport-privacy problems using different protocols and deployment models.

DNS Ports

Traditional DNS commonly uses UDP port 53.

DNS can also use TCP port 53, including for cases where TCP is required by the protocol or DNS data exchange.

Other DNS-related technologies use different ports. For example, DNS over TLS commonly uses TCP port 853.

How to Check DNS Records

You can inspect DNS information using command-line tools.

Windows nslookup

nslookup example.com
  

Linux dig

dig example.com
  

You can also query specific record types.

dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com TXT
  

Example DNS Lookup Using nslookup

A simplified command is:

nslookup example.com
  

The response can contain information such as the DNS server used and the returned address records.

The exact output depends on the operating system and DNS environment.

Common DNS Problems

1. NXDOMAIN

NXDOMAIN indicates that the queried domain name does not exist according to the responding DNS system.

2. SERVFAIL

SERVFAIL indicates that the DNS server could not successfully complete the query.

Potential causes can include DNSSEC validation issues, upstream failures, or authoritative configuration problems.

3. DNS Timeout

A DNS timeout can occur when the client or resolver does not receive an expected response within the relevant period.

4. Incorrect A or AAAA Record

If an A or AAAA record points to the wrong destination, visitors may be directed to the wrong server.

5. Incorrect Nameservers

If domain delegation points to the wrong nameservers, the intended DNS zone may not be used.

6. Stale Cached Information

Resolvers may temporarily return previously cached information until it expires according to TTL and caching behavior.

How to Troubleshoot DNS Problems

A practical troubleshooting sequence is:

  1. Check the domain name for spelling mistakes.
  2. Query the domain using nslookup or dig.
  3. Check the authoritative nameservers.
  4. Inspect A, AAAA, CNAME, MX, and TXT records as appropriate.
  5. Check the TTL and whether cached information may be involved.
  6. Test using a different recursive resolver.
  7. Check DNSSEC configuration when relevant.
  8. Verify that the destination server is actually reachable.

DNS and Website Hosting

When you connect a domain name to a website, DNS is usually part of the configuration.

A simplified setup might be:

Domain
example.com
     |
     v
DNS A Record
     |
     v
Web Server IP
     |
     v
Website
  

For some hosting platforms, other DNS configurations such as CNAME records or provider-specific records may be required.

DNS and Custom Domains

Suppose you want to connect a custom domain to a blog or web application.

The hosting platform may tell you to create one or more DNS records.

Depending on the platform, these could include:

  • A records
  • AAAA records
  • CNAME records
  • TXT verification records

The exact records should always come from the hosting provider's current documentation.

DNS and Subdomain Architecture

A single domain can provide separate services through subdomains.

example.com
   |
   +-- www.example.com → Website
   |
   +-- api.example.com → Backend API
   |
   +-- app.example.com → Web Application
   |
   +-- mail.example.com → Mail Service
  

This is common in modern application architectures.

DNS and Load Balancing

DNS can participate in traffic distribution, although the actual load-balancing behavior depends on the architecture and service involved.

A DNS name may resolve to infrastructure such as a load balancer rather than directly to an individual application server.

api.example.com
       |
       v
Load Balancer
   /    |    \
  v     v     v
App1  App2  App3
  

Important DNS Concepts to Remember

Concept Simple Explanation
DNS System for resolving domain names and related DNS information
Resolver Finds DNS answers for clients
Authoritative Server Provides authoritative records for a DNS zone
A Record Hostname to IPv4 address
AAAA Record Hostname to IPv6 address
CNAME Alias from one hostname to another
MX Mail server information
TXT Text-based DNS information
TTL Caching lifetime for DNS information

Frequently Asked Questions

```

What is DNS in simple words?

DNS is the system that helps translate domain names into information such as IP addresses so computers can locate network services.

What does DNS stand for?

DNS stands for Domain Name System.

Why is DNS needed?

DNS lets people use memorable domain names instead of having to remember numerical network addresses for websites and other services.

What is DNS resolution?

DNS resolution is the process of finding the DNS information associated with a queried domain name.

What is a DNS resolver?

A DNS resolver receives queries from clients and works to find the appropriate DNS answer, often using cached information and other DNS servers.

What is an authoritative DNS server?

An authoritative DNS server provides the official DNS records for the zones it serves.

What is an A record?

An A record maps a hostname to an IPv4 address.

What is an AAAA record?

An AAAA record maps a hostname to an IPv6 address.

What is a CNAME record?

A CNAME record creates an alias from one hostname to another hostname.

What is an MX record?

An MX record identifies mail servers responsible for receiving email for a domain.

What is TTL in DNS?

TTL, or Time to Live, indicates how long DNS information can generally remain cached before it should be refreshed.

What is DNS propagation?

DNS propagation commonly refers to the time during which different DNS caches still contain previous information after a DNS change.

What is DNSSEC?

DNSSEC is a set of DNS extensions that uses cryptographic signatures to help validating resolvers verify the authenticity and integrity of DNS data.

What is the difference between DNS and HTTPS?

DNS helps resolve domain information, while HTTPS protects web communication using TLS.

What port does DNS use?

Traditional DNS commonly uses port 53 over UDP and can also use TCP. Other protected DNS methods use different transports and ports.

```

Final Thoughts

DNS is one of the most important systems behind the internet.

It provides the naming and discovery mechanism that allows people to use names such as example.com while network infrastructure works with addresses and other machine-readable information.

For developers, network engineers, system administrators, cloud engineers, and cybersecurity learners, DNS fundamentals are essential.

Start by understanding domains, resolvers, authoritative servers, DNS hierarchy, A and AAAA records, CNAME, MX, TXT, nameservers, TTL, caching, and DNS troubleshooting.

CodeWithAV Networking Learning Path:

Domain Names → DNS Resolution → Resolvers → Root → TLD → Authoritative DNS → A/AAAA → CNAME → MX/TXT → TTL & Caching → DNSSEC → DNS Troubleshooting.

Related Articles on CodeWithAV

What Is the Internet and How Does It Work?

What Happens When You Type a URL?

How a Website Works From Browser to Server

HTTP vs HTTPS Explained

HTTP Status Codes Every Developer Should Know

Explore More Networking and Web Development Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.

HTTP Status Codes Explained: 40+ HTTP Status Codes Every Developer Should Know

When a browser opens a website or an application sends a request to an API, the server returns an HTTP response. One of the most important pieces of that response is the HTTP status code.

You have probably seen codes such as 200 OK, 404 Not Found, 401 Unauthorized, or 500 Internal Server Error.

These codes help clients, developers, monitoring systems, and API consumers understand what happened to a request.

Simple Definition: An HTTP status code is a three-digit number returned by an HTTP server to indicate the result or current state of a request.

Why Are HTTP Status Codes Important?

Status codes provide a standardized way for servers to communicate outcomes.

For example:

GET /api/users/25
        |
        v
   HTTP Server
        |
        v
200 OK
  

A client can use the status code to decide whether a request succeeded, requires another action, failed because of invalid input, or failed because of a server-side problem.

The Five Main HTTP Status Code Classes

HTTP status codes are grouped into five classes based on their first digit.

Range Class General Meaning
100–199 Informational Request received or processing information
200–299 Success Request was successfully handled
300–399 Redirection Further action may be required
400–499 Client Error Request could not be fulfilled due to a client-side issue
500–599 Server Error Server encountered a problem processing the request

HTTP Status Codes Cheat Sheet

Code Meaning Common Use
100ContinueInterim response
101Switching ProtocolsProtocol upgrade
200OKSuccessful request
201CreatedResource created
202AcceptedRequest accepted for processing
204No ContentSuccessful response without a body
301Moved PermanentlyPermanent redirect
302FoundTemporary redirect
304Not ModifiedConditional request has no newer representation
307Temporary RedirectTemporary redirect preserving method
308Permanent RedirectPermanent redirect preserving method
400Bad RequestMalformed or invalid request
401UnauthorizedAuthentication required or failed
403ForbiddenRequest understood but not permitted
404Not FoundResource not found
405Method Not AllowedHTTP method not supported for resource
408Request TimeoutServer timed out waiting for request
409ConflictConflict with resource state
410GoneResource intentionally no longer available
413Content Too LargeRequest body exceeds permitted size
415Unsupported Media TypeUnsupported request format
422Unprocessable ContentContent understood but cannot be processed
429Too Many RequestsRate limit exceeded
500Internal Server ErrorUnexpected server failure
501Not ImplementedServer does not support required functionality
502Bad GatewayGateway received an invalid upstream response
503Service UnavailableService temporarily unavailable
504Gateway TimeoutGateway timed out waiting for upstream

1xx Informational Status Codes

100-level status codes are informational responses. They generally indicate that the request has been received and processing can continue.

100 Continue

The server indicates that the initial part of the request has been received and the client can continue sending the request.

101 Switching Protocols

This response indicates that the server agrees to switch to a different protocol according to the client's request.



2xx Success Status Codes

200-level status codes indicate successful handling of a request.

200 OK

200 OK is one of the most commonly encountered HTTP status codes.

It generally indicates that the request was successfully processed.

Example:

GET /api/users/25

HTTP/1.1 200 OK
  

201 Created

201 Created indicates that a new resource has been created successfully.

It is commonly used after POST requests that create resources.

POST /api/users

HTTP/1.1 201 Created
  

202 Accepted

202 Accepted indicates that the request has been accepted for processing, but processing may not be complete yet.

This can be useful for asynchronous operations.

204 No Content

204 No Content indicates successful processing when the response does not need to contain a message body.

For example, an API might return 204 after successfully deleting a resource.

3xx Redirection Status Codes

300-level status codes indicate that additional action may be required to complete a request.

301 Moved Permanently

301 indicates that a resource has been permanently moved to a different location.

Example:

https://example.com/old-page
        ↓
https://example.com/new-page
  

302 Found

302 Found indicates a temporary redirection in modern HTTP usage.

304 Not Modified

304 Not Modified is used with conditional requests. It tells the client that its cached representation can still be used because the resource has not changed according to the request's conditions.

307 Temporary Redirect

307 Temporary Redirect indicates a temporary redirect while preserving the request method and request body semantics.

308 Permanent Redirect

308 Permanent Redirect indicates a permanent redirect while preserving the request method and request body semantics.

4xx Client Error Status Codes

400-level responses generally indicate a problem with the request from the client side. That does not necessarily mean the person using the client made a mistake; it means the request cannot be fulfilled due to the request or its context.

400 Bad Request

400 Bad Request is commonly returned when the server cannot process a malformed or invalid request.

Example:

POST /api/users

{
  "email": 
}
  

The request body is malformed, so the server may return 400.

401 Unauthorized

401 Unauthorized is commonly used when valid authentication credentials are required but are missing or invalid.

Example:

GET /api/profile

HTTP/1.1 401 Unauthorized
  

Important: The name can be confusing. In API security discussions, 401 generally relates to authentication, not simply permission.

403 Forbidden

403 Forbidden indicates that the server understood the request but refuses to authorize it.

For example, a normal user may authenticate successfully but still receive 403 when trying to access an administrator-only resource.

404 Not Found

404 Not Found means that the server cannot find a current representation for the requested resource.

Example:

GET /api/users/99999

404 Not Found
  

405 Method Not Allowed

405 Method Not Allowed indicates that the request method is known by the server but is not allowed for the requested resource.

For example, an endpoint might support GET but not DELETE.

408 Request Timeout

408 Request Timeout indicates that the server did not receive a complete request within the time it was prepared to wait.

409 Conflict

409 Conflict indicates that the request conflicts with the current state of the target resource.

For example, an API could use 409 when attempting to create a resource that conflicts with an existing unique record, depending on the API design.

410 Gone

410 Gone indicates that the requested resource is no longer available and that the condition is likely to be permanent.

413 Content Too Large

413 Content Too Large indicates that the request content exceeds a limit defined by the server.

This can occur when uploading a file or sending a large request body.

415 Unsupported Media Type

415 Unsupported Media Type indicates that the server does not support the media format of the request.

For example, an endpoint expecting JSON might reject an unsupported request format.

422 Unprocessable Content

422 Unprocessable Content indicates that the server understood the content type and syntax but could not process the contained instructions or data.

For example, a request might contain valid JSON but fail application-level validation.

429 Too Many Requests

429 Too Many Requests is commonly used when the client has sent too many requests within a defined period.

This is especially relevant to APIs that implement rate limiting.

5xx Server Error Status Codes

500-level status codes generally indicate a problem on the server side while processing a valid request.

500 Internal Server Error

500 indicates an unexpected server-side error.

Example:

GET /api/orders

HTTP/1.1 500 Internal Server Error
  

Possible causes include:

  • Unhandled application exceptions
  • Unexpected dependency failures
  • Programming errors
  • Configuration problems

501 Not Implemented

501 Not Implemented indicates that the server does not support the functionality required to fulfill the request.

502 Bad Gateway

502 Bad Gateway usually occurs when a server acting as a gateway or proxy receives an invalid response from an upstream server.

Client
  |
  v
Reverse Proxy
  |
  v
Application Server
  |
  X
Invalid / Failed Response

Proxy → 502
  

503 Service Unavailable

503 Service Unavailable indicates that the server is currently unable to handle the request, often due to temporary overload, maintenance, or another temporary condition.

504 Gateway Timeout

504 Gateway Timeout indicates that a gateway or proxy did not receive a timely response from an upstream server.

Client
  |
  v
Gateway
  |
  v
Backend
  |
  |
  |------ No timely response
  |
Gateway → 504
  

401 vs 403: What Is the Difference?

This is one of the most common interview questions.

401 403
Authentication is missing or invalid Request is understood but not authorized
Identity has not been successfully established Identity may be known, but access is denied
Example: expired or missing credentials Example: normal user requesting admin-only data

404 vs 410

Both codes relate to missing resources, but their meaning differs.

404 Not Found indicates that the server cannot find a current representation for the resource.

410 Gone indicates that the resource is no longer available and that this is intended to be permanent.

500 vs 502 vs 503 vs 504

Code Typical Problem
500 Unexpected internal server problem
502 Gateway/proxy received an invalid upstream response
503 Service temporarily unavailable
504 Gateway/proxy timed out waiting for upstream

HTTP Status Codes in REST APIs

Correct status codes make REST APIs easier to understand and consume.

For example:

GET    /users/10      → 200
POST   /users         → 201
PATCH  /users/10      → 200 or 204
DELETE /users/10      → 204
GET    /users/999     → 404
POST   /users         → 400 / 422
GET    /admin/report  → 401 / 403
GET    /users         → 429
GET    /users         → 500
  

The exact status selected depends on the semantics of the API and its application rules.

HTTP Status Codes and Frontend Applications

Frontend applications can use status codes to decide what to display or what action to perform.

For example:

if (response.status === 200) {
    // Show data
}

if (response.status === 401) {
    // Ask user to log in
}

if (response.status === 403) {
    // Show access denied message
}

if (response.status === 404) {
    // Show not found message
}

if (response.status === 500) {
    // Show generic server error
}
  

This allows applications to handle different outcomes more intelligently.

HTTP Status Codes and JavaScript Fetch

One important detail is that the Fetch API does not automatically reject a promise merely because an HTTP response has a 4xx or 5xx status.

Developers should inspect the response status or the ok property.

fetch("/api/users")
  .then(response => {
    if (!response.ok) {
      throw new Error(`HTTP ${response.status}`);
    }

    return response.json();
  })
  .then(data => {
    console.log(data);
  })
  .catch(error => {
    console.error(error);
  });
  

HTTP Status Codes and API Error Handling

A good API should combine an appropriate status code with a useful response body when additional information is appropriate.

For example:

HTTP/1.1 422 Unprocessable Content
Content-Type: application/json

{
  "error": "validation_error",
  "message": "Email address is invalid",
  "field": "email"
}
  

This is generally more useful to a frontend than returning only a number.

Should You Use 200 for Every API Response?

Using 200 for every situation is generally a poor API design choice.

Status codes exist to communicate meaningful outcomes.

For example, returning 200 for a failed authentication attempt makes it harder for clients, monitoring tools, developers, and intermediaries to understand what happened.

Use status codes according to the semantics of the operation and your API design.

How Developers Debug HTTP Status Codes

When an application returns an unexpected status code, inspect the complete request and response.

Useful information includes:

  • HTTP method
  • Request URL
  • Request headers
  • Request body
  • Status code
  • Response headers
  • Response body
  • Server logs
  • Reverse-proxy logs
  • Application logs

Browser developer tools, Postman, curl, server logs, and monitoring systems can all help identify the cause.

Example: Debugging a 404

Suppose your frontend requests:

GET /api/user/25
  

but the API actually defines:

GET /api/users/25
  

The difference between user and users could result in a 404.

Always check the actual endpoint, routing configuration, base URL, and deployment environment.

Example: Debugging a 401

Suppose a protected endpoint returns 401.

Check:

  1. Whether credentials were included.
  2. Whether the credentials are valid.
  3. Whether the expected authentication scheme was used.
  4. Whether the token has expired.
  5. Whether the server received the authentication header.

Example: Debugging a 403

If authentication succeeds but the server returns 403, inspect authorization rules.

Common questions include:

  • Does the user have the required role?
  • Does the account have the required permission?
  • Is the requested resource restricted?
  • Is a policy blocking the action?

Example: Debugging a 502

A 502 often points to a problem between a proxy and an upstream service.

Browser
   |
   v
Nginx / Reverse Proxy
   |
   v
Node.js / Python / PHP Backend
  

Possible causes can include:

  • Backend process stopped
  • Incorrect upstream address
  • Connection failure
  • Malformed upstream response
  • Deployment problem

Example: Debugging a 503

A 503 can indicate that a service is temporarily unavailable.

Possible causes include:

  • Maintenance
  • Application overload
  • Unavailable backend service
  • Health-check failure
  • Deployment transition

Example: Debugging a 504

A 504 usually means a gateway or proxy waited for an upstream response but did not receive one within the relevant timeout.

Investigate:

  • Backend response time
  • Database performance
  • Network connectivity
  • Proxy timeout configuration
  • Long-running operations

HTTP Status Codes Interview Questions

What does HTTP 200 mean?

It generally means that the request was successfully processed.

What does HTTP 201 mean?

It indicates that a resource was successfully created.

What does HTTP 204 mean?

It indicates successful processing with no response content.

What does HTTP 301 mean?

It indicates that a resource has been permanently moved to another location.

What does HTTP 304 mean?

It indicates that the client's cached representation can be reused because the resource has not changed according to the conditional request.

What does HTTP 400 mean?

It generally indicates that the server could not process the request because it was invalid or malformed.

What is the difference between 401 and 403?

401 generally relates to missing or invalid authentication, while 403 means the request is understood but access is not permitted.

What does HTTP 404 mean?

It means that the requested resource could not be found.

What does HTTP 429 mean?

It indicates that the client has sent too many requests within a relevant time period.

What does HTTP 500 mean?

It indicates an unexpected internal server error.

What does HTTP 502 mean?

It generally indicates that a gateway or proxy received an invalid response from an upstream server.

What does HTTP 503 mean?

It indicates that the server is currently unable to handle the request, often because of a temporary condition.

What does HTTP 504 mean?

It indicates that a gateway or proxy did not receive a timely response from an upstream server.

Frequently Asked Questions

```

What are HTTP status codes?

HTTP status codes are three-digit numbers returned in HTTP responses to communicate the result or state of a request.

How many categories of HTTP status codes are there?

There are five categories: informational (1xx), success (2xx), redirection (3xx), client error (4xx), and server error (5xx).

Which HTTP status code means success?

200 OK is the most common success status code, although other successful codes such as 201 and 204 are used for specific situations.

Which HTTP status code means not found?

404 Not Found indicates that the server cannot find the requested resource.

What is the difference between 401 and 403?

401 generally indicates an authentication problem, while 403 indicates that the request is not authorized.

What does 429 mean?

429 Too Many Requests indicates that a client has exceeded an applicable request rate limit.

What is the difference between 500 and 503?

500 generally indicates an unexpected internal server error, while 503 indicates that the service is currently unavailable and may recover later.

What causes a 502 error?

A 502 often occurs when a gateway or reverse proxy receives an invalid response from an upstream server.

What causes a 504 error?

A 504 occurs when a gateway or proxy waits for an upstream server but does not receive a response within the relevant timeout.

Are HTTP status codes only used for websites?

No. They are also widely used by APIs, backend services, mobile applications, cloud services, proxies, and other HTTP-based systems.

```

Final Thoughts

HTTP status codes are a fundamental part of web development, backend programming, API design, DevOps, and cybersecurity.

You do not need to memorize every status code immediately. Start with the most useful ones:

200  → Success
201  → Created
204  → No Content

301  → Permanent Redirect
302  → Temporary Redirect
304  → Not Modified

400  → Bad Request
401  → Authentication Problem
403  → Forbidden
404  → Not Found
405  → Method Not Allowed
409  → Conflict
422  → Unprocessable Content
429  → Too Many Requests

500  → Internal Server Error
502  → Bad Gateway
503  → Service Unavailable
504  → Gateway Timeout
  

Once these codes become familiar, debugging web applications and REST APIs becomes much easier.

CodeWithAV Developer Tip:

When debugging an API, never look only at the status code. Inspect the request URL, method, headers, body, response body, server logs, and upstream services together.

Related Articles on CodeWithAV

What Is an API? Complete Beginner Guide

REST API Explained With Examples

What Is JSON?

HTTP vs HTTPS Explained

How a Website Works From Browser to Server

Explore More Web Development and Networking Guides

Disclosure: Some links on CodeWithAV may be affiliate links. If you purchase a product or service through an affiliate link, we may earn a commission at no additional cost to you. We aim to recommend products and services based on their relevance to our readers.

CodeWithAV — Learn, Discover & Build.

Adarsh verma

Adarsh verma

CodeWithAV publishes practical technology tutorials, study resources, programming guides, and cybersecurity learning content.