Domain Name System
The distributed directory translating names to addresses, and the layer where propagation delays live.
The Domain Name System is the distributed database that turns names into addresses. A resolver walks from the root through each label to the authoritative server for the zone, caching results for the duration each record specifies.
Caching is the source of nearly every DNS frustration. A record's time-to-live governs how long resolvers may keep it, so a change is not instant and is not uniform — different people see different answers for a while. Lowering the time-to-live before a planned change is the standard preparation, and it has to happen before, since the old value is already cached.
The common record types are few: an address record, an alias record pointing one name at another, mail routing, and text records used for verification and policy. Provider-specific variants exist to work around the rule that an alias cannot coexist with other records at a zone's apex.
Subdomains are the practically important structure. They are ordinary names under a zone and can point anywhere, which makes them the natural mechanism for multi-tenant systems — each tenant addressed by name, with a wildcard record and a wildcard certificate covering them all. That certificate is usually the part that has to be provisioned deliberately rather than automatically, since proving control of a wildcard requires a DNS-based challenge. See Multi-Tenancy and Same-Origin Policy.
See also12
Port
The numeric endpoint a network service listens on, and a scarce shared resource on a developer machine.
Systems & Tooling19 connections
Cache Invalidation
Deciding when a cached value has stopped being correct — famously one of the hard problems.
Web Platform30 connections
Virtual Private Network
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.
Networks & Distribution22 connections
Caller ID Authentication
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
Networks & Distribution17 connections
eSIM
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
Networks & Distribution12 connections
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling38 connections
Hash Function
A function mapping arbitrary input to a fixed-size digest, used for identity, integrity, and addressing.
Systems & Tooling30 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Multicast DNS
How devices on a local network find each other by name, and discover printers, speakers, and screens, without any server or configuration, by asking everyone at once.
Networks & Distribution8 connections
Top-Level Domain
The last part of a domain name, such as .com or .uk, organized in 1984 into a handful of generic names plus one per country, then opened to over a thousand new names and a source of income for some small nations.
Networks & Distribution7 connections
Loopback
The network address a computer uses to talk to itself, where packets go out and come straight back without touching any hardware, the home of development servers and a recurring blind spot in security.
Networks & Distribution12 connections
Internationalized Domain Name
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
Web Platform10 connections
Linked from24
- AnycastNetworks & Distribution
Anycast announces the same IP address from many locations and lets normal routing send each client to the nearest one.
- Cache InvalidationWeb Platform
Deciding when a cached value has stopped being correct — famously one of the hard problems.
- Caller ID AuthenticationNetworks & Distribution
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
- CAP TheoremData & Content
When a network splits a distributed system, it can stay consistent or stay available, but a proven theorem says not both.
- Certificate AuthorityNetworks & Distribution
An organization trusted to vouch that a public key belongs to a domain or entity, the root of trust behind every HTTPS padlock.
- Content Delivery NetworkNetworks & Distribution
A CDN answers requests from servers near the requester, trading a single origin for many cached edges.
- Denial-of-Service AttackNetworks & Distribution
Making a service unavailable by overwhelming it with traffic or expensive requests, usually from many machines at once, and the layered defenses that absorb or filter the flood.
- DNS over HTTPSNetworks & Distribution
DNS over HTTPS wraps DNS lookups in encrypted HTTPS requests, hiding query contents from anyone but the resolver.
- eSIMNetworks & Distribution
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
- Internationalized Domain NameWeb Platform
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
- IPv6Networks & Distribution
IPv6 exists mainly to end address scarcity, with a large enough space that per-device NAT becomes optional.
- LoopbackNetworks & Distribution
The network address a computer uses to talk to itself, where packets go out and come straight back without touching any hardware, the home of development servers and a recurring blind spot in security.
- Man-in-the-Middle AttackNetworks & Distribution
An attack in which someone secretly sits between two parties, reading or altering what they send, and why authentication, not just encryption, is the defense.
- Multi-TenancyData & Content
One deployment serving many isolated customers, with tenancy threaded through data, routing, and access.
- Multicast DNSNetworks & Distribution
How devices on a local network find each other by name, and discover printers, speakers, and screens, without any server or configuration, by asking everyone at once.
- PortSystems & Tooling
The numeric endpoint a network service listens on, and a scarce shared resource on a developer machine.
- Same-Origin PolicyWeb Platform
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
- Server-Side Request ForgeryWeb Platform
Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.
- SubnetNetworks & Distribution
A block of IP addresses that share a common prefix, written in CIDR notation such as 192.168.1.0/24, which decides what a device can reach directly and what it must send through a router.
- TCP and UDPNetworks & Distribution
TCP guarantees ordered, reliable delivery at the cost of latency; UDP delivers packets fast with no such promise.
- Time to LiveNetworks & Distribution
A limit on how long something may live, counted in hops or seconds, which keeps lost packets from circling forever and tells caches when their copies go stale.
- Top-Level DomainNetworks & Distribution
The last part of a domain name, such as .com or .uk, organized in 1984 into a handful of generic names plus one per country, then opened to over a thousand new names and a source of income for some small nations.
- URLWeb Platform
The address format that names every resource on the web, its parts from scheme to fragment, and why parsing one correctly is harder and more security-relevant than it looks.
- Virtual Private NetworkNetworks & Distribution
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.