Nothing on the internet is delivered to a name. Routers move packets to addresses, and an address is a number. You, on the other hand, are never going to type 142.250.179.174. DNS is the system that turns the one into the other, millions of times a second, and it is invisible until it breaks.
The question your computer asks
Open a page and, before a single byte of that page moves, your computer asks a question: what is the address of this name. It sends that question to a resolver, gets an address back, and only then makes the actual connection.
The resolver is the desk you ask. It is usually your router, sometimes a service like Quad9 or Cloudflare, sometimes a server at your company. Its job is not to know the answer but to find it out for you.
Who answers what
No single machine holds the list of all names. The list is cut up by the dots, read from the right, and different organisations are responsible for the parts.
Take www.example.nl. If the resolver knows nothing at all, it asks in three steps.
- A root server: who looks after
.nl? Answer: these machines do. - Those machines: who looks after
example.nl? Answer: these two name servers. - Those name servers: what is the address of
www.example.nl? Answer: the address.
The last ones in that chain are the authoritative servers. They do not look anything up. They hold the actual records for that domain, put there by whoever owns it. Everything above them only points further down.
This is why a change to a domain is never instant, and why a new domain sometimes works for your colleague and not for you. You are asking different desks, and the desks are at different stages of learning the answer.
Caching, and why it is the whole design
Three questions per name would be ruinous, so everybody remembers. The resolver keeps each answer for a while, and the next person to ask gets it straight from memory. Your computer caches too, and so does your browser.
Every record carries a time to live, a number of seconds saying how long it may be kept. Five minutes, an hour, a day. That number is the deal between the owner of the name and the rest of the world: long means fast and slow to change, short means the opposite.
It is also the reason for the standard advice before a move: lower the time to live a day in advance, make the change, put it back. And the reason that "it still points at the old server" is usually not a mistake but a cache that has not run out yet.
Why bad DNS looks like a dead internet
When the resolver does not answer, nothing happens. The browser sits there. The mail app times out. Nothing gives you an error that says DNS. To everyone in the house, the internet is down.
Meanwhile the connection itself is fine. The clue is that addresses still work when names do not: a device you reach on 192.168.10.20 answers, a ping to a numeric address on the internet comes back, and the moment you type a name it stops. If that is what you see, look at DNS and not at your provider.
The usual causes are dull. The resolver is switched off or unreachable. Clients were handed a DNS address that no longer exists, which happens after you swap a router and forget the handed-out settings. Or the resolver is reachable but its own upstream is not, and it is waiting on an answer that will not come. See when something goes wrong.
What a resolver on your own router buys you
You can let every device ask a public service directly. Putting your own router in the middle gets you four things instead.
- Speed. Every name that anybody in the house has looked up recently is answered from the router in a millisecond, without leaving the building.
- Names for your own things. You can make up records that exist only inside your network:
nas,printer,camera-shed. The internet has never heard of them and does not need to. - One place to change things. Switch your upstream, add a filter, block a list of domains, and every device follows, including the ones with no settings to speak of.
- Something to look at. When you can see what is being asked for, you can see a device that phones home every thirty seconds.
There is a cost, and it is honest to say it. That router is now a single point of failure for something that feels like the whole internet. And a resolver that answers questions for your network must not answer questions from the internet, or it will be abused within days to amplify attacks at somebody else. That second point is not optional, and it is why the default configuration blocks DNS coming in from the outside.
Who sees your questions
Whoever resolves for you sees every name you ask for. That is your provider by default, and it is a different party as soon as you pick one. Encrypting the questions, which is what DNS over HTTPS does, hides them from everyone on the way but not from the resolver at the end. Choosing a resolver is choosing who gets to watch, not choosing to be unwatched.
Where the tool picks this up
The configurator makes the router the resolver for your network by default, with a cache and an upstream you pick, and the details of that choice are in DNS. Which server your devices are told to use is part of LAN and DHCP.