DNS Deep Dive

Why This Comes Up in Interviews

Every system design begins with a user typing a URL. DNS is the entry point for all distributed systems. Interviewers want to hear:

• How DNS resolution actually works (not just "it translates names to IPs")
• How you design for DNS failover and redundancy
• How GeoDNS enables global load balancing
• TTL trade-offs between availability and freshness
• How DNS becomes a bottleneck or single point of failure

DNS Hierarchy — The Tree Structure

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
graph TD
    ROOT["Root Servers (13 clusters, 1000+ instances)"]
    TLD_COM[".com TLD Server"]
    TLD_ORG[".org TLD Server"]
    TLD_IO[".io TLD Server"]
    AUTH_GOOGLE["ns1.google.com (Authoritative)"]
    AUTH_GITHUB["ns1.github.com (Authoritative)"]

    ROOT --> TLD_COM
    ROOT --> TLD_ORG
    ROOT --> TLD_IO
    TLD_COM --> AUTH_GOOGLE
    TLD_COM --> AUTH_GITHUB

    style ROOT fill:#e74c3c,color:#fff
    style TLD_COM fill:#f39c12,color:#fff
    style TLD_ORG fill:#f39c12,color:#fff
    style TLD_IO fill:#f39c12,color:#fff
    style AUTH_GOOGLE fill:#27ae60,color:#fff
    style AUTH_GITHUB fill:#27ae60,color:#fff

Resolution Process — Step by Step

Query: What is the IP address of api.stripe.com?

Total uncached resolution: ~100-200ms (3-4 network hops) Cached resolution: <5ms (resolver already knows the answer)

The math: With a 300s TTL and 1000 req/s to the same domain, only 1 in 300,000 requests actually triggers full resolution. Cache hit rate: 99.9997%.

DNS Record Types

CNAME trap (common interview gotcha): You CANNOT have a CNAME at the zone apex (stripe.com). Why? CNAME must be the only record at a name, but apex needs SOA and NS records. Solution: use ALIAS/ANAME (provider-specific) or A records.

TTL — The Critical Trade-off

Pre-migration trick: Before a DNS migration, lower TTL to 60s 48 hours in advance. Old TTL (say 24hr) needs time to expire from all caches. Then migrate. Then raise TTL back.

DNS Load Balancing

GeoDNS resolution example:

DNS Failover Architecture

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
graph LR
    CLIENT[Client] --> RESOLVER[Recursive Resolver]
    RESOLVER --> GEODNS[GeoDNS Provider]
    GEODNS -->|Health OK| PRIMARY["Primary DC (Virginia)"]
    GEODNS -->|Health FAIL| SECONDARY["Secondary DC (Oregon)"]

    MONITOR[Health Monitor] -->|Check every 10s| PRIMARY
    MONITOR -->|Check every 10s| SECONDARY
    MONITOR -->|Update records| GEODNS

    style PRIMARY fill:#27ae60,color:#fff
    style SECONDARY fill:#f39c12,color:#fff
    style MONITOR fill:#3498db,color:#fff

Failover timing math:

• Health check interval: 10s
• Failure threshold: 3 consecutive failures
• Detection time: 30s
• DNS TTL: 60s
• Worst-case failover: 90s (failure happens right after health check + TTL hasn't expired)

DNS Security

Interview Framework

When DNS comes up in system design:

Step 1: "Users resolve our domain through DNS. I'd use a managed DNS provider (Route53/Cloudflare) with GeoDNS to route users to the nearest datacenter for lowest latency."

Step 2: "For high availability, I'd configure health-check-based failover with a 60s TTL. If the primary datacenter goes down, DNS automatically routes to the secondary within 90 seconds worst-case."

Step 3: "For global load balancing, GeoDNS returns different IPs based on user geography — Tokyo users hit Asia-Pacific servers, EU users hit Frankfurt."

Step 4: "To avoid the Dyn-style single point of failure, I'd use multiple DNS providers (Route53 + Cloudflare) with the same zone data. If one provider goes down, the other still resolves."

Quick Recall