DNS
The system that maps human names like example.com to IP addresses. It's a hierarchical, cached, eventually-consistent database that every connection starts with. Resolution latency and TTLs directly affect perceived performance and failover.
- Always — it's the foundation of naming.
- Geographic/weighted routing via DNS policies for simple global load distribution.
- Sub-second failover (TTLs and resolver caching fight you) — use health-checked LB/CDN instead.
- Carrying secrets or large payloads.
Definition
DNS resolves names to records (A/AAAA for IPs, CNAME aliases, MX for mail, TXT, etc.) via a tree of authoritative servers, with recursive resolvers caching results for a TTL. Lookups are UDP by default with TCP fallback for large responses and DNSSEC.
Why it exists
Humans remember names; networks route to IPs. DNS decouples a stable name from changing infrastructure, enabling moves, multi-IP, and failover without clients changing config.
How it works
Client asks a resolver, which walks from root → TLD → authoritative, caching each step. Records carry a TTL controlling how long caches hold them. Lower TTL = faster changes, more resolver load. DNSSEC signs answers; DoH/DoT encrypts transport.
Scaling limits
A single name's records are limited (~8 IPs per A round-robin reliably). Propagation is bounded by TTLs, so failover is never instant. Authoritative servers must be massively distributed (anycast) to handle global query volume.
Cost shape
Cheap at the edge (cached). You pay for authoritative DNS service by query volume and features (health checks, routing policies). Very low TTLs raise query costs and complicate caching.
Alternatives
- Service discovery — Dynamic per-request routing without TTL lag, but needs a registry client.
- Anycast — Routes by network topology to the nearest instance; complements DNS.
Failure modes
- Long TTLs delaying failover.
- Resolver caching ignoring low TTLs.
- DNSSEC misconfiguration breaking resolution entirely.