Submit

INTERACTIVE LEARNING TOOL

Protocol Explorer · DNS

Explore internet protocols with animated messages, real arrival order and packet inspection.

Read the learning guides ↓
PROTOCOL EXPLORERLearn how the internet works
Now learningDNS · Name resolutionOverview · 5 steps
Learning progress0%
0 / 14 complete · 0 in progress
Client192.168.1.10Router192.168.1.1InternetDNS Resolver8.8.8.8Root Server198.41.0.4.com TLD Server192.5.6.30Authoritative Server198.51.100.53

Protocol overview

DNS

Active

Domain Name System

Resolve a domain through recursive and authoritative servers. Read query IDs, question names, record types, referrals and cache lifetimes.

Layer
Application (Layer 7)
Default port
53
Transport
UDP / TCP
Data format
Queries, records and referrals
Defined in
RFC 1034, RFC 1035
Read the complete guide ↗

Packet flow

DNSTCPRequestResponse
No.TimeSourceDestinationProtocolInfoSize
10.000s192.168.1.108.8.8.8DNSRecursive A query75 B
20.024s8.8.8.8198.41.0.4DNSQuery root · iterative lookup75 B
30.048s198.41.0.48.8.8.8DNSReferral · com NS ns.com + glue120 B
40.072s8.8.8.8192.5.6.30DNSQuery .com server75 B
50.096s192.5.6.308.8.8.8DNSReferral · example.com NS ns.example.com + glue144 B
60.120s8.8.8.8198.51.100.53DNSQuery authoritative server75 B
70.144s198.51.100.538.8.8.8DNSAuthoritative A answer91 B
80.168s8.8.8.8192.168.1.10DNSCached A answer · TTL 6091 B

NAVSPROUT · PROTOCOL FIELD GUIDES

DNS, packet by packet.

Resolve a domain through recursive and authoritative servers. Read query IDs, question names, record types, referrals and cache lifetimes.

PROTOCOL FIELD GUIDE

How DNS works

Resolve a domain through recursive and authoritative servers. Read query IDs, question names, record types, referrals and cache lifetimes.

Default port
53
Transport / carrier
UDP / TCP
Category
application

1. Ask the recursive resolver

The client sends an A question for an IPv4 address. An AAAA question asks for IPv6; MX and TXT request other record types.

2. Follow the root referral

On a cache miss, the resolver asks a root server. The root returns a referral toward the responsible top-level domain, not the final website address.

3. Ask the TLD servers

The top-level domain points to the domain’s authoritative name servers. Glue addresses can help reach those servers.

4. Receive the authoritative answer

The authoritative server returns the requested record or a negative answer. The resolver caches according to DNS TTL rules.

5. Reuse the cache

A later lookup may be answered locally until the TTL expires. TCP is supported too; DNS is not restricted to UDP.

Protocol relationships

Protocols cooperate across layers. Compare the neighboring lessons to distinguish addressing, delivery, application semantics and encryption.

Standards and editorial method

Written and implemented independently by NavSprout. Lessons summarize public protocol standards using synthetic documentation addresses and fictional credentials. Consult the standards for complete wire formats and normative behavior.

RFC 1034 ↗ RFC 1035 ↗

Check your understanding

What does an AAAA record contain?

Why it’s hereNAVSPROUT ORIGINAL

Reading definitions is easier when you can connect them to a packet. This first-party learning tool pairs static explanations with a visual lab, byte inspection and a short knowledge check. All course data and application resources ship with NavSprout.

  1. Choose DNS and follow the lookup from client to authoritative server.
  2. Switch to the sequence view, then inspect a packet and select a field to highlight its bytes.
  3. Compare TCP with UDP, answer the quiz and export your progress.

Frequently asked questions

What happens when I open a website?

A typical first HTTPS visit can involve DNS resolution, a transport connection, a TLS handshake and an HTTP exchange. Caches, connection reuse and HTTP/3 can change this sequence.

How are TCP and UDP different?

TCP presents a reliable ordered byte stream. UDP preserves individual datagram boundaries without built-in delivery guarantees. Applications choose the behavior they need.

Are these real captured packets?

No. Frames are generated locally for teaching. Header lengths and checksums are calculated, while TLS ciphertext and some negotiation payloads are illustrative. Downloaded PCAP files contain synthetic examples, not live traffic.

Can I learn without JavaScript or an account?

All 14 protocol guides and their lesson explanations are available as ordinary HTML without signing in. JavaScript powers animations, byte inspection, local progress and quizzes.

Where is my progress saved?

Only in this browser’s local storage. Export a progress JSON file to move it to another device. Clearing browser data can remove progress.

MAKE A THOUGHTFUL CHOICE

Your shortlist, side by side.

Pricing models are indicative. Check each official website for current plans and limits.