How Traditional DNS Works (The Unencrypted Baseline)

Before You Can Fix Something, Understand What's Broken

To appreciate why encrypted DNS matters, you need to understand the journey a standard DNS query takes. When you type example.com into your browser, the following happens — all in plain text, all in milliseconds:

1. Stub Resolver: Your operating system checks its local cache. If the answer isn't there, it forwards the query to a recursive resolver — typically one provided by your ISP, or a public one like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare).

2. Recursive Resolver: This server does the heavy lifting. It queries the root nameservers (there are 13 sets of them, globally distributed) to find out who is authoritative for .com.

3. TLD Nameserver: The root server points to the .com TLD (Top-Level Domain) nameserver, which knows who is authoritative for example.com.

4. Authoritative Nameserver: The TLD server points to example.com's own nameserver, which returns the final IP address.

5. Answer returned: The recursive resolver caches the answer and returns it to your stub resolver, which passes it to your browser.

Every single one of these hops — from your laptop to the recursive resolver — is traditionally unencrypted UDP on port 53. The hop from your laptop to the recursive resolver is the most exposed, because it crosses your local network and your ISP's infrastructure. Encrypted DNS specifically secures this first hop.