In this article, we discuss DNS lookups — what they are, how they work, and how they impact online privacy and censorship.

A DNS lookup refers to the process of matching the URL you enter into your browser’s address bar (the readable domain name) to its corresponding IP address(new window).

All devices that connect directly to the internet are identified by a numerical label known as an IP address. To help make things easier for us humans, this address can also be identified using more readable and memorable domain names. The Domain Name System (DNS) maps these domain names to their corresponding IP addresses.  

Learn more about IP addresses

For example, the Proton VPN website uses the domain name, which corresponds to the IP address When you type into your browser’s URL bar, the domain name must be converted into its corresponding IP address for computers to understand it. 

This conversion is performed using DNS. So when you type in, DNS converts the domain name into the IP address: This allows your browser to locate and connect to the correct website. 

Domain names exist solely for human convenience and aren’t required for the internet to function. If you could remember IP addresses, you could type those in directly. To see this in action, simply enter into your browser’s URL bar, and it will take you to the Proton VPN website.

How a DNS lookup works

DNS is often compared to a telephone directory that cross-references domain names and their corresponding IP addresses. This is a useful analogy for understanding what DNS does, but the reality of how it works is more complex. 

DNS resolver

When you enter a domain name into your browser’s URL bar, a DNS query is sent to a special server called a DNS resolver (also DNS recursor or just DNS server). 

As its name suggests, the DNS resolver “resolves” the DNS query by retrieving the domain’s corresponding IP address and sending it back to your browser. Now that it knows the IP address of the website you want to visit, your browser can connect to it.

So far, so simple. But how does the DNS resolver retrieve the correct DNS address for a domain (a process complicated by the fact that new domains are created all the time, and IP addresses are often dynamically allocated to domains and therefore routinely change)? 

How a domain is resolved using DNS

A DNS lookup for a top-level domain(new window) (TLD) typically involves the following steps: 

1. You type into your browser’s URL bar. Your browser sends this query over the internet to a DNS resolver

2. The DNS resolver sends a query to a DNS root name server. This is a server that stores information on TLDs (such as .com or .net, or country code TLDs such as .ch or .uk). For our query was (, the DNS root name server would point to the DNS resolver for “.com” TLDs.

3. Armed with this information, the DNS resolver will now query the .com TLD name server, which maintains a list of all .com domains. The TLD name server responds with the IP address of the domain’s authoritative name server

4. The DNS resolver can now query the domain’s authoritative nameserver. This is typically run by a domain name registrar(new window) — a business that leases and manages domain names (such as GoDaddy or Namecheap). The authoritative nameserver is the final source of truth about the domain and can return its IP address to the DNS resolver (in our case, this will be 

5. The DNS resolver sends the correct IP address to your browser, which can now connect to

How DNS works

In reality, the situation is a bit more complicated. For example, many domains are associated with multiple IP addresses (including both IPv4 and IPv6 addresses), and there will be additional steps if you visit a subdomain (such as

Information is also routinely cached (stored locally) at all stages of the process — by your browser, by the DNS resolver, and by the various name servers. If the required information is found in a cache, then a request is not sent, which results in some steps being missed. 

However, in essence, this is how DNS works for a fairly standard visit to a website.

DNS, censorship, and government surveillance

By default, your browser sends your DNS queries to a DNS resolver run by your internet service provider (ISP). Your ISP can use various methods to see what you do on the internet, but by far the easiest (and cheapest) way is to simply monitor your DNS queries.

Most government mass spying programs rely on requiring ISPs to keep logs of their customers’ browsing histories. And, because it is easy and cheap, most ISPs meet these legal obligations by only keeping DNS logs. 

Similarly, when governments wish to censor internet content on social, religious, political, or “moral” grounds, they ask domestic ISPs to enforce these blocks. And the easiest way to do this is to block DNS queries to specified websites and apps. 

Third-party DNS services

One way to avoid at least some of this censorship and surveillance is to use a third-party DNS resolver, such as Cloudflare or OpenNIC. 

Some of these services may have good privacy policies, but unless connections to the DNS resolver servers are encrypted using DNS over TLS (DoT) or DNS over HTTPS (DoH)(new window), your ISP can see the requests in plaintext should it choose to look. 

Encrypting DNS queries makes it harder (and therefore more expensive) for an ISP to monitor your browsing history, but it can still fairly easily trace which websites and apps you connect to if it wishes to.

Get Proton VPN!

DNS and VPNs

When using a VPN (such as Proton VPN), your connection to the VPN server is encrypted. With some effort, your ISP can see that you’ve connected to an IP address belonging to the VPN server, but that’s it.

DNS queries are sent through the VPN tunnel and resolved by the VPN provider, which may run its own DNS resolver or use a third-party VPN resolver. This has no privacy implications since the DNS queries appear to come from the VPN server, not the VPN user. 

Learn how a VPN works

It’s worth noting that there’s no need for encrypted DNS when using a VPN, as all DNS queries are sent through the encrypted VPN tunnel anyway. 

It’s also not recommended to use a third-party DNS resolver together with a VPN. Configuring your system in this way may cause your DNS queries to be sent outside the VPN tunnel to the third-party DNS resolver. 

Learn more about DNS leaks

NetShield Ad-blocker

Proton VPN offers NetShield Ad-blocker in all our apps. This is a DNS filtering feature that blocks DNS queries to domains known to belong to advertising companies, online trackers, and malware. It (and other similar DNS filtering services) works at the DNS resolver level by simply failing to resolve DNS queries to blocklisted domains. 

Learn more about NetShield Ad-blocker

Technically, this constitutes a DNS leak (see below). This may not be a huge issue if the DNS query is encrypted and you trust the DNS resolver, but it introduces an unnecessary third party (and therefore potential point of weakness) into the equation.

DNS leaks

When using a VPN, all DNS queries should get sent through the VPN tunnel to be resolved by the VPN provider. If, for any reason, the DNS query is sent outside the VPN tunnel to a third-party DNS resolver, a DNS leak has occurred. Failure to properly route IPv6 DNS requests through the VPN tunnel is a common cause of DNS leaks.

Since this third party would likely be your ISP, DNS leaks are a serious privacy concern. Needless to say, all Proton VPN apps have strong built-in DNS leak protection. 

Common DNS record types

Here are some of the key DNS record types that can be looked up:

  • A (Address) Record: Maps a domain name to an IPv4 address. Example: →
  • AAAA (Quad A) Record: Maps a domain name to an IPv6 address. Example: → 2001:0db8:85a3:0000:0000:8a2e:0370:7334
  • CNAME (Canonical Name) Record: Maps a domain name to another domain name, effectively aliasing one name to another. Example: →
  • MX (Mail Exchange) Record: Specifies the mail servers responsible for receiving email on behalf of a domain. Example: → (priority 10 — the priority number indicates preference, with lower-priority requests preferred).
  • PTR (Pointer) Record: Maps an IP address to a domain name, used primarily for reverse DNS lookups. Example: →
  • NS (Name Server) Record: Specifies the authoritative name servers for a domain. Example: →,
  • SOA (Start of Authority) Record: Provides important information about the domain, including the primary name server, email of the domain administrator, domain serial number (which helps manage and synchronize DNS data across multiple DNS servers), and refresh retry, and expire timers (Example: →,, 2024041501)
  • TXT (Text) Record: Holds arbitrary text data, often used for email validation (like SPF or DKIM) and other verification purposes. Example: → “v=spf1 ~all”
  • SRV (Service) Record: Specifies the location of servers for specific services, such as the SIP(new window) internet telephony protocol, the XMPP(new window) messaging protocol, etc. Example: → 0 5 5060
  • CAA (Certification Authority Authorization) Record: Specifies which certificate authorities (CAs) are allowed to issue certificates for a domain. Example: → 0 issue “”
  • NAPTR (Naming Authority Pointer) Record: Used for URL resolution and defining rewrite rules for various services like VoIP. Example: → 100 50 “s” “SIP+D2U” “”
  • DNSKEY: Contains the public signing key used in DNSSEC (suite of specifications designed to add an extra layer of security to DNS).
  • . Example: → 256 3 13 …
  • DS (Delegation Signer) Record: Holds the hash of a DNSKEY record to secure delegations in DNSSEC. Example: → 12345 13 2 …
  • SPF (Sender Policy Framework) Record: Used to define which IP addresses are authorized to send email on behalf of a domain. Example: → “v=spf1 ip4: -all”

DNS lookup commands

DNS commands are used to query, test, and troubleshoot DNS servers and records. These commands are essential for network administrators to ensure that DNS services are working correctly, as DNS is crucial for the resolution of domain names to IP addresses.

Below are some commonly used DNS commands. You can run these commands in a terminal window (Linux), Terminal (macOS), Command Prompt (cmd) or PowerShell (Windows), or even a terminal emulator app on your mobile device. Not all these commands may be available “out-of-the-box” on your platform, but in almost all cases they’re easy to install. 


The nslookup command is a tool for querying the DNS to obtain domain name or IP address mapping. You can also specify a particular DNS server to use and perform a reverse DNS lookup.



The dig (Domain Information Groper) command is a more powerful and flexible DNS IP lookup tool than nslookup. Network administrators often prefer it for its detailed output and advanced options.


With dig, you can also query a specific DNS record type, query a specific DNS server, and perform a reverse DNS lookup.


The host command is another tool for performing DNS lookups. It’s simpler than dig but provides sufficient information for basic tasks, including querying a specific DNS server and performing reverse DNS lookups.



The ping command is primarily used to check a host’s reachability on an IP network, but it also performs DNS resolution as part of its operation.


traceroute / tracert

The traceroute (on Linux and macOS) and tracert (on Windows) commands are used to trace a packet’s path, from its source to its destination. It resolves the domain name to an IP address and shows each hop on the way to the destination.


ipconfig / ifconfig

The ifconfig (on Linux and macOS) and ipconfig (on Windows) commands can be used to display network configuration, including the DNS servers that the system is using. When used on its own, it displays only active interfaces. To see all interfaces on Windows, use ipconfig /all


DNS lookup tools

In addition to command-line tools such as those discussed above, there are many online DNS lookup tools that provide a graphic user interface (GUI) way to query DNS. A good example is window), which allows you to perform regular DNS lookups, MX lookups, NS lookups, CNAME lookups, and TXT lookups.

DNS lookup

It can also perform reverse DNS lookups (IP lookup).

Reverse DNS lookup

Final thoughts

At heart, DNS is just a complicated, automated phone book. It makes the internet usable for humans, but it can be (and is) abused by governments to spy on their citizens and censor what they see. The best way to bypass these abuses of DNS is to use a VPN service such as Proton VPN. 

A VPN service securely resolves your DNS queries instead of your ISP, and most reputable VPN services make it their business to protect your privacy.

Of course, a VPN also offers many other benefits, such as hiding your real IP address from websites you visit, providing enhanced protection against IPS’s being able to monitor or censor your internet activity, being able to stream your favorite content when you’re traveling, and more. 

Learn more about the benefits of using a VPN

Protect your privacy and security online
Get Proton VPN free

Related articles

Update July 18, 2024: This article has been updated to feature the latest audit of our no-logs policy by Securitum, which was concluded on July 12, 2024. Links to all our no-logs policy audits are included. We’re pleased to announce that Proton VPN
VPN on mobile device
Growing public awareness about the threat posed to our fundamental right to privacy by online trackers has fueled a surge in VPN adoption, a trend that has been boosted thanks to people spending more time online due to the Covid-19 pandemic. Althoug
Tor over VPN
  • Privacy deep dives
Tor is a powerful privacy tool, but you may not want to use Tor all by itself. Learn why you may want to connect to Tor over a VPN. When you connect to the Internet, especially if you’re using public WiFi, there’s a good chance people are watching y
Smart TV privacy
Smart TVs are essentially televisions that can watch you. Their surge in popularity, along with smart speakers, means corporations (and anyone that can hack these devices) have another window through which they can view your private activity. The dat
Expats should use a VPN
Living abroad can be an adventure, but it also presents unique online privacy obstacles. A VPN can help expats stay in touch with their family and avoid Internet censorship. In the age of the “digital nomad” more and more people are moving abroad. L
The internet is full of information, but some of it is inappropriate, especially for kids and sensitive adults. SafeSearch can help filter out this content to make browsing safer and improve your children’s privacy online. This article explains how