Following one DNS lookup step by step, from the moment you type a domain to the moment your browser has an address to connect to, shows exactly which layer is doing the work at each stage — useful context for diagnosing anything from a slow lookup to a suspected leak.
The full path
- Browser cache. Modern browsers cache recent DNS lookups internally, often answering repeat requests without touching the network at all.
- Operating system cache. If the browser doesn't have a cached answer, the OS-level resolver cache is checked next.
- Recursive resolver. If neither cache has an answer, the request goes to your configured recursive resolver — your ISP's default, a VPN-provided one, or a manually configured public resolver.
- Root servers. If the recursive resolver doesn't have a cached answer either, it starts at the root, which points it toward the right top-level domain servers.
- TLD servers. These point toward the specific authoritative servers for the domain being looked up.
- Authoritative servers. These hold the actual DNS records for the domain and return the final answer.
Why most lookups skip most of these steps
Caching at every layer means the full root-to-authoritative walk only happens when nothing along the chain already has a cached answer — for popular domains, this is relatively rare in practice, which is part of why testing DNS behavior (like a leak test) deliberately uses freshly generated, never-before-seen hostnames rather than common domains that are likely already cached somewhere.
Why this matters for testing
Understanding which layer answered a given query is exactly why NetRiskScan's DNS Leak Test generates a unique hostname per session — it guarantees the query can't be answered from any existing cache, forcing a genuine round trip that reveals which resolver is actually handling your traffic right now.
FAQ
Why do some domains load faster than others the first time?
A domain whose records are already cached somewhere along the chain (by your ISP's resolver, for instance, because many other customers recently visited the same popular site) resolves faster than one requiring a fresh full lookup.