DNS is the phone book of the internet, but really a tree: the root is `.`, under it sit TLDs (`.com`, `.at`, `.io`), and authoritative name-servers delegate responsibility downward. A browser asking for `www.example.com` queries its configured recursive resolver, which walks the hierarchy or returns a cached answer. The key record types: A (IPv4), AAAA (IPv6), CNAME (alias to another name), MX (mail server), TXT (free-form, used for verification and policy like SPF/DKIM/DMARC), NS (delegate to these name-servers). TTL (time-to-live) governs how long resolvers and clients may cache an answer, and understanding TTL is essential for any infrastructure change — a `301 redirect to new host` with a 24-hour TTL means old answers linger. DNS is historically plaintext over UDP port 53, which exposed lookup metadata. DNS-over-HTTPS (DoH, RFC 8484) and DNS-over-TLS (DoT, RFC 7858) encrypt lookups so intermediaries cannot see or modify them, and are now shipping defaults in most modern browsers and operating systems.