Part 1 · Foundations Before System Design
What Happens When You Type a URL and Press Enter?
The one second between pressing Enter and seeing a page hides a DNS lookup, a trip through a dozen routers, two handshakes and a server doing real work. Every later lesson zooms into one part of that journey.
On this page
The Problem
You type www.amazon.com into your browser, press Enter, and less than a second later the page appears. It feels instant. But if you want to design systems for millions of users, you need to understand what happens in that second. Every step is a place where things can be slow, can break, or can be made better.
When a website is slow or down, the problem can be in any of these places:
- the name lookup,
- the network path,
- the server,
- or the database.
This lesson walks through the whole journey. Every later lesson in this series looks at one part of it in more detail.
The Core Idea
Think about sending a letter to a friend. You know your friend's name, but the post office needs an address. So first you look up the address in your contact book. Then you write it on the envelope and put it in a post box. The letter goes through several sorting centres until it reaches your friend's house. Your friend reads it and sends a reply the same way.
The internet works the same way:
| Letter world | Internet world |
|---|---|
| Friend's name ("Priya") | Domain name (amazon.com) |
| Contact book | DNS (Domain Name System) |
| House address | IP address (52.94.236.248) |
| Envelope | Packet |
| Sorting centres | Routers |
| Your friend | The web server |
Two ideas matter most in this lesson:
- Computers find each other by IP address, not by name. Names are for humans.
- Data travels in small pieces called packets. A packet is a small chunk of data with an address on it. Each packet finds its own way across many networks.
How It Works
Here is the full journey, from pressing Enter to seeing the page:
- 1Browser reads the URLprotocol, domain, path and query string
- 2DNS lookupbrowser cache → OS cache → resolver → root → .com → Amazon's DNS
- 3TCP handshakeSYN, SYN-ACK, ACK — one round trip before any data moves
- 4TLS handshakeagree on keys and check the certificate (HTTPS only)
- 5HTTP requestGET /deals?page=2 with headers and cookies
- 6Server does the workCDN edge → load balancer → app server → cache → database
- 7HTTP response200 OK plus HTML, split into packets of up to about 1,500 bytes
- 8Browser rendersparses HTML, then fetches dozens of CSS, JS and image files
Let's go through each step.
Step 1: The browser reads the URL
A URL (Uniform Resource Locator) is the full address of a page or file on the web. A URL like https://www.amazon.com/deals?page=2 has parts:
httpsis the protocol: the set of rules for how to talk (secure HTTP).www.amazon.comis the domain name: the human-friendly name of who to talk to./dealsis the path: what you want.?page=2is the query string: extra details.
If you typed something that is not a URL, like "best laptops", the browser sends it to a search engine instead.
Step 2: DNS, the internet's phone book
Your computer cannot connect to "www.amazon.com". It needs a number, an IP address. An IP address is the number that identifies one machine on a network. DNS (Domain Name System) is a worldwide system of servers that turns a name into that number. A cache is a saved copy of an answer, kept so that the next request is faster.
The lookup tries the fastest options first:
- Browser cache. Did I look this up in the last few minutes?
- Operating system cache. Did any app on this computer look it up?
- Recursive resolver. A DNS server that looks up the answer for you. It is usually your internet provider's DNS server, or a public one like Google's
8.8.8.8or Cloudflare's1.1.1.1. It does the hard work for you.
If the resolver doesn't know the answer, it asks a chain of servers. The root serversknow who runs each top-level domain, such as .com. The TLD servers know who runs each name under that top-level domain, such as amazon.com. The authoritative server (Amazon's own DNS here) holds the final answer.
- who handles .com?
- ask the .com servers
- who handles amazon.com?
- ask Amazon's name servers
- 52.94.236.248TTL 300 s
- The resolver caches the answer for the TTL, so the next person on your ISP skips all of this
- 52.94.236.248
The resolver saves (caches) the answer for a while and gives it to your computer.
TTL (Time To Live). Every DNS answer comes with a TTL. It is a number of seconds that says how long the answer may be cached. This creates a trade-off:
- Long TTL (for example, a day): fewer lookups and faster browsing. But if the company changes its server IP, some users keep going to the old address for up to a day.
- Short TTL (for example, 60 seconds): changes spread quickly, but the DNS servers have to answer more queries.
That is why engineers lower the TTL a few days before a server migration.
Common DNS record types. A DNS record is one saved fact about a domain. Each record has a type:
| Record | What it does | Example |
|---|---|---|
| A | Name → IPv4 address | amazon.com → 52.94.236.248 |
| AAAA | Name → IPv6 address | google.com → 2607:f8b0:... |
| CNAME | Name → another name (an alias) | www.shop.com → shop.netlify.app |
| MX | Where to deliver email | gmail.com → gmail-smtp-in.l.google.com |
| TXT | Free text, often for verification | Domain ownership, email security (SPF is a list of servers allowed to send email for the domain) |
| NS | Which servers are in charge of this domain | example.com → ns1.example-dns.com |
When you connect your own domain to a hosting platform like Vercel, you usually add an A or CNAME record. This means you are editing DNS.
Step 3: IP addresses, packets and routers
Now the browser knows the IP address, so it can start talking.
IP addresses come in two versions:
- IPv4 looks like
192.168.1.10. There are only about 4.3 billion of these, and the free ones have run out. - IPv6 looks like
2001:db8::1. There are so many that we will not run out.
Public vs private IPs. A public IP can be reached from the whole internet. A private IP works only inside one local network. Your laptop at home probably has a private address like 192.168.1.5. Your Wi-Fi router has one public address that every device in the house shares. The router uses NAT (Network Address Translation). NAT is a trick where the router rewrites outgoing packets so they carry the public address, and remembers which reply belongs to which device. This is why your laptop can visit websites, but a stranger on the internet cannot connect directly to your laptop.
Packets. Your request is not sent as one big piece. It is cut into packets, usually up to about 1,500 bytes each. Each packet carries:
- a source IP (you),
- a destination IP (Amazon),
- and a piece of the data.
Routers are the sorting centres. A router is a device that passes packets from one network to the next. Each router looks at the destination IP and sends the packet one "hop" (one step) closer. A router does not read your data. It only looks at the address on the envelope. A packet from India to a US server might pass through 10 to 20 routers.
You can see this yourself with a command-line tool that lists every router on the path:
traceroute www.google.com # macOS / Linuxtracert www.google.com # WindowsEach line is one router on the path, with the time it took to reach it.
How do routers know the way? Big networks (internet providers, cloud companies, Google, Facebook) use BGP (Border Gateway Protocol). BGP is the protocol that networks use to announce "I can reach these IP addresses". Other networks learn routes from these announcements. BGP is the internet's map, built by many companies telling each other which roads they own.
Ports. An IP address finds the machine. A port is a number (0 to 65535) that finds one program on that machine, like an apartment number inside a building. Some well-known ports:
- 80 for HTTP (the web protocol, without encryption),
- 443 for HTTPS,
- 22 for SSH (a protocol for logging in to a remote machine safely),
- 5432 for PostgreSQL (a database),
- 53 for DNS.
Step 4: The network layers
Networking is organised in layers. A layer is one level that does one job and trusts the layer below it. The simple TCP/IP model has four:
You will also hear about the OSI model, which has 7 layers. In system design, people often say "Layer 4" and "Layer 7". These numbers come from the OSI model:
- Layer 4 means the transport layer (TCP and UDP, the two ways to send data between programs).
- Layer 7 means the application layer (HTTP).
This matters later. A load balancer is a server that shares incoming requests between many identical servers. An L4 load balancer only sees IPs and ports. An L7 load balancer can read the URL and headers.
Step 5: Connect, secure, request
Next, the browser:
- opens a TCP connection (a quick three-message "hello" called a handshake, covered in the next lesson),
- sets up TLS encryption for HTTPS (lesson 3). TLS (Transport Layer Security) is the protocol that scrambles data so that nobody on the path can read it,
- sends an HTTP request (HTTP is the protocol for asking a server for a page), such as
GET /deals?page=2.
Step 6: The server does the work
The request usually does not go to a single computer. On a big site it passes through several tiers. A CDN (Content Delivery Network) is a group of servers around the world that keep copies of files close to users. A cache such as Redis is a very fast store that keeps recent answers in memory. The database stores the real data for the long term.
- 1Your browsersends GET /deals?page=2
- 2CDN edgea nearby copy of images, CSS and JS — often answers without going further
- 3Load balancerspreads requests across many identical servers
- 4App serverruns the code for this page
- 5Cache (Redis)“Do we already have the answer?” — sub-millisecond
- 6Database“Fetch the deals for page 2” — the slowest, most precious tier
Each of these gets its own lesson later in the course.
Step 7 and 8: Response and rendering
The server sends back an HTTP response, like 200 OK with HTML. HTML is the text that describes the page. The browser:
- reads the HTML,
- finds links to CSS, JavaScript and images,
- requests all of those too (often dozens of extra requests),
- builds the page on your screen.
Open your browser's DevTools, go to the Network tab and reload any site. You will see every request, and how much time each one spent on DNS, connecting, TLS, waiting and downloading.
Why distance matters: latency
Latency is the time it takes for data to get from one place to another. A round trip is the trip there and back. Signals in fibre-optic cable travel at about 200,000 km per second, roughly two-thirds of the speed of light. That sounds instant, but:
- London → New York is about 5,500 km. One way takes at least about 28 ms, so a round trip takes about 56 ms.
- London → Sydney is about 17,000 km. The round trip is at least about 170 ms, and often 250 ms or more in practice.
A page that needs 4 or 5 round trips before showing anything will feel slow to someone far away, no matter how fast the server is. This is why companies put servers and CDNs close to users. You cannot make light faster, but you can make the distance shorter.
Open DevTools → Network, reload any site and hover the waterfall bar of the first request. You will see the exact time spent in each step of this lesson: DNS lookup, initial connection, SSL, waiting (server time) and content download.
Trade-offs
- DNS caching: makes browsing fast, but makes changes slow to spread. The TTL is the setting that controls this.
- Many small packets vs fewer large ones: small packets recover from loss more easily. Large ones waste less space on headers.
- NAT: saves IPv4 addresses and hides home devices, but makes direct device-to-device connections (like video calls or gaming) harder. That is why apps like Zoom need extra steps to connect two users.
- Relying on one DNS provider: simple, but if that provider goes down, your site "disappears" even though your servers are fine.
In the Real World
Facebook's 6-hour outage (October 2021). During routine maintenance, a configuration change caused Facebook's BGP routes to be withdrawn (taken away). The rest of the internet no longer knew how to reach Facebook's networks, including its DNS servers. Every DNS lookup for facebook.com, instagram.com and whatsapp.com failed. Billions of users were affected, and even Facebook's employees reportedly had trouble getting into buildings because internal tools were down. The servers themselves were running fine. The problem was that nobody could find them.
The Dyn DNS attack (October 2016). A huge attack from hacked internet-connected devices (the Mirai botnet) sent so much traffic to Dyn, a major DNS provider, that it could not answer real users. Sites like Twitter, Netflix, Reddit and GitHub became unreachable for many users on the US East Coast. After this, many companies started using more than one DNS provider.
Public DNS resolvers. Google (8.8.8.8) and Cloudflare (1.1.1.1) run free resolvers used by millions. Some people switch to them because they can be faster or more private than their internet provider's default.
Hosting a blog on Vercel or Netlify. When you point your domain at a hosting platform, it asks you to add a DNS record. Then its DNS and CDN send each visitor to a nearby edge location (a server close to the user). The idea from this lesson (put servers close to users) is already built into the platform for you.
Interview Questions
Q1Walk me through what happens when you type a URL and press Enter.
The browser reads the URL, then turns the domain into an IP through DNS (browser cache, OS cache, recursive resolver, then root → TLD → authoritative servers). It opens a TCP connection to port 443, runs a TLS handshake to agree on keys and verify the certificate, and sends an HTTP request. The request usually passes a CDN and a load balancer before an app server builds the response from cache or database. The response comes back as packets, and the browser renders the HTML and fetches the CSS, JS and images it references.
Q2Why do engineers lower a DNS TTL a few days before migrating servers?
DNS servers everywhere may keep the old answer for as long as the TTL says. If you lower the TTL in advance (say from a day to 60 seconds), then when the IP finally changes, the old copies expire within a minute instead of a day.
Q3What is the difference between an L4 and an L7 load balancer?
L4 works at the transport layer and sees only IPs and ports, so it forwards whole connections. L7 works at the application layer and can read the HTTP request (path, headers, cookies), so it can route /api to one pool and /images to another.
Q4Your servers are healthy but nobody can reach your site. What could be wrong?
The problem is probably the path to the servers, not the servers: DNS (expired domain, broken records, DNS provider outage), BGP routes withdrawn (as in Facebook's 2021 outage), an expired TLS certificate, or a CDN or load balancer misconfiguration. Tools such as dig (DNS lookup), traceroute (path) and curl -v (HTTP details) help you find the broken layer one step at a time.
Q5Why can't a faster server fix slow page loads for users in Australia?
Much of the time is spent on round trips, and the speed of light in fibre limits each round trip. The fix is to shorten the distance with CDNs and regional servers, and to cut the number of round trips (reusing connections, using HTTP/2 or HTTP/3, and having fewer requests that must finish first).
Key Takeaways
- Computers talk using IP addresses. DNS turns human-friendly names into those addresses.
- DNS answers are cached everywhere, and the TTL controls how long. That is why DNS changes take time to spread.
- Data travels in packets through many routers. BGP is how networks learn routes.
- Networking works in layers: link, IP, TCP/UDP, and HTTP on top. "L4" and "L7" come from this.
- Distance adds latency that you cannot remove, so big sites put servers and CDNs near users.
Further Reading
- Computer Networking: A Top-Down Approach by Kurose and Ross (chapters 1 and 4)
- High Performance Browser Networking by Ilya Grigorik (chapter 1, "Primer on Latency and Bandwidth")
- The open-source "what-happens-when" project on GitHub (a very detailed version of this lesson)
- Cloudflare Learning Center articles on DNS and BGP
Published by Jainik · Last updated · How these lessons are made
Keep learning
Related series