Part 1 · Foundations Before System Design

What Happens When You Type a URL and Press Enter?

The one second between pressing Enter and seeing a page hides a DNS lookup, a trip through a dozen routers, two handshakes and a server doing real work. Every later lesson zooms into one part of that journey.

Lesson 0110 min readbeginner#networking#dns#basics

On this page

  1. The Problem
  2. The Core Idea
  3. How It Works
  4. Trade-offs
  5. In the Real World
  6. Interview Questions
  7. Key Takeaways
  8. Further Reading

The Problem

You type www.amazon.com into your browser, press Enter, and less than a second later the page appears. It feels instant. But if you want to design systems for millions of users, you need to understand what happens in that second. Every step is a place where things can be slow, can break, or can be made better.

When a website is slow or down, the problem can be in any of these places:

  • the name lookup,
  • the network path,
  • the server,
  • or the database.

This lesson walks through the whole journey. Every later lesson in this series looks at one part of it in more detail.

The Core Idea

Think about sending a letter to a friend. You know your friend's name, but the post office needs an address. So first you look up the address in your contact book. Then you write it on the envelope and put it in a post box. The letter goes through several sorting centres until it reaches your friend's house. Your friend reads it and sends a reply the same way.

The internet works the same way:

Letter worldInternet world
Friend's name ("Priya")Domain name (amazon.com)
Contact bookDNS (Domain Name System)
House addressIP address (52.94.236.248)
EnvelopePacket
Sorting centresRouters
Your friendThe web server

Two ideas matter most in this lesson:

  1. Computers find each other by IP address, not by name. Names are for humans.
  2. Data travels in small pieces called packets. A packet is a small chunk of data with an address on it. Each packet finds its own way across many networks.

How It Works

Here is the full journey, from pressing Enter to seeing the page:

  1. 1
    Browser reads the URL
    protocol, domain, path and query string
  2. 2
    DNS lookup
    browser cache → OS cache → resolver → root → .com → Amazon's DNS
  3. 3
    TCP handshake
    SYN, SYN-ACK, ACK — one round trip before any data moves
  4. 4
    TLS handshake
    agree on keys and check the certificate (HTTPS only)
  5. 5
    HTTP request
    GET /deals?page=2 with headers and cookies
  6. 6
    Server does the work
    CDN edge → load balancer → app server → cache → database
  7. 7
    HTTP response
    200 OK plus HTML, split into packets of up to about 1,500 bytes
  8. 8
    Browser renders
    parses HTML, then fetches dozens of CSS, JS and image files
The whole journey, from Enter to pixels. Every later lesson explains one of these boxes in detail. · flow

Let's go through each step.

Step 1: The browser reads the URL

A URL (Uniform Resource Locator) is the full address of a page or file on the web. A URL like https://www.amazon.com/deals?page=2 has parts:

  • https is the protocol: the set of rules for how to talk (secure HTTP).
  • www.amazon.com is the domain name: the human-friendly name of who to talk to.
  • /deals is the path: what you want.
  • ?page=2 is the query string: extra details.

If you typed something that is not a URL, like "best laptops", the browser sends it to a search engine instead.

Step 2: DNS, the internet's phone book

Your computer cannot connect to "www.amazon.com". It needs a number, an IP address. An IP address is the number that identifies one machine on a network. DNS (Domain Name System) is a worldwide system of servers that turns a name into that number. A cache is a saved copy of an answer, kept so that the next request is faster.

The lookup tries the fastest options first:

  1. Browser cache. Did I look this up in the last few minutes?
  2. Operating system cache. Did any app on this computer look it up?
  3. Recursive resolver. A DNS server that looks up the answer for you. It is usually your internet provider's DNS server, or a public one like Google's 8.8.8.8 or Cloudflare's 1.1.1.1. It does the hard work for you.

If the resolver doesn't know the answer, it asks a chain of servers. The root serversknow who runs each top-level domain, such as .com. The TLD servers know who runs each name under that top-level domain, such as amazon.com. The authoritative server (Amazon's own DNS here) holds the final answer.

step 1 / 9
Laptop
Resolver
Root
.com TLD
Amazon DNS
  1. not in browser or OS cache
  2. who handles .com?
  3. ask the .com servers
  4. who handles amazon.com?
  5. ask Amazon's name servers
  6. 52.94.236.248
    TTL 300 s
  7. The resolver caches the answer for the TTL, so the next person on your ISP skips all of this
  8. 52.94.236.248
A DNS cache miss. The recursive resolver does all the asking; your laptop asks once and waits. · sequence · step through

The resolver saves (caches) the answer for a while and gives it to your computer.

TTL (Time To Live). Every DNS answer comes with a TTL. It is a number of seconds that says how long the answer may be cached. This creates a trade-off:

  • Long TTL (for example, a day): fewer lookups and faster browsing. But if the company changes its server IP, some users keep going to the old address for up to a day.
  • Short TTL (for example, 60 seconds): changes spread quickly, but the DNS servers have to answer more queries.

That is why engineers lower the TTL a few days before a server migration.

Common DNS record types. A DNS record is one saved fact about a domain. Each record has a type:

RecordWhat it doesExample
AName → IPv4 addressamazon.com → 52.94.236.248
AAAAName → IPv6 addressgoogle.com → 2607:f8b0:...
CNAMEName → another name (an alias)www.shop.com → shop.netlify.app
MXWhere to deliver emailgmail.com → gmail-smtp-in.l.google.com
TXTFree text, often for verificationDomain ownership, email security (SPF is a list of servers allowed to send email for the domain)
NSWhich servers are in charge of this domainexample.com → ns1.example-dns.com

When you connect your own domain to a hosting platform like Vercel, you usually add an A or CNAME record. This means you are editing DNS.

Step 3: IP addresses, packets and routers

Now the browser knows the IP address, so it can start talking.

IP addresses come in two versions:

  • IPv4 looks like 192.168.1.10. There are only about 4.3 billion of these, and the free ones have run out.
  • IPv6 looks like 2001:db8::1. There are so many that we will not run out.

Public vs private IPs. A public IP can be reached from the whole internet. A private IP works only inside one local network. Your laptop at home probably has a private address like 192.168.1.5. Your Wi-Fi router has one public address that every device in the house shares. The router uses NAT (Network Address Translation). NAT is a trick where the router rewrites outgoing packets so they carry the public address, and remembers which reply belongs to which device. This is why your laptop can visit websites, but a stranger on the internet cannot connect directly to your laptop.

Packets. Your request is not sent as one big piece. It is cut into packets, usually up to about 1,500 bytes each. Each packet carries:

  • a source IP (you),
  • a destination IP (Amazon),
  • and a piece of the data.

Routers are the sorting centres. A router is a device that passes packets from one network to the next. Each router looks at the destination IP and sends the packet one "hop" (one step) closer. A router does not read your data. It only looks at the address on the envelope. A packet from India to a US server might pass through 10 to 20 routers.

You can see this yourself with a command-line tool that lists every router on the path:

Text
traceroute www.google.com     # macOS / Linuxtracert www.google.com        # Windows

Each line is one router on the path, with the time it took to reach it.

How do routers know the way? Big networks (internet providers, cloud companies, Google, Facebook) use BGP (Border Gateway Protocol). BGP is the protocol that networks use to announce "I can reach these IP addresses". Other networks learn routes from these announcements. BGP is the internet's map, built by many companies telling each other which roads they own.

Ports. An IP address finds the machine. A port is a number (0 to 65535) that finds one program on that machine, like an apartment number inside a building. Some well-known ports:

  • 80 for HTTP (the web protocol, without encryption),
  • 443 for HTTPS,
  • 22 for SSH (a protocol for logging in to a remote machine safely),
  • 5432 for PostgreSQL (a database),
  • 53 for DNS.

Step 4: The network layers

Networking is organised in layers. A layer is one level that does one job and trusts the layer below it. The simple TCP/IP model has four:

Application · L7
HTTP, DNS, TLS — “What are we saying?”
Transport · L4
TCP, UDP — “Is it reliable? Which program (port)?”
Internet · L3
IP — “Which machine, which route?”
Link · L2
Wi-Fi, Ethernet — “How do bits cross this cable?”
The four-layer TCP/IP model. Each layer does one job and trusts the one below it. · layers

You will also hear about the OSI model, which has 7 layers. In system design, people often say "Layer 4" and "Layer 7". These numbers come from the OSI model:

  • Layer 4 means the transport layer (TCP and UDP, the two ways to send data between programs).
  • Layer 7 means the application layer (HTTP).

This matters later. A load balancer is a server that shares incoming requests between many identical servers. An L4 load balancer only sees IPs and ports. An L7 load balancer can read the URL and headers.

Step 5: Connect, secure, request

Next, the browser:

  1. opens a TCP connection (a quick three-message "hello" called a handshake, covered in the next lesson),
  2. sets up TLS encryption for HTTPS (lesson 3). TLS (Transport Layer Security) is the protocol that scrambles data so that nobody on the path can read it,
  3. sends an HTTP request (HTTP is the protocol for asking a server for a page), such as GET /deals?page=2.

Step 6: The server does the work

The request usually does not go to a single computer. On a big site it passes through several tiers. A CDN (Content Delivery Network) is a group of servers around the world that keep copies of files close to users. A cache such as Redis is a very fast store that keeps recent answers in memory. The database stores the real data for the long term.

  1. 1
    Your browser
    sends GET /deals?page=2
  2. 2
    CDN edge
    a nearby copy of images, CSS and JS — often answers without going further
  3. 3
    Load balancer
    spreads requests across many identical servers
  4. 4
    App server
    runs the code for this page
  5. 5
    Cache (Redis)
    “Do we already have the answer?” — sub-millisecond
  6. 6
    Database
    “Fetch the deals for page 2” — the slowest, most precious tier
On a big site, one request passes several tiers before it reaches any data. · flow

Each of these gets its own lesson later in the course.

Step 7 and 8: Response and rendering

The server sends back an HTTP response, like 200 OK with HTML. HTML is the text that describes the page. The browser:

  1. reads the HTML,
  2. finds links to CSS, JavaScript and images,
  3. requests all of those too (often dozens of extra requests),
  4. builds the page on your screen.

Open your browser's DevTools, go to the Network tab and reload any site. You will see every request, and how much time each one spent on DNS, connecting, TLS, waiting and downloading.

Why distance matters: latency

Latency is the time it takes for data to get from one place to another. A round trip is the trip there and back. Signals in fibre-optic cable travel at about 200,000 km per second, roughly two-thirds of the speed of light. That sounds instant, but:

  • London → New York is about 5,500 km. One way takes at least about 28 ms, so a round trip takes about 56 ms.
  • London → Sydney is about 17,000 km. The round trip is at least about 170 ms, and often 250 ms or more in practice.

A page that needs 4 or 5 round trips before showing anything will feel slow to someone far away, no matter how fast the server is. This is why companies put servers and CDNs close to users. You cannot make light faster, but you can make the distance shorter.

~56 ms
London ⇄ New York
round trip, at best
~170 ms
London ⇄ Sydney
often 250 ms+ in practice
4–5 × RTT
before first byte
DNS + TCP + TLS + request
Light in fibre covers about 200,000 km/s. Distance sets a minimum latency that no server can beat. RTT means round-trip time. · numbers
Try it yourself

Open DevTools → Network, reload any site and hover the waterfall bar of the first request. You will see the exact time spent in each step of this lesson: DNS lookup, initial connection, SSL, waiting (server time) and content download.

Trade-offs

  • DNS caching: makes browsing fast, but makes changes slow to spread. The TTL is the setting that controls this.
  • Many small packets vs fewer large ones: small packets recover from loss more easily. Large ones waste less space on headers.
  • NAT: saves IPv4 addresses and hides home devices, but makes direct device-to-device connections (like video calls or gaming) harder. That is why apps like Zoom need extra steps to connect two users.
  • Relying on one DNS provider: simple, but if that provider goes down, your site "disappears" even though your servers are fine.

In the Real World

Facebook's 6-hour outage (October 2021). During routine maintenance, a configuration change caused Facebook's BGP routes to be withdrawn (taken away). The rest of the internet no longer knew how to reach Facebook's networks, including its DNS servers. Every DNS lookup for facebook.com, instagram.com and whatsapp.com failed. Billions of users were affected, and even Facebook's employees reportedly had trouble getting into buildings because internal tools were down. The servers themselves were running fine. The problem was that nobody could find them.

The Dyn DNS attack (October 2016). A huge attack from hacked internet-connected devices (the Mirai botnet) sent so much traffic to Dyn, a major DNS provider, that it could not answer real users. Sites like Twitter, Netflix, Reddit and GitHub became unreachable for many users on the US East Coast. After this, many companies started using more than one DNS provider.

Public DNS resolvers. Google (8.8.8.8) and Cloudflare (1.1.1.1) run free resolvers used by millions. Some people switch to them because they can be faster or more private than their internet provider's default.

Hosting a blog on Vercel or Netlify. When you point your domain at a hosting platform, it asks you to add a DNS record. Then its DNS and CDN send each visitor to a nearby edge location (a server close to the user). The idea from this lesson (put servers close to users) is already built into the platform for you.

Interview Questions

Q1Walk me through what happens when you type a URL and press Enter.

The browser reads the URL, then turns the domain into an IP through DNS (browser cache, OS cache, recursive resolver, then root → TLD → authoritative servers). It opens a TCP connection to port 443, runs a TLS handshake to agree on keys and verify the certificate, and sends an HTTP request. The request usually passes a CDN and a load balancer before an app server builds the response from cache or database. The response comes back as packets, and the browser renders the HTML and fetches the CSS, JS and images it references.

Q2Why do engineers lower a DNS TTL a few days before migrating servers?

DNS servers everywhere may keep the old answer for as long as the TTL says. If you lower the TTL in advance (say from a day to 60 seconds), then when the IP finally changes, the old copies expire within a minute instead of a day.

Q3What is the difference between an L4 and an L7 load balancer?

L4 works at the transport layer and sees only IPs and ports, so it forwards whole connections. L7 works at the application layer and can read the HTTP request (path, headers, cookies), so it can route /api to one pool and /images to another.

Q4Your servers are healthy but nobody can reach your site. What could be wrong?

The problem is probably the path to the servers, not the servers: DNS (expired domain, broken records, DNS provider outage), BGP routes withdrawn (as in Facebook's 2021 outage), an expired TLS certificate, or a CDN or load balancer misconfiguration. Tools such as dig (DNS lookup), traceroute (path) and curl -v (HTTP details) help you find the broken layer one step at a time.

Q5Why can't a faster server fix slow page loads for users in Australia?

Much of the time is spent on round trips, and the speed of light in fibre limits each round trip. The fix is to shorten the distance with CDNs and regional servers, and to cut the number of round trips (reusing connections, using HTTP/2 or HTTP/3, and having fewer requests that must finish first).

Key Takeaways

  • Computers talk using IP addresses. DNS turns human-friendly names into those addresses.
  • DNS answers are cached everywhere, and the TTL controls how long. That is why DNS changes take time to spread.
  • Data travels in packets through many routers. BGP is how networks learn routes.
  • Networking works in layers: link, IP, TCP/UDP, and HTTP on top. "L4" and "L7" come from this.
  • Distance adds latency that you cannot remove, so big sites put servers and CDNs near users.

Further Reading

  • Computer Networking: A Top-Down Approach by Kurose and Ross (chapters 1 and 4)
  • High Performance Browser Networking by Ilya Grigorik (chapter 1, "Primer on Latency and Bandwidth")
  • The open-source "what-happens-when" project on GitHub (a very detailed version of this lesson)
  • Cloudflare Learning Center articles on DNS and BGP

Published by Jainik · Last updated · How these lessons are made

Keep learning

Related series