LearnPart 5 of 8
How a domain becomes a website
When you visit a website, your browser asks DNS for the IP address stored in the domain's A, AAAA or CNAME records, connects to that server, checks its HTTPS certificate, and asks for the page. All of it usually takes well under a second.
In 30 seconds
- Your browser asks DNS for the address of the website's server.
- DNS finds it by asking the root, then the extension's servers, then your domain's nameservers.
- To connect a domain to a website, add the A or CNAME record your web host gives you.
- HTTPS needs a certificate for your domain; most hosts set one up for you for free.
Words with a dotted underline explain themselves: tap or hover them.
What happens when you type a web address
Type any web address below and step through what your browser does with it, from reading the address to drawing the page.
Step 1 of 11 · Browser
Read the address
The browser splits what you typed into the protocol (https), the hostname (www.example.com) and the path (/pricing). Only the hostname needs DNS.
The DNS lookup, in detail
Four kinds of server take part in a lookup:
| Server | What it knows | Run by |
|---|---|---|
| Recursive resolver | Nothing at first. It asks the others on your behalf and remembers the answers. | Your internet provider, your company, or a public service |
| Root servers | Which servers handle each extension. | Twelve organisations, coordinated by IANA |
| Extension (TLD) servers | Which nameservers handle each domain in the extension. | The registry, such as Verisign for .com |
| Authoritative nameservers | The domain's actual records: addresses, mail servers, text records. | Your DNS host |
The resolver starts at the top and follows referrals down the tree: the root sends it to .com, .com sends it to example.com's nameservers, and those give the answer. If a name is a CNAME record, the resolver starts again for the name it points to. If no record exists, the answer is NXDOMAIN, "no such name", and the browser shows a "site can't be reached" error.
Caching, TTL and "propagation"
Every DNS answer carries a (time to live): how many seconds it may be reused. Resolvers, operating systems and browsers all keep answers for that long, which is why most lookups finish in a few milliseconds and the root servers aren't asked about .com a billion times a minute.
It is also why a change can seem slow. Nothing actually "propagates"; your new record is live at your DNS host straight away, and each cache picks it up when its copy expires. Before a planned move, lower the TTL to five minutes a day ahead, make the change, then raise it again. The TTL guide has the numbers.
Pointing a domain at a website
Your web host tells you what to add. It will be one of these:
| Your host says | What to do |
|---|---|
| Point your domain to 203.0.113.10 | Add an A record for @ (the root domain) with that address. |
| Point your domain to 2001:db8::10 | Add an AAAA record, the IPv6 version of an A record. |
| Point www to yoursite.host.example | Add a CNAME record for www with that name. |
| Point your root domain to a name | Use your DNS host's ALIAS, ANAME or flattening option; see ALIAS records. |
| Change your nameservers to ns1.host.example | Change them at your registrar. This moves all of your DNS to the host. |
| Add a TXT record to verify | Add a TXT record with the exact value; it proves you control the domain. |
Then point the other version too, root domain or www, and redirect one to the other so there is one real address. More on www.
Change nameservers, or add records?
Changing nameservers moves every record, including email, to the new provider. Adding records changes only what you add. If your email works today and you only want a website, add records.
The most common way people break their email is switching nameservers to a web host that doesn't copy the MX record records across. If you do switch, copy every existing record to the new DNS host first. A DNS lookup shows what is there now.
The web server
Once the browser has an IP address, it connects to the server there, on port 443 for HTTPS. One server often hosts thousands of websites, so every request names the site it wants in a Host header, and the server picks the right one.
Often the address belongs to a (content delivery network) rather than the site's own server. CDNs answer from hundreds of locations at once, so visitors connect to one nearby, which serves cached copies and fetches the rest from the origin server behind it.
HTTPS and certificates
HTTPS is HTTP sent through an encrypted connection set up by TLS. Before anything is exchanged, the server shows a : a file, signed by a certificate authority your browser trusts, that says "this key belongs to www.example.com". The browser checks three things: the name matches, the signature is trusted, and the dates are current. If any check fails, you see a warning instead of the site.
- Getting one: the certificate authority checks you control the domain, by fetching a file from your site or looking for a TXT record. Most hosts do this for you automatically and for free.
- Renewing: certificates are short-lived, at most 200 days since March 2026, so automatic renewal matters.
- Restricting: a CAA record lists the authorities allowed to issue certificates for your domain.
- Checking: the free SSL checker shows any site's certificate and when it expires.
Domain forwarding and redirects
Registrars often offer domain forwarding: send everyone who visits example.net to example.com. Behind the scenes the registrar points your domain at its own web server, which replies with a redirect. Use a permanent redirect (301 or 308) so search engines move their listing to the new address, and avoid "masked" forwarding, which hides the real site in a frame.
When a website doesn't load
| What you see | Usual cause |
|---|---|
| "This site can't be reached" or NXDOMAIN | No A, AAAA or CNAME record for that exact name, or the nameservers at the registrar are wrong. |
| Your registrar's parking page | The domain still uses the registrar's default records. |
| Works for you, not for others (or the reverse) | Caches holding the old answer until the TTL runs out. |
| Root domain works but www doesn't, or the reverse | Only one of the two names has a record. |
| "Your connection is not private" | The certificate doesn't cover this name, or it has expired. |
| The whole domain stopped working at once | The domain expired or was suspended. Check its expiry date and status. |
A free domain report checks the registration, DNS, website and certificate together and points out what is wrong.
Questions people ask
How long does DNS take to update?
Your DNS host usually publishes a change within seconds. What takes time is caches around the world holding the old answer until its TTL runs out, often between five minutes and a day. Lowering the TTL a day before a planned change makes the switch quick.
Do I need to change nameservers to connect my domain to a website?
No. You can keep your nameservers and add the A or CNAME records your web host gives you. Changing nameservers hands every DNS record to the new provider, which is only worth it if you want them to manage all of your DNS.
What is the difference between an A record and a CNAME?
An A record points a name straight at an IPv4 address. A CNAME points a name at another name, and the lookup continues from there, so your host can change its servers without you editing anything. The root domain can't be a CNAME.
Why does my site say "not secure"?
Either it is served over plain HTTP, or its HTTPS certificate doesn't cover the exact name in the address bar or has expired. Most hosts issue free certificates automatically once the domain points at them.
Can one domain point to several websites?
Yes, through subdomains. example.com can point at your main site, shop.example.com at a store and docs.example.com at a documentation host, each with its own records.