1. The stub
Your operating system has a stub resolver. Apps ask it for a name. The stub almost never talks to the root itself; it forwards the question to a recursive resolver configured via DHCP, a VPN, or a manual setting such as Cloudflare or Google Public DNS.
2. The recursor
The recursive resolver’s job is to get a final answer. If it has a cached record whose TTL has not expired, it returns that and stops. Otherwise it starts at the root hints — a baked-in list of root server addresses — and asks, in effect, “who knows about com?” The root does not know example.com’s IP. It returns NS records (and glue) for the com TLD.
3. The TLD
The TLD nameservers know which nameservers the registrar delegated for example.com. They return those NS records. If the nameservers are inside the same domain, the parent also supplies glue A/AAAA records so the recursor is not stuck in a loop.
4. The authority
Authoritative servers for the zone return the record you asked for, or NXDOMAIN, or a CNAME that sends the recursor on another hunt. They are the source of truth for that zone. If you edit DNS in a panel that is not actually authoritative — a classic mismatch with NS at the registrar — nothing you save will be visible here. Check with an NS lookup first.
Caching and “propagation”
Each answer carries a TTL. Recursors, and sometimes stub caches, keep the answer that long. There is no instant worldwide overwrite. Lower the TTL a day before a migration if you can. After the change, wait at least the old TTL. DNSFetch caches for five minutes so our own repeats are cheap; your ISP may cache longer. See DNS caching and TTL.
Transport notes
Classic DNS uses UDP port 53, falling back to TCP for large answers. DNS-over-HTTPS and DNS-over-TLS encrypt the path from stub to recursor; they do not encrypt the recursor’s queries to authoritative servers unless those servers also speak encrypted DNS. DNSSEC signs records so a cache cannot quietly swap an IP. That is a separate layer, covered in DNSSEC.
To watch a real answer, use the DNS lookup tool and compare it with dig +trace example.com on a machine you trust.