What Is a DNS Handshake?
Interactive DNS Lookup Guide
A DNS handshake is a simple way to describe the DNS lookup that happens before your browser connects to a website. Your device asks for the IP address of a domain name, receives a DNS answer, and then uses that address to start loading the site.
The more technical terms are DNS lookup or DNS resolution, but “DNS handshake” is a useful beginner phrase. This visual guide shows the request, the resolver answer, and the website connection step by step.
Quick note: DNS is separate from the TLS handshake used by HTTPS. DNS finds the server address first. TLS then helps secure the connection after your browser reaches the server.
About this free tool: this browser-based explainer uses example domains only. It shows a normal DNS lookup, then compares it with an encrypted or VPN-routed DNS path.
Initialising DNS handshake lab... This demo shows how a domain name becomes the IP address your browser needs.
-
1. Domain Request
Your device asks for a site
-
2. DNS Answer
The resolver returns an IP
-
3. Website Connects
The browser loads the site
DNS Handshake Explained
What a DNS Handshake Means
A DNS handshake is an easy way to describe the short request-and-response process that happens before a website loads. Your device asks where a domain name lives, and a DNS resolver replies with the IP address needed to reach it.
The phrase is beginner-friendly, but the more accurate technical terms are DNS lookup and DNS resolution.
How It Works Step by Step
- You enter a domain name. For example, you type example.com into your browser.
- Your device checks its cache. If the answer was recently saved, the browser may already know the IP address.
- Your device asks a DNS resolver. If there is no cached answer, it sends a DNS query to a resolver.
- The resolver finds the answer. It checks DNS records and returns the IP address for the domain.
- Your browser connects. Once the IP address is known, the browser can start loading the website.
DNS Handshake vs DNS Lookup
People often say “DNS handshake” when they are learning how websites connect, but “DNS lookup” is the more precise phrase.
| Phrase | Simple meaning | Accuracy |
|---|---|---|
| DNS handshake | A beginner-friendly way to describe the device and resolver exchanging a DNS request and answer. | Useful, but informal. |
| DNS lookup | Your device asks for the IP address of a domain name. | Technically accurate. |
| DNS resolution | The full process of finding the correct DNS answer. | Technically accurate. |
What Happens Before a Website Loads
A normal website visit usually includes several separate steps:
- DNS lookup: your device finds the website’s IP address.
- TCP or QUIC connection: your browser starts a network connection to the server.
- TLS handshake: for HTTPS sites, your browser and the server set up encryption.
- HTTP request: your browser asks the server for the page.
- Page loading: the browser downloads and displays the content.
DNS usually comes first because the browser needs to know which server to contact before it can connect.
DNS Handshake vs TLS Handshake
| Process | What it does | When it happens |
|---|---|---|
| DNS lookup | Finds the IP address for a domain name. | Before the browser connects to the server. |
| TLS handshake | Sets up an encrypted HTTPS connection. | After the browser reaches the server. |
Security Risks When DNS Goes Wrong
DNS is small, fast, and mostly invisible to the user, which is why attackers target it. If the DNS answer is changed, the browser can be sent to the wrong server before the user notices. For a visual example, see how DNS spoofing works.
DNS interception can also support fake login pages and traffic redirection. These attacks often overlap with broader interception techniques, so it also helps to understand how man-in-the-middle attacks work.
Why DNS Lookups Matter for Privacy
DNS requests can reveal which domains a device is trying to visit. Even when the final website uses HTTPS, a standard DNS lookup may still be visible to a network operator, internet provider, or DNS resolver. For more context, read our guide to what your ISP can see online.
This is why many people use encrypted DNS or a VPN that routes DNS through the VPN tunnel, especially on public Wi-Fi.
Does a VPN Change the DNS Handshake?
A VPN can change the DNS path if it sends DNS requests through the VPN tunnel to trusted DNS resolvers. This can reduce what the local network can see and can help prevent some local-network DNS tampering. To see where DNS fits into the tunnel, compare this with how a VPN connection works.
A VPN does not replace DNSSEC or HTTPS. It also does not guarantee every DNS answer is trustworthy. It mainly changes who can see or interfere with the lookup on the local network path.
DNS vs VPN vs Smart DNS
DNS, VPNs, proxies, and Smart DNS services are often mixed together, but they do different jobs. DNS helps find the right server, a VPN changes the network path, and Smart DNS is usually used to route selected location-based requests. For the bigger comparison, see our guide to VPNs, proxies and Smart DNS services.
| Protection | What it helps with | What it does not fully solve |
|---|---|---|
| DNSSEC | Helps validating resolvers check that DNS answers are authentic. | It does not hide every DNS request from the network path. |
| Encrypted DNS | Encrypts DNS queries between the device and the resolver. | It does not prove the resolver itself is trustworthy. |
| VPN DNS | Routes DNS through the VPN tunnel to reduce local-network snooping or tampering. | It does not replace DNSSEC, HTTPS, or good security habits. |
Public Wi-Fi DNS Risks
Public Wi-Fi is one of the places where DNS visibility and tampering matter most. A hostile or compromised network can try to observe DNS lookups, redirect users, or push fake login pages. For a broader walkthrough, see how hackers exploit public networks.
How to Make DNS Lookups Safer
- Use a trusted DNS resolver.
- Use DNSSEC-validating DNS where possible.
- Enable encrypted DNS if your browser, operating system, or router supports it.
- Use a VPN on public Wi-Fi if it prevents DNS leaks.
- Do not ignore HTTPS certificate warnings.
- Keep your router, browser, and operating system updated.
Quick Takeaway
A DNS handshake is the plain-English idea of your device asking DNS where a website lives. The accurate term is DNS lookup or DNS resolution. It happens before the browser can connect to the site, and it affects speed, privacy, and security.
Frequently Asked Questions
What is a DNS handshake?
A DNS handshake is an informal way to describe the DNS lookup process that happens before a website loads. Your device asks for the IP address of a domain name, receives an answer from a DNS resolver, and then uses that IP address to connect.
Is a DNS handshake the same as a DNS lookup?
In simple explanations, yes. The more technically accurate phrase is DNS lookup or DNS resolution. DNS handshake is a beginner-friendly phrase for the request-and-response process.
Does DNS happen before HTTPS?
Yes. DNS usually happens before your browser connects to the website server. After the IP address is found, the browser can connect and, for HTTPS sites, perform a TLS handshake.
Can someone see my DNS handshake?
On many standard networks, DNS requests may be visible to your internet provider, network operator, or DNS resolver. Encrypted DNS and VPN-routed DNS can reduce what local networks can see.
Can a VPN protect DNS requests?
A VPN can help if it routes DNS requests through the VPN tunnel and prevents DNS leaks. This can reduce local-network monitoring and tampering, but it does not replace DNSSEC or HTTPS.
Reviewed for Accuracy
This guide explains “DNS handshake” as a beginner-friendly phrase for DNS lookup and DNS resolution. It separates DNS, TLS, encrypted DNS, DNSSEC, and VPN DNS because each protects a different part of the connection process.
Published: 30 June 2026
Updated: 30 June 2026