One server usually finds another by asking DNS to translate a name into an address, then connecting to that address. Private DNS limits where certain names can be resolved; service discovery can go further by identifying service instances and their ports. These mechanisms help locate a destination, but none alone proves that it is healthy, reachable, or authorized to serve a request.
How does one server find another?
Suppose an application needs to reach api.example.com. It asks its host’s configured DNS resolver for records associated with that name. The resolver may already have a cached answer. Otherwise, a recursive resolver follows DNS referrals until it can obtain an answer from a server authoritative for the relevant zone, then returns the response to the client. The application uses the resulting address to attempt a connection.
As an Amazon Associate I earn from qualifying purchases.
- The application has a name. It may be configured directly or supplied by another part of the system.
- The host sends a DNS query. Its configured resolver may be a local or network resolver, often a recursive resolver.
- The resolver finds an answer. It can return a cached response or query other DNS servers, ultimately consulting authoritative records as needed.
- The application connects. An A record supplies an IPv4 address; an AAAA record supplies an IPv6 address. The application then attempts to reach the returned destination.
The recursive resolver does the lookup on the client’s behalf; an authoritative server holds the original records for its DNS zone. A DNS answer addresses a naming question, not a health check or security decision. A returned address can be stale while cached, and a valid record does not show that a process is listening, that network routes allow access, or that the server will authenticate the client.
What do DNS, private DNS, and service discovery each do?
| Approach | What it answers | Typical scope | What the client receives |
|---|---|---|---|
| Ordinary DNS | Which address is associated with this name? | Often public internet, though DNS can also serve internal names | Records such as A or AAAA addresses |
| Private DNS | Which records are visible to clients in an authorized environment? | A private network, VPC, or other configured scope | Internal records, potentially different answers from public DNS |
| Service discovery | Which instances provide this service, and how should a client reach them? | Depends on the discovery system, such as DNS-SD or a cluster | May include instance names, target hosts, ports, and attributes |
These are complementary ideas, not mutually exclusive products. Private DNS describes record visibility and resolution scope. Service discovery describes how a client learns about service instances and connection details; it may use DNS records as its mechanism.
#1 Best Overall
- Used Book in Good Condition
What makes private DNS private?
A public DNS zone can be queried from the public internet. A private zone is not publicly queryable and can be made available only to selected networks or other authorized resolver contexts. For example, Google Cloud documents VMs using a configured metadata-server resolver to look up private-zone records when they are on an authorized VPC network. An internal name such as db-01.dev.example.com can then resolve to an internal address. This illustrates one provider’s setup; resolver addresses and controls differ across platforms.
Private DNS can also support split-horizon resolution: a name can return an internal answer to a client inside an authorized network and a different public answer to an outside client. Zone matching matters. In Google Cloud’s documented behavior, a query matching an authorized private zone but lacking a record there can return NXDOMAIN even when a public zone has a record with that name. Overlapping zones can therefore shadow public records; review the resolver’s matching and query-order rules for the platform you use.
Forwarding and peering are ways to make DNS queries reach another authority or network. Their configuration and behavior are platform-specific, so confirm the resolver rules for each connected environment rather than assuming private zones are automatically visible everywhere.
How does service discovery find an instance and port?
For a client that needs more than a host address, DNS-Based Service Discovery (DNS-SD) defines a sequence using ordinary DNS record types. As specified in IETF RFC 6763, a client can query PTR records for a service type and naming domain. The returned names identify service instances. The client can then query an instance’s SRV record for its target hostname and port, and its TXT record for associated attributes.
An SRV record also contains priority and weight fields. The discovery convention only helps when the application supports it: a client making a basic A or AAAA lookup will not necessarily query or honor SRV records. DNS-SD and application-specific hostname lookups are related, but they are not interchangeable in every software stack.
How Kubernetes uses DNS for Services
Kubernetes gives Services DNS names so workloads can use a stable service name instead of tracking changing Pod addresses directly. As the official documentation puts it, “You can contact Services with consistent DNS names instead of IP addresses.” The exact cluster domain and implementation details can vary by configuration.
- Regular Service: its DNS A or AAAA record resolves to the Service’s cluster IP, a stable virtual address for the Service.
- Headless Service: its DNS answer contains the addresses of selected Pods. A client can consume the returned set or use ordinary round-robin selection.
- Named ports: Kubernetes also defines SRV records. For a regular Service, a record identifies the Service name and port; for a headless Service, DNS can return one record per backing Pod.
For a specific cluster, check its DNS configuration and Service definitions before relying on a particular name or record shape. Kubernetes behavior is an example of service discovery within a platform, not a universal DNS rule.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What DNS-based discovery does not guarantee
- Service health: a record can exist even when the application is down or not listening.
- Network reachability: routing, firewalls, policies, and the target port determine whether a connection can be made.
- Authentication or confidentiality: knowing an address does not authenticate either endpoint or encrypt application traffic.
- Instant updates: DNS responses can be cached according to their TTL, so record changes are not necessarily reflected immediately by every client.
Use DNS for naming and discovery, and use separate health checks, network controls, and application-level authentication where those guarantees are required.
What can private DNS and DNS-SD reveal?
A private zone keeps records out of public DNS, but it does not make names secret from authorized network clients or infrastructure able to query or observe the resolver. Keep access controls and application authentication in place.
DNS-SD can expose service-instance names, node names, and related properties to parties able to query or observe its records. IETF RFC 8882 describes these privacy and security considerations. Consider what service and device names disclose, and who can see the records, when choosing what to publish.
Which approach should you use?
- Use ordinary DNS when a client needs a hostname mapped to an address and the intended resolvers can see the record.
- Use private DNS when internal names or addresses should resolve only in selected networks, or when internal clients need answers distinct from public DNS.
- Use service discovery when clients need to learn which service instances exist and may need their individual target hosts, ports, or attributes.
- Combine them when appropriate: for example, a discovery mechanism can publish records into a privately scoped DNS environment.
For any design, decide who owns record updates, which clients may resolve the names, how the resolver handles overlapping zones, and how clients behave while cached answers remain valid. Those details determine whether a name is useful in practice—not just whether a record exists.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
