Domain, DNS and SSL Explained: How Browsers Find Your Site

A domain is the name people type into the address bar. DNS is the system that translates that name into a server’s address. SSL (strictly speaking, TLS) is the encryption that keeps the connection from being read or tampered with on the way; you see it as the padlock in the browser.

The three are tied together: without DNS the name leads nowhere, and without SSL the browser warns visitors that the site isn’t secure, and most of them leave. Here is how they work together and where people usually trip up on launch.

The domain: a name you rent

You don’t buy a domain forever. You register it for a period, usually a year, and renew it. The company you registered it with is called the registrar.

Things worth doing right away:

turn on auto-renewal and check that the card on file isn’t about to expire;
register the domain to the company’s or founder’s account, not a freelancer’s or contractor’s;
enable two-factor login at the registrar, because whoever controls the domain controls the site and the email.

An expired domain is one of the dumbest and most expensive outages: the site and email vanish at once, and sometimes the name can’t be recovered.

How DNS works

Computers on the internet find each other by IP address, a string of numbers like 203.0.113.10. DNS is the phone book that lists an address next to each name.

When someone opens your site, the browser asks DNS “where does example.com live?” and gets an answer. The entries in that book come in several types:

A record points a name to a server’s IPv4 address. If you run your own server, this is the one.
AAAA does the same for IPv6.
CNAME points a name to another name. Hosting platforms often ask for this: “point www to your-project.platform.app”.
MX says where to deliver email for the domain.
TXT holds service text: domain ownership verification, email anti-spoofing settings.

Records are edited in the dashboard of whoever serves DNS for the domain. That isn’t always the registrar: if you moved DNS to another provider, edits at the registrar simply have no effect. The domain’s NS records tell you who is actually answering.

Why DNS changes take time

You changed a record, you still see the old site, and your colleague sees the new one. This is normal and is called propagation.

DNS answers are cached by internet providers, by the operating system and by the browser. Every record has a TTL, the number of seconds it may be cached. Until that runs out, some people see the old value. Things usually settle within minutes or hours, but with a long TTL it can take a day.

A practical trick: before a migration, lower the TTL on the relevant records to a few minutes, wait until the old TTL has expired, then change the address. Once you’ve moved, you can raise it again.

SSL and the padlock: what it actually means

An SSL certificate proves that the server really is responsible for the domain and lets the connection be encrypted. Without it, passwords, tokens and form data travel in plain text, and the browser shows a scary warning.

It is worth knowing what the padlock does not mean. It doesn’t say the site is honest or secure on the inside. It only says the connection is protected and leads to whoever controls the domain.

Certificates are now issued for free and automatically. Hosting platforms handle it themselves; on your own server it’s usually a one-time setup in the web server or proxy. Certificates are short-lived and must renew automatically, because an expired certificate breaks a site just as reliably as an expired domain.

Common mistakes when connecting a domain

The site works on www but not without it, or the other way round. Set up both and redirect one to the other.
Two records for the same name with different addresses, so half the visitors land on the old server.
The certificate covers only one name while people open the site under another.
The site is served over both http and https. Everything should redirect to https.
DNS edits are made in a dashboard that no longer controls the domain.
MX records get deleted during a site migration, and email disappears with them.

In short

A domain is a rented name, DNS is the address book, SSL is the protected connection.
Turn on auto-renewal and two-factor login at your registrar.
An A record points to an IP address, a CNAME to another name, MX to your email.
DNS changes spread gradually because of caching; lower the TTL before a migration.
Certificates should renew themselves, and all traffic should go over https.

If connecting a domain has turned into a quest, SUBXCAT can set up DNS, email and certificates so you can stop thinking about them.