A Domain Name System (DNS) server acts like a dictionary that translates domain names into IP addresses. Arranged in a hierarchy, DNS servers allow devices to look up domain names, which form the foundation of the internet.
Depending on an organization’s security and connectivity needs, DNS servers fall into two distinct categories. Public DNS servers are accessible to any internet user with a connected device, while private DNS servers are managed environments where access, resolution rules, and policies are controlled by the organization.
Because of this flexibility, there are many options for how a DNS server can be set up within an organization. This article explores the different types of DNS server setups and the main differences between public and private DNS servers, including their respective use cases and properties.
Communication between servers and devices happens via IP address exchanges, not domain names. As mentioned above, DNS servers convert human-readable domain names into numerical IP addresses. This process can be compared to matchmaking between web browsers and the web pages that users look for.
The DNS is hierarchical and consists of the following layers:
What does this hierarchy mean in practice? If a DNS server lacks the requested IP address, it queries other servers until it finds the correct one. These constant exchanges help keep the data up to date and resolve requests.
By default, devices use a DNS server provided by their internet service provider (ISP). However, users or organizations can manually configure their devices to use different DNS servers, creating a clear distinction between public and private DNS servers.
It is a DNS service that an organization controls and configures for its own users or devices. It works much like a public DNS from an end user’s perspective, but the organization decides how domain names get resolved, which sites are blocked, and which security and privacy rules apply. Private DNS can be self-hosted or delivered as a commercial SaaS product.
Depending on how and where it is implemented, the term private DNS can refer to different setups:
Importantly, private DNS is not limited to internal or local IP addresses. It can resolve any public domain—the organization simply controls how that resolution happens.
A common private DNS setup works like this: a user types a domain name in their browser, and the device sends a query, searching for an IP address matching that domain. From there:
A public DNS resolves public domain names into public IP addresses.
Public DNS servers are accessible to anyone with an internet connection and are often provided by internet service providers or third-party companies like Google (8.8.8.8) or Cloudflare (1.1.1.1).
These servers are most commonly used by individuals and organizations that do not require organizational control over their DNS queries. Public DNS offers a straightforward and efficient way to navigate the web and helps users access websites quickly and reliably.
With private DNS, the process starts with a DNS request. A user types a website address (URL) into their browser, and this is what happens next:
Though it looks like a time-consuming process, DNS responses are usually very fast, often taking just milliseconds. However, the speed of these responses depends on connectivity and transmission latency.
The key goal of public and private DNS is the same: to translate domain names into IP addresses. From a user’s point of view, both work the same way—users type in a requested domain name and, in a few seconds, they can access its content.
The difference is on the administrator’s side. With private DNS, an organization can control how a human-readable domain gets resolved and which sites users can reach. A few examples:
Here’s how public and private DNS services compare:
Area of comparison | Public DNS | Private DNS |
|---|---|---|
Access | Unrestricted. Open to anyone globally with a device connected to the internet. | Restricted. Limited to authorized users or devices only. |
Control and management | Operated and maintained by an internet service provider (ISP) or a third-party provider like Cloudflare or Google. | Managed and controlled by an organization. It can be self-hosted or hosted by a SaaS-based provider. |
Security | Standard resolution with limited organizational security controls. | Supports encrypted queries, content filtering, blocklists, and organization-defined policies. |
Customization | Very limited options for the user and organization. | Extensive—custom domain resolution, content filtering, security rules, and access policies. |
Speed | Historically slower, but global infrastructures now offer better uptime, reliability, and speeds. | Can be faster for internal or frequently accessed resources, depending on the setup. |
Organizations often combine private and public DNS servers for their day-to-day operations. One of the most common setups involves maintaining an external DNS server that handles public web traffic, with a separate internal DNS server that holds data for the company’s private, local assets.
Managing a dual-DNS setup demands extra effort from network administrators, but it is an essential best practice for organizations that want to achieve strong security.
However, by using private DNS, organizations that use private DNS gain 3 major advantages over those that rely solely on a public DNS configuration:
Can having an in-house DNS server protect you from all risks? Not really. For a network to stay protected, every user must actually route their traffic through the company’s DNS server. However, that can be difficult to enforce, especially if the business has a bring-your-own-device (BYOD) policy. Remote users can switch DNS servers at any time, putting the company at additional risk.
From an administrator’s perspective, having control of a DNS server also means limiting the harmful websites available to any given user. This acts as an additional barrier to protect endpoints and helps protect the company’s resources.
With NordLayer’s custom DNS, your organization can route internet traffic through its own DNS servers instead of the default ones provided by NordLayer. This allows you to enforce your DNS rules automatically and helps secure access to internal resources.
Another NordLayer feature that helps prevent DNS-related risks is DNS filtering by category. It allows admins to block access to websites belonging to a specific category, such as phishing or gaming sites.
Want to learn more about how NordLayer can help your business? Contact us.
Joanna Krysińska
Senior Cybersecurity Copywriter
Joanna writes about zero trust, network security, access control, and threat prevention, but her cup of tea is compliance and how regulations shape security controls. Her work also includes the dark web topics and the methods cybercriminals use to target companies, such as social engineering or ransomware attacks, for example.
Subscribe to our blog updates for in-depth perspectives on cybersecurity.
