What does "DNS search domains" mean?

[v074]

When I try to configure VPN on my Android phone, one of the things it requests you to fill out is the "DNS search domains". What does that mean? I know that "domain" means a website and that "DNS" stands for "Domain Name System".

 

[Pinhedd]

the DNS search domain is what the DNS service will use to resolve hostnames that are not fully qualified.

A fully qualified domain name is one that can be resolved by working down from the root domain (which is just an empty string) and eventually ending up with an IP address. In less technical terms, it's one that ends in a top-level-domain such as .com, .org, .net, .ca, etc... The root domain holds the name servers for the global top level domains.

For example, www.google.com. is a fully qualified domain name (FQDN) in the global DNS hierarchy, as is myhost.example.com. What you can't see here is the invisible root domain after the com. (the period is intentional, it's implicit in most applications) and there's no resolving above the root domain. However, myhost on its own is not fully qualified and attempting to locate it can result in ambiguity.

An FQDN is characteristically non-ambiguous. There may be multiple IP addresses associated with a single hostname, but there will never be two conflicting DNS results. There could be a myhost.example.com and a myhost.example2.com, so there needs to be a mechanism to remove this ambiguity and that's what the DNS search domains entry is. This is an ordered list of domains which will be appended to a hostname that is not fully qualified.

Many companies and organizations use internal intranets with their own DNS servers. It's common practice to use non-global domains for practical and security purposes. Common internal domains are ".local", ".localdomain", and ".corp". These domains are not able to be found through the root domain and are analogous to private networks such as the popular 192.168.0.0/16. A machine may have a DNS entry for somehost.localdomain but there may also be a somehost.otherdomain with records on the same nameserver, the search domains will tell it which one to pick first.

If you don't have an intranet on the far side and are only using it to tunnel out through a remote gateway, just leave it blank or put "local"

EDIT: the search domain for the public DNS system is the root domain, so that's why you've likely never seen it before.