DNS
The internet's name system. Stub asks recursive; recursive walks to authoritative. Analysts live in the query log.
Domain Name System maps names to answers: addresses, mail servers, aliases, policy text. A stub resolver on the host asks a recursive resolver, which walks from the root to the authoritative servers that hold the zone. Query in, response out, plus a time-to-live.
If DNS lies or dies, everything above it looks broken: websites, mail, single sign-on, updates. Malware, phishing, and command-and-control almost always leave DNS. NXDOMAIN spikes, odd types, brand-new domains, and answers that keep changing are cheap signals. Log it. Use a resolver you actually trust.
See also: Authoritative vs recursive DNS, DNSSEC, DNS over HTTPS and DNS over TLS, TTL.
Fact source: IETF RFC 1034, DNS concepts.