What Happens When You Type a URL and Press Enter

Introduction¶

"What happens when you type example.com and press Enter" is a classic interview question because it touches every layer of the stack. It's also a genuinely useful mental checklist: when a site is slow or broken, knowing the stages tells you where to look first.

The stages¶

1. URL parsing¶

The browser splits the URL into scheme (https), host (example.com), port (default 443), path (/), and query string. If you typed something that isn't a URL, it goes to the default search engine instead.

2. DNS resolution¶

The browser needs an IP for example.com. It checks, in order: its own cache, the OS cache, then asks the configured resolver (your router, or 1.1.1.1 / 8.8.8.8). The resolver either has it cached or walks the hierarchy — root → .com → example.com's authoritative nameservers.

dig +trace example.com A

3. TCP connection¶

With an IP, the browser opens a TCP connection to port 443 — the three-way handshake (SYN, SYN-ACK, ACK). On a fresh connection this is one round trip.

curl -w "tcp connect: %{time_connect}s\n" -o /dev/null -s https://example.com

4. TLS handshake¶

For HTTPS, TLS negotiates a cipher, the server presents its certificate, and both sides derive session keys. TLS 1.3 does this in one round trip (or zero on resumption); TLS 1.2 takes two. The client sends the hostname in the SNI extension so the server knows which certificate to present.

curl -w "tls handshake done at: %{time_appconnect}s\n" -o /dev/null -s https://example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

5. HTTP request and response¶

The browser sends GET / HTTP/2 with headers (Host, User-Agent, Accept, cookies). The server responds with a status line, headers, and the HTML body. The time from request sent to first byte received is TTFB — mostly server processing plus one network round trip.

curl -w "ttfb: %{time_starttransfer}s   total: %{time_total}s\n" -o /dev/null -s https://example.com

6. Parsing and subresources¶

The browser parses the HTML, and for each <script>, <link rel=stylesheet>, <img> it discovers, it fetches that resource — often reusing the existing HTTP/2 connection, or opening new ones for other hosts (each needing its own DNS + TCP + TLS). Render-blocking CSS and synchronous JS in <head> delay first paint.

7. Render¶

Layout, paint, composite. JavaScript may then mutate the DOM, triggering more of the same.

Watch the whole thing¶

curl's timing breakdown in one shot:

curl -s -o /dev/null -w "
dns:      %{time_namelookup}s
connect:  %{time_connect}s
tls:      %{time_appconnect}s
ttfb:     %{time_starttransfer}s
total:    %{time_total}s
" https://example.com

Each number is cumulative from the start. Subtract to get each phase: tls - connect is the TLS handshake, ttfb - tls is the server's think time.

Where problems live¶

Related tools and reading¶

• On-site: HTTP Checker, DNS Lookup, SSL/TLS Checker, Traceroute.
• Related posts: DNS resolution, step by step, The TCP three-way handshake, The TLS 1.3 handshake.