A DNS lookup is the process of translating a domain name, such as example.com, into an IP address before a network connection is made. It is a core part of how most internet traffic starts, because applications usually need the numeric address before they can reach a server.
In cyber security, DNS lookups matter because they create an early, observable signal. Security teams can log, filter, and analyze these requests to spot suspicious domains, infrastructure changes, or signs of malware command-and-control activity. Defenders also use DNS history and passive DNS records to trace relationships between domains and IPs. Attackers may try to bypass this layer by connecting directly to an IP address, which removes a useful detection point. That makes DNS visibility important, but not sufficient on its own; analysts also correlate firewall, proxy, and endpoint telemetry when hunting threats.