When you make a DNS query, why does the packet's destination MAC = your default gateway's MAC, but the destination IP = the DNS server's IP?
Because DNS servers are typically outside your subnet — Layer 2 (MAC) addresses next-hop, Layer 3 (IP) addresses end-destination. The gateway forwards the packet to the right network.
The packet anatomy:
[ Ethernet ]
Dst MAC = gateway's MAC (e.g., 00:1A:2B:...)
Src MAC = your MAC
[ IP ]
Dst IP = 8.8.8.8 (DNS server)
Src IP = your IP
[ UDP ]
Dst port = 53
Src port = ephemeral (e.g., 51428)
[ DNS query: "What's the A record for google.com?" ]
Why this layered addressing:
Layer 2 (Ethernet) only delivers within the LAN — to the next physical hop. Layer 3 (IP) tracks the end-to-end destination. Each hop:
- Looks at the dest IP
- Decides "this is for X subnet, the next hop is router Y"
- Rewrites the MAC to router Y's MAC
- Forwards
So MACs change at every router, IPs stay constant.
When the DNS server IS local:
If you have a DNS server on your LAN (e.g., Pi-hole at 192.168.1.10), then the dest MAC would be the DNS server's MAC directly — no gateway hop needed. ARP would resolve 192.168.1.10's MAC, and that MAC goes in the Ethernet header.
This is the same logic as ARP:
DNS query going to an external IP follows the same rule as any external traffic:
1. Routing table: "8.8.8.8 not on local network → use default gateway"
2. ARP cache: "Default gateway is 192.168.1.1, MAC is XX:XX:..."
3. Build packet with gateway MAC + DNS server IP
Tip: This is also why a misconfigured gateway breaks DNS even though the DNS server's IP is reachable — the packets can't physically leave your LAN to reach it.
Go deeper:
Default gateway (Wikipedia) — why off-subnet traffic is framed to the gateway's MAC while the IP stays end-to-end.- MAC address (Wikipedia) — the Layer-2 addressing that gets rewritten at each hop.