Everything you need to understand DNX.

Networks do not send files or messages. They send packets: small chunks of data, typically around 1,500 bytes, each carrying enough labelling to travel independently.

A packet is built in layers, like an envelope inside an envelope. Each layer adds a header saying what the layer beneath needs to know, and treats everything above it as opaque cargo.

A number identifying a network interface — 203.0.113.7 in the familiar form. Critically, it describes where something is attached, not what or who it is. Move a laptop to a different network and it gets a different address, because the address describes the connection point.

This is the single fact that explains most of the rest of networking's complexity. An address is a location, and locations change, and locations prove nothing about identity.

No router knows where every machine on Earth is. There are billions, and the table would be impossible. Instead routers work with prefixes — blocks of addresses that share a beginning.

A router holds a rule like "anything starting 203.0.113 goes out this port". One line covers 256 machines. Bigger blocks cover millions. This is aggregation, and it is what makes the Internet possible.

The original address space allowed about 4.3 billion addresses, and we ran out. Network Address Translation was the workaround: give a whole household or office one public address, and let the router rewrite outgoing packets so they all appear to come from it, keeping a table to send replies back to the right machine.

It worked, and it is why the Internet did not seize up. But it broke something fundamental: machines behind NAT have no address anyone outside can reach. Your laptop can start conversations, but nothing outside can start one with it — there is no entry in the translation table yet, so the router does not know where to send it.

Port forwarding, dynamic DNS, VPNs, relay servers and "hole punching" all exist to work around this one consequence.

People cannot remember numbers, so the Domain Name System translates example.com into an address before your machine connects. It is hierarchical and delegated: whoever runs .com points at whoever runs example.com, who points at the actual records.

Two consequences matter for DNX. First, answers are cached with a time-to-live, so a machine that moves can be unreachable for minutes or hours while the world holds a stale answer. Second, and more importantly: once the name becomes an address, the name stops mattering. Every router afterwards sees only numbers.

A keypair is two matched numbers. One is private and never leaves your machine; the other is public and you hand it to anyone.

The private key can produce a signature over a message. Anyone holding the public key can check that signature. Nobody can forge it without the private key. That is the whole idea, and it gives you something an address never can: proof that a specific holder of a secret produced this exact message.

DNX uses this to bind a name to a keypair. Reaching a name and proving who answered become the same operation.

Because the network layer proves nothing. When you connect to an address, you have no idea who is on the other end — so TLS runs above the connection, presenting a certificate that some authority vouches for, and then encrypting everything.

It works well. But notice the shape of it: identity was not part of addressing, so it had to be added on top afterwards, with its own separate trust system. DNX's question is what happens if identity is part of the address from the beginning.

Here is the trick that makes NAT-crossing possible without configuring anything. Two machines, both behind routers that block unexpected incoming traffic, both want to talk.

A third party that both can reach — because outbound always works — tells each about the other. Then both send packets outward at the same moment. Each outgoing packet creates an entry in its own router's translation table, and that entry is exactly what allows the other side's traffic in.

The insight worth keeping: NAT was never blocking inbound traffic. It was blocking unexpected inbound traffic. Make it expected at both ends simultaneously and the wall opens from the inside.

An overlay is a network built on top of another one. Its packets travel as ordinary payload inside the network beneath, which means it can invent its own addressing without asking anyone's permission or replacing any hardware.

This is how new networking ideas actually get deployed. IP itself began as an overlay on the telephone system. Nobody removed the copper — it simply stopped being what anyone thought about.

Put the previous nine lessons together and a pattern appears. Addresses are locations, so identity had to be bolted on afterwards (TLS). Addresses ran out, so NAT appeared, so reachability broke, so VPNs and relays appeared. Names get translated away immediately, so the network never benefits from their structure.

DNX asks: what if the name kept mattering all the way down?

• The name is bound to a key, so reaching it and verifying it are one operation — no separate certificate system.
• The name hierarchy is the routing hierarchy, so aggregation comes from the namespace's own structure rather than from address allocation policy.
• Hole punching is built in, so a machine behind a home router is addressable with no configuration at all.
• It runs as an overlay, so none of this requires replacing hardware or coordinating a flag day.

Whether that is a good idea is exactly what the project is trying to find out. The specification describes how it works and lists what is broken; the comparisons cover the many cases where an existing tool is the better answer.