My understanding of IPFS is that there is some DNS-and-HTTP translation step that resolves content to IPFS locations. Is that correct, and is it immutable? How does that work?
There are many gateways that allow viewing IPFS content over HTTP (e.g. ipfs.io), but the "true" IPFS experience is not over HTTP, it's done via P2P and addressed using content hashes. For example, one of my NFTs has content hash of
QmTqkpmbKmciQgqhUWpML7dsJ59MBEjgQd7wH853n4ASZM
I keep a copy of it on my computer (+ backups). If for some reason it were to be unhosted by every IPFS participant, I could become one, and re-establish my NFT. Image content -> content hash, so everyone would agree about content re-establishing.
Content on IPFS is keyed by hash values. The data is immutable at least to the extent that it's impractical to find a hash collision with sha256 (today). The content will also only remain up so long as someone (either the initial submitter or others) has it pinned. Otherwise, the content will, eventually, disappear.