Authoritative DNS

An authoritative DNS server is the official source for the contents of a DNS zone. It answers directly from its own zone data rather than from cache, and is the only kind of server that can publish changes to A, AAAA, MX and other records for a domain. A recursive resolver eventually asks an authoritative server for every fact it later caches.

Which servers are authoritative for a zone is defined by the zone's NS records and confirmed by the delegation in the parent zone (typically the TLD). The zone is anchored by a SOA record holding the serial number and synchronisation parameters. Changes are made on the primary authoritative server and distributed to secondaries via zone transfers (AXFR for full, IXFR for incremental), usually triggered by a NOTIFY from the primary so secondaries pick up the new serial within seconds.

Authoritative answers are flagged with the AA bit in the DNS response header, which is how a resolver can distinguish them from referral or cached answers. A negative response (NXDOMAIN) from an authoritative server is definitive for the zone; the same response from a recursive may simply be a cached prior answer.

Most serious deployments run authoritative and recursive functions on separate servers to avoid mixing roles and to reduce attack surface — authoritative servers are publicly reachable but answer only their own zones, while recursive resolvers serve a defined client population. Authoritative platforms are also where DNSSEC signing happens: zone keys live on the authoritative side, and RRSIG, DNSKEY and NSEC/NSEC3 records are published alongside the data they protect.