Recursive DNS

A recursive DNS server is a resolver that accepts a query from a client and performs the full resolution process against authoritative servers itself. The client receives one finished answer rather than having to walk the name hierarchy on its own, which is what makes ordinary applications able to use the DNS without implementing any of its protocol logic.

Resolution starts at a root name server, continues to the TLD server (for example .com), and ends at the authoritative server for the domain. Along the way the resolver follows the NS records published at each level, asking each tier where the next one lives. The final answer — an A, AAAA or other record — is delivered to the client, along with a TTL it must respect for caching.

Caching is what makes recursive DNS workable at internet scale. Answers and intermediate referrals are kept for the duration of the record's TTL, and negative responses (NXDOMAIN, NODATA) are cached under the limit set by the zone's SOA minimum. The result is that most real-world queries are answered from local cache in microseconds, and only cold lookups pay the full hierarchy traversal cost. This caching also shapes DNS propagation when records change.

A validating recursive resolver also performs DNSSEC checks on every signed response, returning SERVFAIL if a signature is missing, expired or wrong rather than passing tampered data to the client. Well-known public services include 1.1.1.1 (Cloudflare), 8.8.8.8 (Google) and 9.9.9.9 (Quad9); most ISPs and enterprises run their own alongside.