The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A recursive DNS resolver finds an answer for a client, either from its cache or by querying other DNS servers. An authoritative DNS server publishes the DNS data for zones it serves and answers from that local data. They are different roles, although one software installation or host can perform both.
Understanding the distinction explains why a computer normally contacts one server first, why that server may contact several others, and why DNS replies sometimes contain an answer, an error, or a referral to a different name server.
As an Amazon Associate I earn from qualifying purchases.
What is the difference between a recursive and an authoritative DNS server?
The word “DNS server” is incomplete on its own. It describes a system participating in DNS, but not what that system is doing for a particular query. The two principal roles have different sources of information and different responsibilities.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Aspect | Recursive resolver | Authoritative DNS server |
|---|---|---|
| Primary job | Obtains a final answer for a client by using cached data or querying other servers. | Answers from the DNS zone data it is configured to serve. |
| Where its knowledge comes from | Previously cached responses and answers gathered during resolution. | Local zone data, such as records published for a domain. |
| Upstream activity | May send queries to root, top-level-domain and authoritative servers, following referrals. | Normally answers from local knowledge; it can refer a querier to another server for delegated data. |
| Typical client result | Returns the answer or an error to the client when recursion is requested and available. | Returns authoritative data for served zones, or a referral when another server is responsible. |
| Precise name | Recursive resolver or recursive DNS service. | Authoritative name server or authoritative DNS service. |
RFC 9499, the IETF’s March 2024 DNS terminology reference, defines recursive mode as a server that “receives DNS queries and either responds to those queries from a local cache or sends queries to other servers in order to get the final answers to the original queries.” The same document attributes the authoritative-server definition to RFC 2182: a server “that knows the content of a DNS zone from local knowledge, and thus can answer queries about that zone without needing to query other servers.”
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
What does a recursive DNS resolver do?
A client device usually runs a small stub resolver. The stub does not normally walk the DNS hierarchy itself. Instead, it sends a question containing a domain name, record type and class to a recursive resolver configured by the operating system, network or administrator.
First, it checks its cache
If the resolver has a still-valid cached response, it can reply immediately. The cache may contain a positive answer, information about an alias, or a cached error. Cache state is why two resolvers can produce different results for the same name at the same moment: they may have learned the information at different times or followed different paths.
Then, it asks other DNS servers when necessary
When the cache cannot answer, the resolver sends DNS queries to other servers. It follows the delegation chain, using each response to decide where to ask next. The resolver, not the ordinary client, normally performs this sequence and returns the resulting answer or error to the client.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11It may resolve aliases and related records
A response can identify an alias rather than the final address record. The resolver may need additional queries to obtain the target data before constructing the response sent to the client. Consequently, the exact number and order of upstream queries depends on the records encountered, cache contents and server replies.
What does an authoritative DNS server do?
An authoritative server is responsible for one or more DNS zones. Its zone data is the local source of truth for names and records within those zones. It does not need to ask another server to know the records it is authoritative for.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Authoritative answers
When a query falls inside a served zone, the authoritative server can return the configured record data. A DNS response marks this kind of answer as authoritative in the message header. The answer is based on the zone’s published data, not on a cache assembled from unrelated servers.
Referrals for delegated data
DNS is hierarchical. A parent zone can delegate a child zone to different name servers. If a server receives a question for data outside the zone it serves but knows which servers are responsible for a delegated branch, it can return a referral. The referral directs the querier toward the servers that are closer to the requested data; it is not the final record answer.
Authoritative does not mean “recurses”
An authoritative service can be configured not to perform recursion. In that arrangement it answers for its own zones and returns referrals or errors for questions outside its authority. A server can also support both roles, so the presence of authoritative answers does not by itself reveal whether recursion is enabled.
How does DNS resolution work from a client to an authoritative answer?
The following sequence describes a normal lookup when the recursive resolver has no usable cached answer. Actual traffic can be shorter because of caching or longer because of aliases and additional records.
- The application asks the stub resolver. A browser, mail client or other program requests a name and record type, such as an address record.
- The stub sends a recursive request. It sends the DNS question to its configured recursive resolver, commonly with the Recursion Desired flag set.
- The resolver searches its cache. If it can answer from cached information, it returns that result without contacting an upstream server.
- The resolver contacts a server at the appropriate delegation level. If it lacks the needed information, it queries DNS servers and examines their answers or referrals.
- Referrals guide the next query. A referral identifies name servers responsible for a more specific delegated zone. The resolver queries one of those servers.
- An authoritative server supplies zone data. Once the resolver reaches a server authoritative for the requested name, it receives the record, an authoritative negative response, or another protocol-defined result.
- The resolver completes any required follow-up lookups. Aliases or related records can require additional queries before the resolver has the result requested by the client.
- The resolver caches what it is allowed to cache and replies. The client normally receives the resolver’s final answer or error, not each intermediate referral.
This is why a client can appear to contact only one DNS address even though several DNS servers participated behind the scenes.
Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
What are referrals, and how are they different from answers?
A referral says, in effect, “another server is responsible for the next part of this name.” It supplies delegation information so the resolver can continue. A final authoritative answer supplies the requested record data from the zone that owns it.
Recursive resolvers follow referrals on behalf of their clients. A non-recursive querier, including a resolver deliberately operating in iterative mode, may receive a referral and decide what to do next itself. Confusing a referral with a missing record is a common source of misleading DNS troubleshooting.
What do the RD and RA DNS flags mean?
RD and RA are separate header flags with different meanings.
| Flag | Meaning | What it does not prove |
|---|---|---|
| RD (Recursion Desired) | The client is asking the server to provide recursive service for this query. | It does not prove that the server can or will recurse. |
| RA (Recursion Available) | The server indicates that it is willing to provide recursive service. | It does not prove that the client requested recursion; availability is a server capability signal. |
RFC 1034 describes recursive mode as occurring when RD is set and the server is willing to provide the service. In a reply, inspect both flags: RD records the request, while RA reports the server’s willingness to recurse. A response can therefore have RA clear even when the client asked for recursion, or have RA set because the server offers recursion even if a particular query did not request it.
Can one DNS system be both recursive and authoritative?
Yes. The roles are functional descriptions, not a requirement that every role run on a separate product or machine. A DNS software package or host can serve local zones authoritatively and also resolve external names recursively.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
That combination does not make the roles interchangeable. For each query, ask which function is being used:
- Is the server obtaining information for a client, potentially by querying elsewhere? That is recursive service.
- Is it answering from a zone it operates and publishes? That is authoritative service.
- Is it returning directions to another name server for delegated data? That is referral behavior, normally associated with authoritative knowledge of the delegation.
Operational documentation should therefore say “recursive resolver,” “authoritative name server,” or “both,” rather than simply “DNS server.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you tell which role answered a query?
Command-line DNS tools expose the clues in a response. The exact display varies by tool, but the following tests illustrate the questions to ask.
Test a normal recursive lookup
dig example.com ALook at the response flags. rd shows that the request asked for recursion; ra indicates that the server says recursion is available. The answer section shows the result returned to the client. This command usually queries the resolver configured for the machine.
Ask a server without requesting recursion
dig @server.example example.com A +norecurseThe +norecurse option clears RD. A server that is authoritative for the name can answer from its zone. A server that is not authoritative may return a referral or another non-recursive response instead of obtaining the final answer for you.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Observe the hierarchy
dig +trace example.comThis mode makes the tool follow the delegation path and display successive responses. It is useful for seeing where a referral occurs, but it is not the same as asking your normal recursive resolver for one final response.
When interpreting output, distinguish the answer section from the authority and additional sections. A referral can contain name-server information without containing the address record you originally wanted.
What happens when DNS cannot return a normal answer?
A recursive resolver can return an error when it cannot complete resolution. The reason may be a negative authoritative response, an unavailable upstream server, a delegation problem or another DNS failure. The client sees the resolver’s final response, while the resolver may have encountered several intermediate responses.
Free tools Windows power users keep installed
One-click scans. No signup required.
An empty answer section does not automatically mean that the domain does not exist. The response code and authority information matter, as does the record type requested. For example, a name may exist but have no record of the particular type queried. Check the status field, authority section and whether the response is authoritative before deciding what failed.
Why the distinction matters in real networks
- Configuration: A recursive resolver needs permission and network reachability to query upstream servers; an authoritative server needs accurate zone data and delegation.
- Troubleshooting: If a client receives stale or unexpected data, investigate resolver cache and upstream resolution. If every resolver receives the same wrong data, inspect the authoritative zone and delegation.
- Testing: Querying a recursive resolver tests the path available to clients. Querying an authoritative server directly tests published zone data and avoids relying on the resolver’s cache.
- Documentation: Naming the role prevents teams from assuming that a server offering authoritative data also provides recursion, or that a resolver is authoritative for the names it can resolve.
Which standards define these terms?
RFC 9499, DNS Terminology, published by the IETF in March 2024, is the current terminology reference identified here and obsoletes RFC 8499. RFC 1034, Domain Names—Concepts and Facilities, published in November 1987, describes the foundational recursive and non-recursive service model. RFC 1035, Domain Names—Implementation and Specification, published in November 1987, specifies DNS message details including header flags. RFC 8499, published in January 2019, remains useful historical terminology but has been superseded by RFC 9499.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
