When an application needs an IP address for a hostname, its stub resolver typically asks a recursive resolver. That resolver either returns usable cached data or follows DNS referrals from the root, through the relevant top-level domain, to an authoritative name server. It then returns an answer or an error. This is a distributed lookup, not a search of one global database.
What happens when an application looks up a hostname?
The lookup involves distinct roles. The application relies on a stub resolver, usually provided by its operating system or runtime. The stub sends the query to a recursive resolver, which does the work of obtaining an answer on the client’s behalf. An authoritative name server serves DNS data for a zone. These roles and the referral process are described in RFC 1034.
As an Amazon Associate I earn from qualifying purchases.
“Recursive” describes the service the client requests: return an answer, or report why one could not be obtained. The resolver may perform several queries to other servers to fulfill that request. Those other servers commonly respond with referrals rather than performing the entire lookup themselves.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow does a DNS lookup work step by step?
- The client forms a question. The application needs a particular record type for a name—for example, an A record for an IPv4 address. The stub resolver sends that question to its configured recursive resolver.
- The recursive resolver checks its cache. If it has usable data for the queried name and type, it can return that data without contacting authoritative servers. If not, it begins resolving the name through DNS delegations.
- The resolver asks a root server where to continue. If it does not already have the necessary referral information cached, it queries a root server. The root can refer it to the appropriate top-level domain’s name servers.
- The resolver asks a top-level domain server for the next referral. For example, a server responsible for a top-level domain can refer the resolver to the name servers authoritative for the relevant domain.
- The resolver asks an authoritative server for the requested data. The authoritative server responds based on the contents of its zone. The response can contain the requested record, an alias such as a CNAME that leads to further data, or an error.
- The resolver returns the result to the stub. It can retain cacheable data for later queries, subject to the data’s TTL, and sends the response or failure back to the client.
This is a logical path, not a guarantee that every query contacts each level. A resolver may already have relevant referrals or answer data cached, and the exact sequence depends on the name, record type, delegation data, and cache state. DNS architecture and response behavior are covered in RFC 1034.
#1 Best Overall
What is the difference between a recursive resolver and an authoritative name server?
| Role | What it does | What it returns |
|---|---|---|
| Stub resolver | Acts for an application and sends its DNS question to a recursive resolver. | The response it receives from the recursive resolver. |
| Recursive resolver | Handles the client’s request, using cached data when valid or querying other DNS servers as needed. | An answer or an error; it may obtain the answer by following referrals. |
| Authoritative name server | Serves DNS records for a zone for which it is authoritative. | Data from that zone, or a relevant response such as an error. |
A recursive resolver is not necessarily authoritative for the names it resolves. Conversely, an authoritative server supplies data for its zone; it is not, simply by being authoritative, the client’s recursive service. This distinction is central to the DNS architecture in RFC 1034.
What is a DNS record, and why does the query type matter?
A DNS resource record has an owner name, a type, a class, a TTL, and type-specific data. Engineers most often encounter A records for IPv4 addresses, AAAA records for IPv6 addresses, CNAME records for aliases, and NS records for name-server information. The DNS message and record format are specified in RFC 1035.
A DNS question asks for a particular type of information. An answer to an A query does not establish that an AAAA query for the same name will return the same result—or any result. When investigating a discrepancy, keep the queried name and record type attached to each observation.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does DNS TTL mean?
The time to live (TTL) is the maximum period a cache may retain a resource record. The zone administrator sets the TTL for the data, and a TTL of zero prohibits caching. A resolver’s cached copy ages: when its remaining TTL expires, the resolver must obtain usable data again rather than continue relying on that expired cache entry. The TTL model is described in RFC 1034.
Rank #3
- Used Book in Good Condition
A shorter TTL can reduce how long caches retain an answer after an authoritative change, but it also reduces the opportunity to reuse cached answers. Lowering a TTL ahead of a planned change cannot shorten the lifetime of copies that caches already stored with the former, longer TTL; those copies may remain usable until their existing lifetime runs out. Changing an authoritative record therefore does not instantly flush recursive caches worldwide.
How to reason about a change or incident
- Identify which resolver answered the client. Different resolvers can have different cache state.
- Record the queried name and record type. An A result and an AAAA result answer different questions.
- Check the response code and the answer contents, including whether a CNAME appears before the data you expected.
- Check the TTL remaining in the response. It indicates how much cache lifetime remains for that returned record.
- Compare the recursive answer with the authoritative data, allowing for cached data and its remaining lifetime.
What changes with DNS over HTTPS?
Classic DNS uses the message format specified in RFC 1035 and is commonly carried over UDP or TCP. DNS over HTTPS (DoH) carries DNS queries and responses in HTTP exchanges over HTTPS. As RFC 8484 puts it, “This document defines a protocol for sending DNS queries and getting DNS responses over HTTPS.” DoH focuses on communication between a DNS client, such as a stub resolver, and a recursive resolver; it preserves DNS message semantics while changing the transport.
Rank #4
That transport change can protect the client-to-DoH-resolver connection from on-path observation or interference in ways that traditional unencrypted DNS transport does not. It also means the client is using the chosen DoH provider as its resolver. DoH does not make all DNS activity private: the resolver receives the queries, and DNS can still involve correlation and metadata across network and HTTP layers. These considerations are discussed in RFC 8484.
DoH and HTTP caching
DoH does not let an HTTP cache extend DNS data beyond its DNS TTL. RFC 8484 requires an HTTP response’s freshness lifetime not to exceed the smallest TTL in its Answer section and recommends making the values equal. A DoH client also takes the HTTP Age header into account when determining the remaining DNS TTL.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is DoH the same thing as DNSSEC?
No. DoH concerns the transport between a DNS client and a resolver. DNSSEC addresses authenticity of DNS data; HTTPS by itself does not establish that the DNS answer is authentic. The standards are compatible but address different problems. RFC 8484 states: “DNSSEC and DoH are independent and fully compatible protocols, each solving different problems.”
| Mechanism | Question it addresses | What it does not establish by itself |
|---|---|---|
| Classic DNS transport | How DNS messages are carried, commonly over UDP or TCP. | Authenticity of DNS data. |
| DNS over HTTPS | How DNS messages are carried between a client and resolver: through HTTPS. | That the DNS data is authentic merely because the transport uses HTTPS. |
| DNSSEC | Authenticity of DNS data through DNSSEC validation. | Which transport the client uses to communicate with its resolver. |
Transport choice and DNS data validation are separate decisions. A DoH connection and DNSSEC validation can be used together; using DoH alone is not a substitute for DNSSEC.
Can a resolver answer after a record’s TTL expires?
It can, under a defined resiliency mechanism. RFC 8767 standardizes serving stale DNS data to improve resilience. Under that behavior, a resolver may return an expired record; a stale record returned in a response must have a TTL greater than zero, with 30 seconds recommended by the RFC. This is not a universal behavior of every resolver, so TTL expiry does not guarantee that every resolver immediately has no answer.
Recommended Free Tools
Which DNS detail should you check first?
For an engineer tracing a lookup, the useful unit of evidence is not just “the hostname resolves” or “the change has propagated.” Capture the name and record type, the resolver that answered, the response code and returned records, and the remaining TTL. Then determine whether the answer came from usable cache, a fresh authoritative query, or—in implementations that support it—a stale-data resiliency path. That separates a difference in data from a difference in resolver state or transport.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
