Stub resolver
Receives a request from an application and sends a DNS query to a configured recursive service. It normally has little or no knowledge of the hierarchy.
Fundamentals
A distributed namespace, not a central directory
DNS maps names to typed data by splitting one global tree into independently administered zones. Delegation connects those zones without requiring one organisation to store every answer.
The namespace
Names form a tree read from right to left
The fully qualified domain name www.example.com. consists of labels. The final dot represents the root, com is below the root, example is below com, and www is below example.com.
DNS names are case-insensitive for comparison, although original letter case may be preserved. A complete wire-format name is limited to 255 octets, and an individual label to 63 octets.
.comexamplewww
The dot at the end is normally omitted in everyday writing but matters in zone files, where it distinguishes an absolute name from a name relative to the current origin.
Zones and delegation
A domain and a zone are related, but not identical
A domain is a branch of the namespace. A zone is the portion of that branch served as one administrative unit. A zone stops where it delegates a child zone.
A parent publishes the child’s NS records. When the child’s name servers live inside the child zone—such as ns1.example.com for example.com—the parent also supplies address records called glue so resolvers can reach them without circular dependency.
Delegation data exists in two places.
The parent’s delegation and the child zone’s apex NS RRset should agree. Mismatches may work intermittently and are easy to miss when caches are warm.
DNS roles
Do not collapse every component into “the DNS server”
Recursive resolver
Returns a final answer or an error. It follows referrals, caches RRsets, performs retries and can validate DNSSEC.
Forwarder
Sends queries to another recursive resolver rather than performing full iteration itself. Forwarding centralises policy but also shifts trust and visibility.
Authoritative server
Answers from configured zone data. It is authoritative only for those zones and should not offer open recursion.
Queries and responses
A compact binary protocol
A DNS message contains a header and up to four sections: Question, Answer, Authority and Additional. Flags communicate intent and status:
- RD / RA
- Recursion desired / recursion available
- AA
- The answer is authoritative for the queried name
- AD / CD
- Authenticated data / checking disabled, used with DNSSEC validation
- TC
- The response was truncated and should usually be retried over a transport that can carry the full answer
DNS began with UDP and TCP on port 53. EDNS extends the protocol, including larger UDP payloads and option space. Modern deployments should be prepared for both UDP and TCP; treating TCP as an optional fallback is operationally unsafe.
Failure vocabulary
“DNS is down” hides very different conditions
NOERRORThe query was processed. The requested type may still be absent; that is called NODATA.
NXDOMAINThe queried name does not exist. A signed zone can authenticate this denial.
SERVFAILResolution failed—for example because all authoritative paths failed or DNSSEC validation was bogus.
REFUSEDThe server understood the query but policy forbids answering it.
FORMERRThe message format was unacceptable or malformed.
TIMEOUTNo usable response arrived; this is a client observation, not a DNS RCODE.