Authoritative, recursive and root DNS servers

Overview

Every time a browser loads a site, several different DNS servers cooperate, and "DNS server" is an overloaded word: a root server, a TLD server, your ISP's recursive resolver, and the authoritative nameserver for the domain all play different roles. Knowing which one you are looking at is the difference between a correct nslookup reading and a false alarm.

The three roles

| Role | Owns what | Who runs it |

| Root servers | The top of the tree: pointers to each TLD's nameservers (13 logical root server addresses, run across many machines worldwide) | ICANN, root operators |

| TLD servers | The .com, .org, .net zone, delegate every registered domain to its authoritative nameservers | Registry operators |

| Authoritative nameserver | The records for your domain (A, MX, TXT), the "source of truth" | Your registrar or DNS host |

A fourth role is the recursive resolver, sometimes called a "recursive DNS server" or "caching namespace": the one your computer actually asks, which walks the tree and caches the answer. Root and TLD servers answer the resolver's delegation questions; they never hold your domain's records.

The full lookup journey

1. Your browser asks the recursive resolver (typically your ISP's, or a public one like 8.8.8.8 / 1.1.1.1) for www.example.com.
2. The resolver asks a root server: "who is authoritative for .com?" The root answers with the .com TLD server addresses.
3. The resolver asks the .com TLD server: "who is authoritative for example.com?" The TLD replies with your registrar-configured nameserver names.
4. The resolver asks the authoritative nameservers for the A record of www.example.com and receives the IP.
5. The resolver caches the result for the TTL and returns the IP to the browser.

Only the authoritative server holds your records. Verify that directly: nslookup -type=NS example.com prints the delegated nameservers, and nslookup www.example.com <that nameserver> forces the resolver to query them specifically.

Which role do you manage?

Small site owners rarely run a root or TLD server. What they configure is usually:

• Authoritative: the zone on your registrar or DNS host, where you add A, CNAME, MX and TXT records. This is "our DNS."
• Recursive: the resolver settings on your router, computer or mobile, or the public DNS you choose in network settings. This is the "check with 8.8.8.8" trick you use for diagnostics.

The same three-letter distinctions also cause confusion in outages: an outage of your authoritative provider makes the domain unresolvable for everyone; an outage or misconfiguration of your recursive resolver makes it fail only for you. Getting both right usually means records live in the authoritative registrar zone, and diagnostics point at a public recursive server.

Common troubleshooting directions

• If the domain does not resolve for anyone: authoritative. nslookup -type=NS, check the registrar delegation, check the zone, check SOA.
• If the domain does not resolve only on your network: recursive. Try public DNS, flush the local cache, and switch networks to confirm it is environmental.
• If the record changed but looks old everywhere: TTL and cache. The TTL article and the propagation article both live in this corpus.

Deep detail

The naming is awkwardly reversed: "authoritative" expresses who owns the record, "recursive" expresses who does the walking. Many who are not network operators use "DNS server" to mean the recursive resolver they configure through their ISP. For a site maintainer, the key takeaway is that the authoritative server decides the live answer and the recursive server remembers it. Both belong to you only in so far as you configure a resolver; the authoritative nameserver is always the zone owner's choice.

The record types reference lists the records the authoritative server serves; the propagation article watches them spread.