When people say “the DNS server,” they’re usually collapsing two very different roles into one idea. DNS is split between recursive resolvers and authoritative name servers, each with a distinct job and a strict boundary of responsibility.
That split explains how DNS behaves under load, during outages, and when things go wrong.
Two roles, one system
DNS works because different servers agree to answer different questions:
- Recursive resolvers find answers.
- Authoritative name servers publish answers.
They cooperate, but they don’t overlap, and the separation is foundational to how DNS scales.
What a recursive resolver does
A recursive resolver does the work on behalf of a client. When a laptop, phone, or application needs an address for a name, it sends one query to its resolver that amounts to “find the answer for me.”
The resolver then:
- Checks its cache.
- If no cached answer exists, walks the DNS hierarchy.
- Returns the final answer to the client.
- Caches the result for future queries, respecting TTLs.
This is the role played by your ISP’s resolver, public services such as 1.1.1.1 and 8.8.8.8, and the protective resolvers organizations run for their own networks. Clients almost never contact authoritative servers directly.
www.example.com. The resolver has no cached entry, so it queries a root server, then a .com server, then the authoritative servers for example.com. The final A record is returned to the laptop and cached.
Resolvers are tuned for volume, with aggressive caching and fast answers that hide the machinery from end devices.
What an authoritative name server does
An authoritative name server doesn’t search, recurse, or cache answers for others.
Its job is simpler and stricter: store the records for its zones, answer queries about those zones, and respond with authority or not at all. Asked about a name below a delegation it holds, it returns a referral. Asked about a zone it doesn’t host at all, an authoritative-only server typically refuses the query. It never tries to help further, because authority must be unambiguous.
Where resolvers are tuned for volume, authoritative servers are tuned for correctness and availability.
Why the roles are separated
A single server that both finds answers and publishes them sounds convenient, and some server software can do both. Operational practice keeps the roles apart, and RFC guidance recommends separating them as much as practical.
Keeping recursion and authority apart prevents circular dependencies. It lets caching exist without corrupting authoritative data. It limits the blast radius when either side misbehaves. And it lets resolution and publishing scale independently, which is why DNS survives partial outages that would take down a more entangled design.
The boundary is enforced in both directions
A resolver can’t modify the authoritative source data, stretch TTLs beyond what was published, or pose as authoritative for zones it doesn’t control. A policy-enforcing resolver may deliberately change what it returns, but that’s configured policy, not a claim about the source. Resolvers that step outside these lines by accident produce the kind of pathology that is miserable to debug, because the answers stop having a traceable origin.
An authoritative server, for its part, must not recurse for clients, guess about zones it doesn’t hold, or cache for unrelated domains. Most authoritative platforms ship with recursion disabled outright.
How this looks in a real lookup
The client never sees the root, TLD, or authoritative servers. It sees only its resolver. That indirection is the design working as intended.
Why this distinction matters operationally
Many DNS problems get easier the moment you ask: is this failing at the recursive layer or the authoritative layer?
Slow browsing usually points at the resolver or its cache misses. Wrong answers usually point at authoritative data. Intermittent weirdness often means caches disagreeing across resolvers.
Security follows the same boundary. Attackers use resolvers for amplification and authoritative infrastructure for domain abuse, different roles with different mechanics. The recursive layer is also where DNS filtering lives, since a resolver can evaluate policy before it answers.
Summary
Resolvers find and cache answers for clients. Authoritative servers publish answers for zones they control. They cooperate through boundaries that both sides enforce, and DNS works at internet scale because those boundaries hold.
Once you know who’s allowed to answer which questions, you also know where to look when the answers go wrong.