DNS Recursive Resolution: Mermaid Sequence Diagram

DNS Recursive Resolution sequence diagram

About Source

DNS recursive resolution is the process by which a recursive resolver queries the DNS hierarchy on behalf of a client, walking from root servers down to an authoritative name server to obtain a definitive answer.

While How DNS Works gives a broad overview of the DNS lookup chain including caching, this diagram focuses specifically on the recursive resolver's behavior — the detailed query-response exchanges it performs when no cached answer is available.

A recursive resolver (also called a full-service resolver) takes on the burden of iteratively querying the DNS hierarchy so the client doesn't have to. When a stub resolver on your machine sends a query, it simply expects a final answer; the recursive resolver handles all intermediate steps.

The resolver starts by querying one of the 13 root server clusters. Root servers don't hold IP-to-hostname mappings — they only know which TLD name servers are authoritative for each top-level domain. The response is a referral: "I don't know, but ask these servers."

The resolver follows the referral to the appropriate TLD name server (e.g., .com TLD servers). Again it receives a referral — this time pointing to the domain's own authoritative name server. Only the authoritative server holds the actual resource records (A, AAAA, MX, CNAME, etc.) for the domain.

Each intermediate step typically involves a UDP query on port 53, with TCP fallback for responses larger than 512 bytes (or always with EDNS0). DNSSEC adds cryptographic signatures at each delegation step, allowing resolvers to verify that responses haven't been tampered with.

The final authoritative answer is returned up the chain and cached at the resolver with the record's TTL. This recursive pattern is why changing a DNS record doesn't propagate instantly — each resolver must wait for its cached copy to expire before re-querying the authoritative server. For privacy-focused variants of this process, see DNS over HTTPS Flow and DNS over TLS Flow.

Frequently asked questions

DNS recursive resolution is the process where a recursive resolver — acting on behalf of a client's stub resolver — iteratively queries the DNS hierarchy to obtain a definitive answer. The client sends a single query and expects a final answer; the recursive resolver handles all intermediate steps from root servers down to the authoritative name server.

The resolver first queries a root name server, which responds with a referral to the appropriate TLD name server (e.g., `.com`). The TLD server provides a referral to the domain's authoritative name server. The authoritative server holds the actual resource records (A, AAAA, MX, etc.) and returns the definitive answer. Each step uses UDP on port 53, with TCP fallback for large responses.

In recursive resolution, the client asks the resolver to do all the work and return a final answer. In iterative resolution, the client itself queries each server in the hierarchy, following referrals at each step. Stub resolvers on end-user devices use recursive mode; recursive resolvers use iterative queries to the DNS hierarchy on the client's behalf.

The most common issue is stale cached responses — resolvers serve old records until the TTL expires. DNSSEC validation failures can cause resolution to fail entirely if signatures don't verify. Firewalls blocking UDP port 53 or ICMP can prevent fallback to TCP, causing timeouts. Poisoning attacks (injecting false responses) are mitigated by DNSSEC and random source ports.

mermaid

sequenceDiagram
    participant StubResolver as Stub Resolver (Client)
    participant Recursive as Recursive Resolver
    participant Root as Root Name Server
    participant TLD as TLD Name Server (.com)
    participant Auth as Authoritative Name Server

    StubResolver->&gt;Recursive: Recursive query: api.example.com?
    note">Note over Recursive: Check local cache — miss

    Recursive->&gt;Root: Iterative query: api.example.com?
    Root-->&gt;Recursive: Referral: ask a.gtld-servers.net for .com

    Recursive->&gt;TLD: Iterative query: api.example.com?
    TLD-->&gt;Recursive: Referral: ask ns1.example.com

    Recursive->&gt;Auth: Iterative query: api.example.com?
    Auth-->&gt;Recursive: A record: 203.0.113.42 (TTL 300)

    note">Note over Recursive: Cache answer for TTL duration
    Recursive-->&gt;StubResolver: Authoritative answer: 203.0.113.42