recursive resolver

A DNS server that answers on a client's behalf, from its cache or by querying authoritative servers until it has the answer.

The stub resolver in every laptop and phone hands its questions to one, usually the address DHCP supplied or a public service. It sees the names its clients look up, and what it caches, filters or validates is what they get.

RFC 9499 defines it as a resolver acting in recursive mode: it answers from its local cache or queries other servers for the final answer, and RFC 1034 adds that it returns the answer or an error, never a referral. It is expected to cache, which makes it what RFC 1123 calls a full-service resolver, though some do not. Recursive server means the same; BIND's manual counts caching name server among its many names, and RFC 9499 discourages full resolver, a term RFC 1035 uses without defining it.

It needs the address of at least one root server, learnt by priming from a root hints list, often built into the software. For a name it has not cached, it starts from the closest name servers it knows, the root at worst, sends non-recursive queries and follows the referrals down until an authoritative server returns the data or a name error. The result goes to the client and into the cache for at most its TTL.

A reply with both rd and ra set shows the server worked recursively. A validating resolver answers SERVFAIL when validation fails, unless the query set CD, and its AD bit can be relied on only over a secure path. RFC 9499 calls one that serves any client an open resolver, or a public resolver when that is intended; most open ones are probably misconfigured. dig +trace runs the same iteration from the client and shows each referral.

Also known as: recursive server, full-service resolver, full resolver, caching name server, recursive name server

Sources

← All glossary entries