referral

A DNS response that holds no answer itself but names the servers of a zone closer to the name that was asked.

Authoritative servers return referrals for names delegated below them, and a resolver follows them from the root down; dig +trace prints each step. Reading one as a failed lookup is a common mistake: an empty answer with NS records in the authority section is a pointer, not a denial.

RFC 9499 defines a referral as a response in which a server, signalling that it is not (completely) authoritative for an answer, gives the querying resolver an alternative place to send its query. A pure referral has an empty answer section, the NS records of the child zone in the authority section, possibly their addresses in the additional section, and the AA bit clear.

Those addresses are glue when the name servers sit inside the zone being delegated: without them a resolver following the referral has no way of finding the servers. RFC 9471 (2023) made in-domain glue mandatory, with the TC bit set when it does not all fit. RFC 1034 lets a server answering non-recursively return a referral; a server acting recursively returns the answer or an error, but never referrals.

To tell a referral from NODATA, read the authority section: an SOA there, or no NS records at all, means NODATA. dig +trace makes iterative queries from the root and shows the answer of each server it follows; dig @server name +norecurse asks one server for only what it holds, which from a server that is not authoritative for the name is often a referral.

Also known as: dns referral, referral response, referral answer

Sources

← All glossary entries