• Glossary
  • What is an authoritative DNS server?

DNS glossary

What is an authoritative DNS server?

An authoritative DNS server (authoritative name server) is a DNS server that holds the original resource records for one or more zones and returns definitive answers for names within them. It does not rely on cached data from other servers, and it marks its responses as authoritative.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

An authoritative DNS server holds the original resource records for DNS zones and provides definitive answers for names within those zones without relying on cached data from other servers. These servers are critical infrastructure components that serve as the source of truth for every name an organization publishes, and their availability, consistency, and security directly impact whether users can resolve domain names and reach associated web servers, mail servers, and applications. Organizations must deploy at least two authoritative servers on separate networks for redundancy, maintain synchronized zone data across all servers, implement proper access controls and DNSSEC signing, and protect against denial-of-service attacks to ensure reliable DNS resolution.

  • Authoritative servers answer only for their configured zones using original zone data, while recursive resolvers query multiple servers and cache results to answer client queries across the entire DNS namespace.
  • Common operational failures include lame delegations (parent zone listing non-serving name servers), inconsistent zone copies from failed transfers, and single network placement of all zone servers, each causing intermittent resolution failures or complete zone unavailability.
  • Security threats to authoritative servers encompass unauthorized record changes that redirect traffic or mail, reflection and amplification attacks exploiting open recursion, and denial-of-service attacks targeting the servers themselves, all requiring access controls, DNSSEC signing, rate limiting, and distributed hosting strategies.

Authoritative DNS server at a glance

AttributeValue
Full nameAuthoritative DNS server
CategoryDNS server role
Defined inRFC 1034 and RFC 1035
Protocol and portDNS over UDP and TCP, port 53
OSI layerApplication layer (layer 7)
Primary usePublishing and answering queries for the records in a DNS zone
Related termsRecursive resolver, DNS zone, NS record, SOA record, Zone transfer, DNS caching

How authoritative DNS server works

An authoritative server answers queries for the zones it is configured to serve. It is usually reached by a recursive resolver that is working through the DNS hierarchy on behalf of a client.

  1. Receive the query: A recursive resolver sends a query for a name, such as a host name and record type, to a server listed in the NS records for the zone.
  2. Match the zone: The server checks whether the queried name falls inside a zone it holds. If it does not, it does not answer authoritatively.
  3. Look up the record: The server finds the matching resource records in its zone data. The data comes from a zone file, a database, or a copy received from a primary server.
  4. Return the response: The server replies with the records and sets the authoritative answer flag in the DNS header. If the name does not exist, it returns an authoritative negative answer. If the name belongs to a delegated child zone, it returns a referral to that zone's name servers.

Zones are normally served by several authoritative servers for redundancy. In the traditional model, one primary server holds the master copy and secondary servers receive updates through zone transfers, as described in the DNS standards. The record time to live tells resolvers how long they may cache the answer.

Why authoritative DNS server matters in enterprise networks

Authoritative servers are the source of truth for every name an organization publishes. If they are unreachable or return wrong data, the affected names stop resolving for everyone, even when the web servers, mail servers and applications behind them are healthy. Resolvers can cover short gaps from cache, but only until record time to live values expire.

Availability and consistency drive most operational practice. The DNS standards call for at least two name servers per zone, and placing them on separate networks avoids a single point of failure. Operators also need to keep zone data in sync across servers. Mismatched serial numbers, failed zone transfers or stale secondaries cause some users to receive outdated or missing answers while others get correct ones, which is hard to trace.

Security matters because whoever controls the authoritative data controls where traffic goes. Unauthorized record changes can redirect users or mail, so access control and change auditing are essential. DNSSEC lets an authoritative server sign its zone data so validating resolvers can detect tampering. Authoritative servers are also common targets for denial-of-service attacks, so capacity planning, rate limiting and distributed hosting reduce the impact on the names they serve.

Authoritative DNS server vs Recursive DNS server

An authoritative server answers only for the zones it hosts, while a recursive server resolves names for clients by querying other servers and caching the results. What is Recursive DNS server?

AttributeAuthoritative DNS serverRecursive DNS server
Source of answersIts own zone dataOther servers and its cache
Typical clientsRecursive resolversStub resolvers on end devices
ScopeOnly the zones it is configured to serveAny name in the DNS namespace
Authoritative flag in responsesSet for names in its zonesNot set for answers it obtained elsewhere
ExposureUsually reachable from the internet for public zonesUsually restricted to internal or customer networks

Authoritative DNS server vs Caching DNS server

An authoritative server holds the original records for a zone, while a caching server only stores copies of answers it learned from others until their time to live expires. What is Caching DNS server?

Common authoritative DNS server issues

The parent zone lists a name server in its NS records that does not actually serve the zone, or does not answer authoritatively. Resolvers see timeouts or SERVFAIL responses from that server and retry others, which adds latency and can cause intermittent failures.

A secondary server serves older data because zone transfers fail or the SOA serial was not incremented after an edit. Users get different answers depending on which name server a resolver happens to query.

An authoritative server that also answers recursive queries for any client can be abused in reflection and amplification attacks. Operators usually separate the authoritative and recursive roles or disable recursion on the authoritative side.

All name servers for a zone sit in one subnet, site or provider. An outage or routing problem there makes the whole zone unreachable once cached records expire.

Firewalls that allow only UDP port 53 break zone transfers and any response too large for UDP. Symptoms include failed transfers and resolvers that cannot retrieve large DNSSEC-signed answers.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Authoritative DNS server FAQ

Related terms

Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

Caching DNS server

A server that handles recursive requests from clients.

Learn more
Article

DNS zone

A distinct, contiguous portion of the domain name space for which administrative responsibility has been delegated to a single manager.

Learn more
Article

NS record

A DNS record that provides a list of the authoritative name servers responsible for the domain.

Learn more
Article

SOA record

A DNS record type that provides important details about a DNS zone; required for every DNS zone.

Learn more
Article

Nameserver

An application for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identification or addressing component. An example of a name server is the server component DNS.

Learn more
Article

Time to Live (TTL)

A setting for each DNS record that specifies how long a resolver is supposed to cache the DNS query before it expires.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Browse the full glossary