DNS glossary

What is a DNS query?

A DNS query (also called a DNS request) is a DNS message that asks a DNS server for records matching a name, a record type and a class. It is sent by a client or resolver and answered with a DNS response, as defined in RFC 1035.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A DNS query is a request message sent by a client to a DNS server asking for records matching a specific domain name, record type, and class, answered according to RFC 1035 specifications. The query initiates nearly every network connection and serves as a direct measure of DNS service demand, with volume analysis by record type, client, and response code revealing capacity needs and identifying misconfigurations. Monitoring query patterns—including spikes in NXDOMAIN responses, query floods, and truncated UDP responses—is critical for operational reliability and security, as unmonitored query traffic allows problems to surface only as user complaints rather than being proactively resolved.

  • DNS queries typically use UDP on port 53 but fall back to TCP when responses are truncated, with newer encrypted transports like DNS over TLS available as alternatives to plain-text RFC 1035 queries.
  • Query floods—high-volume bursts often targeting random domain names from spoofed sources—can exhaust resolver resources and cause rising latency, SERVFAIL errors, and timeouts far above normal baseline rates.
  • Analyzing queries by record type, client source, and response code helps teams detect misconfigured clients generating repeated identical lookups, broken applications causing NXDOMAIN spikes, or devices querying wrong resolvers after DHCP changes.

DNS query at a glance

AttributeValue
CategoryDNS message
Defined inRFC 1035
Protocol and portUDP and TCP, port 53
OSI layerLayer 7 (application)
Primary useRequesting DNS records, such as an IP address, for a domain name
Related termsDNS resolver, DNS record, recursive query, iterative query, DNS response, DNS query flood

How DNS query works

A DNS query carries a question made of a name, a record type and a class. The client sends it to a resolver, which either answers from its cache or works through the DNS hierarchy to find the answer.

  1. Build the question: The client forms a query with the domain name to look up, the record type (for example A, AAAA, MX or TXT) and the class, which is almost always IN for Internet.
  2. Send to a resolver: The client's stub resolver sends the query to a configured recursive resolver, usually over UDP on port 53.
  3. Check the cache: The recursive resolver returns a cached answer if it holds an unexpired one for the same name and type.
  4. Query authoritative servers: If there is no cached answer, the resolver sends iterative queries to root, top-level domain and authoritative servers until one gives the answer or an error.
  5. Return the response: The resolver sends the answer to the client and caches it for the time set by the record's time to live.

Queries normally use UDP, and the client retries over TCP when a response is truncated. The response code reports the outcome, such as no error or NXDOMAIN for a name that does not exist. Extensions such as EDNS and encrypted transports like DNS over TLS change how queries are carried, not what they ask.

Why DNS query matters in enterprise networks

Nearly every network connection begins with a DNS query, so query volume is a direct measure of how much demand a DNS service carries. Counting queries per day, by record type, client and response code, shows capacity needs and helps identify misconfigured clients that repeat the same lookup. The query types in use also matter: A and AAAA queries dominate, while unusual types may point to tools or tunneling.

Query handling has operational and security consequences. A spike in NXDOMAIN responses can indicate a broken application, a misconfigured search domain or malware generating random names. A DNS query flood overwhelms a server or resolver with more requests than it can process, and the resulting delays or timeouts make applications that depend on name resolution appear to be down. Because traditional queries are sent in plain text, as defined in RFC 1035, anyone on the path can observe or tamper with them unless an encrypted transport or DNSSEC validation is used.

When query traffic is not monitored, these problems surface only as user complaints. Collecting query logs, applying rate limiting on resolvers and keeping redundant servers give teams the evidence and headroom to resolve failures before they spread.

DNS query vs Recursive query

A DNS query is any question sent to a DNS server, while a recursive query is a specific kind of query in which the client asks the server to do all the work of finding the final answer. What is Recursive query?

AttributeDNS queryRecursive query
ScopeGeneral term for any DNS questionA query type defined by the recursion desired flag being set
Who does the lookup workDepends on how the query is sentThe receiving resolver follows referrals until it has an answer or an error
Typical senderStub resolver or recursive resolverStub resolver asking a recursive resolver

DNS query vs Iterative query

A DNS query is the general message, while an iterative query is one where the server returns its best answer or a referral and the asker follows up itself. What is Iterative (or non-recursive) query?

AttributeDNS queryIterative query
ScopeGeneral term for any DNS questionA query handled without the server chasing other servers
Server behaviorVaries with the queryReturns an answer or a referral to other name servers
Typical senderStub resolver or recursive resolverRecursive resolver asking authoritative servers

Common DNS query issues

A large burst of queries, often for random names or from spoofed sources, can exhaust resolver CPU, sockets or upstream bandwidth. Symptoms are rising latency, SERVFAIL or timeouts, and a query rate far above the normal baseline.

A misconfigured client or application that ignores TTL and caching can send the same query many times per second. It shows up in logs as one client dominating the top-talker list for a single name.

A sudden rise in NXDOMAIN responses often traces to a broken application, a wrong search domain suffix or a stale configuration pointing at a removed name. Clients may also append several search suffixes, multiplying failed queries per lookup.

When an answer exceeds the size a client accepts over UDP, the server sets the truncation flag and the client must retry over TCP. Firewalls that block TCP port 53 cause intermittent failures for large responses such as those with DNSSEC data.

Clients configured with a public or stale resolver bypass internal DNS, so internal names fail to resolve or return different answers. This often appears after DHCP scope changes or on devices with hard-coded DNS settings.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS query FAQ

Related terms

Article

Recursive query

A kind of query in which the DNS server will do all the job of fetching the answer and giving it back to you; the DNS server might also query other DNS servers on your behalf.

Learn more
Article

Iterative (or non-recursive) query

A DNS request that states, “Give me the answer or give me any information that will help me find the answer.” The nameserver will respond back from its cache or zone files but will not contact other DNS servers.

Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

DNS stub resolver

The part of the client device that facilitates DNS queries.

Learn more
Article

NXDOMAIN

DNS response code indicating the DNS query failed because the domain name queried does not exist.

Learn more
Article

Time to Live (TTL)

A setting for each DNS record that specifies how long a resolver is supposed to cache the DNS query before it expires.

Learn more
Article

Caching DNS server

A server that handles recursive requests from clients.

Learn more
Article

DNS – Domain Name System

A hierarchical naming system that enables communication across devices in a network.

Learn more
Browse the full glossary