• Glossary
  • What is a forwarding DNS server?

DNS glossary

What is a forwarding DNS server?

A forwarding DNS server (forwarder) is a DNS server that sends queries for names it is not authoritative for to a designated upstream DNS server instead of resolving them itself. It caches the answers it receives, so repeated queries from local clients are served without another upstream lookup.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A forwarding DNS server is a DNS server that delegates queries it cannot answer to designated upstream servers rather than performing full resolution itself, caching responses for repeated local lookups to improve performance and reduce outbound traffic. This architecture centralizes external name resolution, logging, and filtering at upstream servers while allowing branch offices and internal sites to run lightweight forwarders instead of full recursive resolvers. However, forwarding creates dependencies on upstream server availability and correctness, requiring careful management of forwarder lists, monitoring of response times, and proper configuration of conditional forwarding rules to avoid outages, security risks, and hard-to-diagnose failures.

  • A forwarding DNS server caches answers received from upstream servers, so repeated queries for popular names are resolved locally and respond faster without additional upstream lookups.
  • Forwarding concentrates external resolution in centralized upstream servers, reducing outbound DNS traffic while enabling centralized logging and filtering across multiple branch offices and remote sites.
  • If all configured forwarders become unreachable and no fallback exists, clients fail to resolve external names even though the local forwarder remains healthy, making this risk manageable only by configuring at least two forwarders on separate paths.

Forwarding DNS server at a glance

AttributeValue
Full nameForwarding DNS server
CategoryDNS server role
Protocol and portDNS over UDP and TCP, port 53 by default
OSI layerLayer 7 (application)
Primary useOffloading external name resolution to an upstream resolver while caching answers for local clients
Related termsRecursive DNS server, Authoritative DNS server, DNS caching, Conditional forwarding, Stub resolver

How forwarding DNS server works

A forwarding DNS server is configured with one or more upstream servers, called forwarders. It answers what it can from local data or cache and hands everything else to those upstream servers.

  1. Client query: A client or stub resolver sends a recursive query for a name to the forwarding DNS server.
  2. Local check: The server checks the zones it hosts and its cache. If it holds a valid answer, it replies immediately.
  3. Forward upstream: If no answer is available, the server sends the query to a configured forwarder with the recursion desired flag set, asking the upstream server to do the full resolution.
  4. Upstream resolution: The upstream server resolves the name, usually by walking the DNS hierarchy from the root, or answers from its own cache.
  5. Cache and reply: The forwarding server receives the answer, stores it for the duration of its time to live, and returns it to the client.

Many implementations support conditional forwarding, which sends queries for specific domains to specific servers, such as a partner network's DNS servers. Some can fall back to their own iterative resolution if forwarders do not respond, while others can be set to forward only and fail the query instead.

Why forwarding DNS server matters in enterprise networks

Forwarding concentrates external resolution in a few upstream servers. Branch offices, remote sites and internal servers can run lightweight forwarders instead of full recursive resolvers. This reduces outbound DNS traffic, centralizes logging and filtering, and lets the shared upstream cache serve many sites. Because the forwarder also caches, repeat lookups for popular names stay local and respond faster.

Forwarding also creates dependencies. The forwarding server trusts the upstream server's answers, so a compromised or misconfigured upstream resolver can return false data to every client behind it. DNSSEC validation helps only if the validating resolver is placed where it can check the signatures, and a forwarder that does not validate must rely on the upstream server's validation. Forwarding to an unmanaged public resolver also exposes internal query patterns to a third party.

Poor management shows up as outages and slow lookups. If a forwarder address is wrong or unreachable and no fallback exists, external names stop resolving while internal zones still work, which can be hard to diagnose. Chains of forwarders add latency and make cache behavior unpredictable. Conditional forwarding rules that point to retired servers cause failures for specific domains. Monitoring upstream response times and reviewing forwarder lists regularly prevents most of these problems.

Forwarding DNS server vs Recursive DNS server

A forwarding DNS server passes queries it cannot answer to an upstream server, while a recursive DNS server performs the full resolution itself by querying root, TLD and authoritative servers. What is Recursive DNS server?

AttributeForwarding DNS serverRecursive DNS server
Resolution methodHands the query to a configured upstream serverWalks the DNS hierarchy itself
Contact with authoritative serversUsually none directlyQueries them directly
DependencyDepends on the upstream server's availability and answersDepends on reachability of root and authoritative servers
Typical placementBranch offices and internal serversCentral or ISP-level resolver

Forwarding DNS server vs Caching DNS server

A caching DNS server stores answers to reuse them, and a forwarding DNS server is defined by where it sends unresolved queries; many servers do both. What is Caching DNS server?

Common forwarding DNS server issues

If every configured forwarder is unreachable, clients fail to resolve external names even though the local server is healthy. Listing at least two forwarders on separate paths reduces this risk.

Two servers configured to forward to each other, or a chain that circles back, cause queries to bounce until they time out. Symptoms are slow lookups and SERVFAIL responses for names that resolve elsewhere.

Sending queries for internal domains to a public upstream server returns NXDOMAIN or wrong answers. Conditional forwarding or locally hosted zones for those domains avoids this.

Firewalls that permit only UDP port 53 between forwarder and upstream server break responses that need TCP, such as large DNSSEC-signed answers. Intermittent failures for specific names are the typical sign.

The forwarder caches whatever the upstream server returns, so a bad answer persists until its TTL expires. Flushing the cache fixes the local copy but not the upstream source.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Forwarding DNS server FAQ

Related terms

Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

Caching DNS server

A server that handles recursive requests from clients.

Learn more
Article

DNS stub resolver

The part of the client device that facilitates DNS queries.

Learn more
Article

Recursive query

A kind of query in which the DNS server will do all the job of fetching the answer and giving it back to you; the DNS server might also query other DNS servers on your behalf.

Learn more
Article

Time to Live (TTL)

A setting for each DNS record that specifies how long a resolver is supposed to cache the DNS query before it expires.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Article

DNS server

Also called a DNS nameserver, it stores DNS records and responds to and resolves DNS queries from devices. Learn More

Learn more
Article

Authoritative DNS server / Authoritative name server

Provides original and definitive answers to DNS queries.

Learn more
Browse the full glossary