DNS glossary

What is an iterative query?

An iterative query (also called a non-recursive query) is a DNS request that asks a nameserver for the best answer it can give without contacting other servers on the client's behalf. It returns either the requested data or a referral to nameservers closer to the answer.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

An iterative query (also called a non-recursive query) is a DNS request where a nameserver returns either the best answer it has from its own data and cache or a referral to other nameservers closer to the answer, placing responsibility on the asking party to follow referrals. This design forms the foundation of global DNS distribution, allowing root and top-level domain servers to handle enormous query volumes by answering only from their own data rather than performing full resolution for every client. For network operations, understanding iterative queries is critical for proper server configuration, security hardening against DNS amplification attacks, and effective troubleshooting of resolution failures and intermittent DNS faults.

  • Iterative queries shift resolution responsibility to the resolver, which follows referrals from root servers through top-level domain and authoritative servers, reducing load on high-volume DNS infrastructure defined in RFC 1034 and RFC 1035.
  • Authoritative servers must answer iteratively only and restrict recursion to trusted clients to prevent abuse such as DNS amplification attacks, where enabling recursion on public-facing servers creates security vulnerabilities.
  • Misconfigurations and broken delegations in iterative resolution chains produce intermittent failures that require testing each referral step to isolate which server in the chain is unreachable or missing glue records.

Iterative query at a glance

AttributeValue
Full nameIterative query, also called a non-recursive query
CategoryDNS query type
Defined inRFC 1034 and RFC 1035
Protocol and portDNS over UDP or TCP, port 53
OSI layerApplication layer (layer 7)
Primary useResolving names step by step by following referrals from root to authoritative servers
Related termsRecursive query, recursive resolver, authoritative nameserver, root server, referral, DNS caching

How iterative query works

In an iterative query, the queried server answers only from what it already knows, such as its own zone data or cache. It never sends queries to other servers to complete the answer. The asking party is responsible for following any referral.

  1. Client sends the query: A resolver sends a DNS query to a nameserver, typically with the recursion desired flag not set, or to a server that will not recurse for it.
  2. Server checks local data: The nameserver looks in its authoritative zones and its cache for a matching record.
  3. Server returns an answer or referral: If it has the data, it returns the answer. If not, it returns a referral listing nameservers that are closer to the name, usually as NS records with any available address records.
  4. Resolver follows the referral: The resolver sends the same question to a server named in the referral and repeats until it reaches an authoritative server that gives the final answer or an error such as a nonexistent domain.

Recursive resolvers commonly use iterative queries when resolving names, starting at the root servers and working down through the top-level domain and the authoritative servers. An authoritative server that does not offer recursion behaves this way for every query it receives. Responses are cached according to record time to live values, which reduces repeat queries.

Why iterative query matters in enterprise networks

Iterative queries are the basis of how the global DNS distributes work. Root and top-level domain servers handle enormous query volumes, and they can do so because they only answer from their own data or point onward, rather than performing resolution for every client. The design is described in RFC 1034 and RFC 1035, and it keeps the cost of resolution with the resolver, which can cache results and serve many clients.

For network teams, the distinction affects server design and troubleshooting. Authoritative servers should generally answer iteratively only, and recursion should be limited to resolvers serving known clients. Leaving recursion open on an authoritative or public-facing server exposes it to abuse, including use as a reflector in DNS amplification attacks, where small spoofed requests produce much larger responses aimed at a victim.

Misunderstanding the query type causes real faults. A tool that sends a non-recursive query to a resolver with an empty cache may get a referral or no answer, which can be mistaken for an outage. Broken delegations, missing glue records or unreachable nameservers cause iterative resolution to fail partway, producing intermittent failures that depend on which referral a resolver follows. Testing each step of the chain helps isolate where it breaks.

Iterative query vs Recursive query

A recursive query asks the server to do all the work needed to return a final answer or an error, while an iterative query asks only for the best answer the server already has, such as data or a referral. What is Recursive query?

AttributeIterative queryRecursive query
Who follows referralsThe asking resolverThe queried recursive server
Work done by queried serverAnswers from zone data or cache onlyQueries other servers until it can answer
Typical senderA recursive resolver querying authoritative serversA stub resolver or client querying a recursive resolver
Result returnedAnswer or referralFinal answer or error
Recursion desired flagUsually not setSet

Common misconceptions about iterative query

Some assume an iterative answer is always built from scratch. A server answering iteratively can answer from its cache as well as from zone data, and a recursive resolver relies on its cache to avoid repeating iterative lookups.

Stub resolvers on endpoints normally send recursive queries to a configured resolver. The iterative queries happen between the recursive resolver and the authoritative servers, so packet captures on a client rarely show referrals.

A response with no answer section but with NS records in the authority section is a normal referral. Engineers new to DNS sometimes read it as a broken server when it is the expected reply from a parent zone.

Enabling recursion on an authoritative server for convenience exposes it to abuse such as use in amplification attacks and mixes two roles. Best practice is to separate authoritative and recursive functions or restrict recursion to trusted clients.

A REFUSED response to a recursive query usually means the server will not recurse for that source, not that it answered iteratively. Checking the recursion available flag and access control lists on the server finds the cause.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Iterative query FAQ

Related terms

Article

Recursive query

A recursive query is a DNS query in which the DNS server retrieves the answer by querying other DNS servers on behalf of the requester and returns the result.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

Authoritative DNS server / Authoritative name server

An authoritative DNS server provides original and definitive answers to DNS queries.

Learn more
Article

DNS Root Server

A DNS Root Server is a name server that answers requests for records in the root zone and directs other requests to authoritative name servers for appropriate top-level domains.

Learn more
Article

DNS query / DNS request

A DNS query is a request for information sent from a device to a DNS server asking it to resolve a domain name.

Learn more
Article

Caching DNS server

A caching DNS server handles recursive requests from clients.

Learn more
Article

DNS stub resolver

A DNS stub resolver is the component on a client device that initiates and facilitates DNS queries to recursive resolvers.

Learn more
Article

DNS Delegation

DNS delegation is the process of assigning responsibility for managing a domain or subdomain to separate authoritative DNS servers.

Learn more
Browse the full glossary