• Glossary
  • What is a non-recursive query?

DNS glossary

What is a non-recursive query?

A non-recursive query, also called an iterative query, is a DNS request that asks a name server to answer from data it already holds or to refer the client onward. It does not require the server to contact other servers, so the server returns an answer or a referral immediately.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A non-recursive query, also called an iterative query, is a DNS request that asks a name server to provide only the information it already holds or to refer the client to another server, without performing additional lookups on the client's behalf. Non-recursive queries form the backbone of DNS traffic between servers, with recursive resolvers using them to walk the DNS hierarchy by querying root servers, top-level domain servers, and authoritative servers in sequence. Understanding the distinction between recursive and non-recursive queries is operationally critical for server design, troubleshooting, security configuration, and preventing misconfigurations such as stub clients pointed at authoritative-only servers that refuse recursion.

  • Non-recursive queries are defined in RFC 1034 and RFC 1035, operating over DNS UDP and TCP on port 53 at OSI layer 7, and represent the primary mechanism for server-to-server DNS communication across the hierarchy.
  • Authoritative servers are expected to answer non-recursive queries quickly from zone data, with their operational load growing in proportion to the number of recursive resolvers that depend on them and the length of record lifetimes.
  • Security best practices restrict recursion to trusted clients while permitting non-recursive answers about authoritative zones to be open to all sources, preventing reflection and amplification attacks while maintaining service availability.

Non-recursive query at a glance

AttributeValue
Full nameNon-recursive query, also called an iterative query
CategoryDNS query type
Defined inRFC 1034 and RFC 1035
Protocol and portDNS over UDP and TCP, port 53
OSI layerLayer 7 (application)
Primary useResolving names step by step by asking each server in turn, and answering from local data
Related termsRecursive query, Recursive resolver, Authoritative name server, Root server, DNS cache, Referral

How non-recursive query works

In a non-recursive query, the client sends a question and the server replies with the best information it has, without doing further lookups on the client's behalf. Recursive resolvers use this approach to walk the DNS hierarchy.

  1. Client sends the query: The client, usually a recursive resolver, sends a query to a name server with the recursion desired flag unset or with no expectation that the server will recurse.
  2. Server checks its data: The server looks in its zone data if it is authoritative for the name, or in its cache if it keeps one.
  3. Server returns an answer: If the server holds the answer, it returns it. An authoritative server marks the response as authoritative.
  4. Server returns a referral: If the server does not hold the answer, it returns a referral listing name servers closer to the name, such as the servers for a child zone.
  5. Client follows the referral: The client sends the same question to a server named in the referral and repeats until it receives an answer or an error.

The server never queries other servers for the client, so the work of following referrals stays with the asker. A resolver typically starts at a root server, then queries a top-level domain server, then the authoritative server for the domain, using non-recursive queries at each step.

Why non-recursive query matters in enterprise networks

Non-recursive queries are the mechanism behind most DNS traffic between servers. Every time a recursive resolver cannot answer from its cache, it sends non-recursive queries up the hierarchy as described in RFC 1034. Authoritative servers are expected to answer these queries quickly from zone data, so their load grows with the number of resolvers that rely on them and with how short the record lifetimes are.

Operationally, the distinction matters for server design and troubleshooting. An authoritative-only server that does not offer recursion will answer only non-recursive questions about its own zones, and a client that expects recursion from it will see a referral or a refusal instead of an answer. Misunderstanding this causes confusing failures, such as stub clients that cannot resolve external names after being pointed at an authoritative server.

Security follows from the same split. Servers that answer recursive queries from any source can be abused in reflection and amplification attacks, so many operators restrict recursion to trusted clients while leaving non-recursive answers about their own zones open to everyone. Keeping those roles separate, and monitoring query types and response codes, makes misconfigurations and abuse easier to spot.

Non-recursive query vs Recursive query

A recursive query asks the server to return a final answer or an error by querying other servers as needed, while a non-recursive query asks only for what the server already knows or a referral to a better server. What is Recursive query?

AttributeNon-recursive queryRecursive query
Work done by the serverAnswers from zone data or cache, or returns a referralResolves the name fully, contacting other servers as needed
Typical senderA recursive resolver talking to authoritative serversA stub resolver or client talking to a recursive resolver
Typical responderAuthoritative serverRecursive resolver
Possible resultAnswer or referralFinal answer or error
Recursion desired flagUnset or not relied onSet

Common misconceptions about non-recursive query

Iterative queries are not inherently slower. Each step is a simple lookup, and a resolver that caches referrals and answers often skips most of the steps.

Stub resolvers normally send recursive queries to a resolver. The non-recursive exchange happens between the resolver and authoritative servers, so it is mostly invisible to end clients.

A referral is a normal response, not a failure. It points the resolver to name servers closer to the answer, and a missing referral is a delegation problem rather than a query-type problem.

An authoritative-only server does not resolve names outside its zones, even when the recursion desired flag is set. It typically returns a referral or a refusal, which is often mistaken for an outage.

A caching server can answer a non-recursive query from its cache if the data is there. If it is not cached, the server does not go and fetch it for that query.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Non-recursive query FAQ

Related terms

Article

Recursive query

A recursive query is a DNS query in which the DNS server retrieves the answer by querying other DNS servers on behalf of the requester and returns the result.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

Authoritative DNS server / Authoritative name server

An authoritative DNS server provides original and definitive answers to DNS queries.

Learn more
Article

DNS query / DNS request

A DNS query is a request for information sent from a device to a DNS server asking it to resolve a domain name.

Learn more
Article

Caching DNS server

A caching DNS server handles recursive requests from clients.

Learn more
Article

DNS namespace

A DNS namespace is the hierarchical structure of domains that form a complete domain name in the DNS system.

Learn more
Article

DNS Delegation

DNS delegation is the process of assigning responsibility for managing a domain or subdomain to separate authoritative DNS servers.

Learn more
Article

DNS – Domain Name System

The Domain Name System (DNS) is a hierarchical naming system that resolves domain names to IP addresses, enabling communication across network devices.

Learn more
Browse the full glossary