• Glossary
  • What is Recursive DNS server?

DNS Glossary

What is Recursive DNS server?

A recursive DNS server is a DNS server that resolves domain names to IP addresses on behalf of client devices. It queries root, top-level domain and authoritative servers as needed, returns the final answer to the client, and caches results to answer later queries faster.

Let’s simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A recursive DNS server resolves domain names to IP addresses on behalf of client devices by querying the DNS hierarchy, caching results, and returning answers to stub resolvers; nearly every network connection depends on recursive servers, making them critical infrastructure that must be secured against open resolver attacks, cache poisoning, and configuration issues that can cause application failures even when network connectivity is healthy. Caching improves response times and reduces load on authoritative servers, but cached data persists until the time-to-live expires, affecting how quickly record changes propagate to users. Proper management practices—including restricting recursion to authorized clients, running redundant servers, enabling DNSSEC validation, and maintaining query logs—are essential to reduce security risks and ensure consistent DNS resolution.

  • Recursive DNS servers accept queries with the recursion desired flag set and perform hierarchical lookups by querying root, top-level domain, and authoritative servers before caching and returning the final answer to clients.
  • DNSSEC validation, access control lists limiting recursion to internal client ranges, and TCP port 53 allowance between resolvers and both clients and upstream servers are critical security and reliability configurations to prevent reflection attacks, cache poisoning, and resolution failures.
  • Common operational issues such as stale cached records persisting until TTL expiration, broken forwarders causing intermittent timeouts, and split-horizon mismatches for private namespaces require specific troubleshooting and configuration adjustments to restore consistent DNS resolution.

Recursive DNS server at a glance

AttributeValue
Full nameRecursive DNS server
CategoryDNS server role
Defined inRFC 1034 and RFC 1035, with the resolver role clarified in RFC 9499
Protocol and portDNS over UDP and TCP, port 53
OSI layerApplication layer (layer 7)
Primary useResolving domain names for client devices and caching the answers
Related termsAuthoritative DNS server, DNS resolver, DNS cache, Root server, Stub resolver

How recursive DNS server works

  1. Lorem Ipsum (Optional)
  2. Lorem Ipsum (Optional)
  3. Lorem Ipsum (Optional)
  4. Lorem Ipsum (Optional)
  5. Lorem Ipsum (Optional)
  6. Lorem Ipsum (Optional)

Real servers also reuse cached referrals, so root and top-level domain servers are often skipped. Many deployments can forward queries to an upstream recursive server instead of resolving iteratively themselves.

Why recursive DNS server matters in enterprise networks

Nearly every network connection starts with a DNS lookup, so the recursive server sits in the path of almost all client traffic. If it is slow or unavailable, applications appear to fail even when the network is healthy. Caching reduces load on authoritative servers and shortens response times, but cached data stays in place until its time to live expires, which affects how quickly record changes reach users. The roles of resolvers and servers are defined in RFC 9499 [1], and the original resolution behavior is described in RFC 1034 [2].

Recursive servers are a security control point. An open resolver that answers queries from any source can be abused for reflection and amplification attacks, and a resolver that accepts forged responses can have its cache poisoned. DNSSEC lets a validating recursive server check that answers were signed by the zone owner, as specified in RFC 4033 [3]. Because the server sees every domain a client requests, it is also a natural place to apply filtering and logging.

Poor management shows up as inconsistent answers, single points of failure and blind spots during incident response. Restricting which clients may query, running redundant servers, enabling validation and keeping query logs are common practices that reduce these risks.

Recursive DNS server vs Authoritative DNS server

A recursive DNS server looks up answers for clients by querying other servers, while an authoritative DNS server holds the zone data and gives definitive answers only for the zones it hosts. What is Authoritative DNS server?

AttributeRecursive DNS serverAuthoritative DNS server
Main roleResolves names on behalf of clientsPublishes records for its own zones
Source of answersOther DNS servers and its cacheLocally configured zone data
Typical clientsStub resolvers and forwarding serversRecursive resolvers
Caching of other zonesYes, until the TTL expiresNot part of its role
Authoritative answer flagNot set for answers from other serversSet for answers from its own zones

Recursive DNS server vs DNS stub resolver

A stub resolver is the small client-side component that sends queries to a configured server, while a recursive DNS server performs the full resolution and caching on its behalf. What is DNS stub resolver?

AttributeRecursive DNS serverDNS stub resolver
LocationNetwork server, shared by many clientsInside the host operating system or application
Follows referralsYesNo
Cache scopeShared across all clientsLocal to one host, if present
Queries sent toRoot, TLD and authoritative serversA configured recursive server

Common recursive DNS server issues

A recursive server that answers queries from any source address can be abused for reflection and amplification attacks against third parties. Restrict recursion to internal client ranges with access control lists and check that the server is not reachable from the internet.

Cached records remain in place until the TTL expires, so a changed record may keep resolving to the old address for some users. Flushing the cache fixes the symptom, and enabling DNSSEC validation reduces the risk of accepting forged answers.

If a server forwards to an upstream resolver that is slow, filtered or down, clients see intermittent timeouts and SERVFAIL responses. Test the forwarder directly and confirm that the server can fall back to full recursion or a secondary forwarder.

Firewalls that allow only UDP port 53 break responses that are truncated and need a TCP retry, and large DNSSEC answers may fail. Allow TCP port 53 between the resolver and both clients and upstream servers.

Internal names fail to resolve when the recursive server has no forwarding or stub zone for the private namespace and queries the public internet instead. Clients then receive NXDOMAIN for names that exist only inside the network.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Recursive DNS server FAQ

Related terms

Article

Recursive query

A kind of query in which the DNS server will do all the job of fetching the answer and giving it back to you; the DNS server might also query other DNS servers on your behalf.

Learn more
Article

Caching DNS server

A server that handles recursive requests from clients.

Learn more
Article

Forwarding DNS Server

A DNS server on a network that forwards DNS queries for external DNS names to DNS servers outside that network.

Learn more
Article

DNS stub resolver

The part of the client device that facilitates DNS queries.

Learn more
Article

Authoritative DNS server / Authoritative name server

Provides original and definitive answers to DNS queries.

Learn more
Article

Time to Live (TTL)

A setting for each DNS record that specifies how long a resolver is supposed to cache the DNS query before it expires.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Article

Response Policy Zone (RPZ)

A DNS zone that lets resolvers rewrite answers on the fly to block, redirect, or log queries to risky or disallowed domains, giving admins real-time security and policy control.

Learn more

Browse the full glossary