---
title: "DNS Recursive Resolution and Caching Internals"
description: "An in-depth technical overview of the DNS recursive resolution process, DNSSEC validation, caching behavior, and related extensions and configurations."
keywords: ["dns", "recursive resolution", "caching", "dnssec", "edns0", "dns over https"]
category: "networking"
---

When a client application requests a domain name, the local DNS resolver on the client machine must perform a recursive DNS lookup to translate the domain name into an IP address. This recursive resolution process involves querying multiple DNS servers in a specific order until the final IP address is obtained. In contrast, an iterative DNS resolution involves the client querying each DNS server in the resolution chain individually.

The DNSSEC validation chain is a critical component of secure DNS resolution. DNSSEC provides a way to cryptographically verify the authenticity of DNS responses using digital signatures. The resolver must follow the DNSSEC trust chain, starting from the root zone, to validate each response in the resolution process. This ensures the client is receiving authentic data and protects against DNS cache poisoning attacks.

DNS resolvers employ caching to improve performance and reduce load on upstream DNS servers. The Time-to-Live (TTL) value specified in DNS responses determines how long a resolver can cache a record before it must be refreshed. Resolvers also implement negative caching per RFC 2308, caching the fact that a record does not exist for a specified period.

EDNS0 is an extension to the DNS protocol that allows larger response packets, support for DNSSEC, and other advanced capabilities. Resolvers must support EDNS0 to take advantage of these features. DNS over HTTPS (DoH) is another extension that encrypts DNS traffic to provide better privacy and security. Resolvers can be configured to use DoH by specifying the appropriate DNS server URL.

Stub resolvers are lightweight clients that rely on a recursive resolver to perform the full resolution process on their behalf. In contrast, a full resolver is a standalone service that performs the entire recursive lookup independently. Glue records are a special type of DNS record that provides the IP address of a name server, allowing the resolver to follow a delegation chain.

The root hints file contains the IP addresses of the 13 root DNS servers that form the starting point for all recursive resolution. Resolvers must be configured with the correct root hints to bootstrap the resolution process. The resolver follows the delegation chain, querying the appropriate top-level domain (TLD) servers and then the authoritative servers for the specific domain, until the final IP address is obtained.The Time-to-Live (TTL) value specified in DNS responses is a crucial factor in caching behavior. A higher TTL allows the resolver to cache the record for a longer period, reducing the need for additional queries and improving resolution speed. However, a lower TTL means the resolver must refresh the record more frequently, ensuring the data remains up-to-date. Resolvers should balance caching efficiency with data freshness based on the specific use case and requirements.

Negative caching, as defined in RFC 2308, allows resolvers to cache the fact that a record does not exist for a domain. This is particularly useful for non-existent domains or domains with no associated records, as it prevents the resolver from repeatedly querying authoritative servers for the same negative response. Negative caching entries are stored with their own TTL, ensuring the resolver refreshes the negative cache in a timely manner.

EDNS0, or Extension Mechanisms for DNS, is an extension to the DNS protocol that provides several enhancements. It allows for larger DNS response packets, enabling the transfer of DNSSEC records and other data that exceeds the standard 512-byte limit. EDNS0 also introduces support for DNSSEC, allowing resolvers to indicate their DNSSEC capabilities and receive the appropriate signed responses. Additionally, EDNS0 enables the use of new resource record types and other advanced features.

DNS over HTTPS (DoH) is an emerging protocol that encrypts DNS traffic to provide better privacy and security. Instead of using the traditional DNS port 53, DoH utilizes HTTPS on port 443 to transmit DNS queries and responses. This helps protect against eavesdropping and man-in-the-middle attacks, as well as censorship and surveillance efforts that target unencrypted DNS traffic. Resolvers can be configured to use DoH by specifying the appropriate DNS server URL, which typically follows a well-known format like https://doh.example.com/dns-query.

Stub resolvers are lightweight DNS clients that rely on a recursive resolver to perform the full resolution process on their behalf. They send queries to the recursive resolver and receive the final IP address in response, without needing to handle the complex recursive lookup themselves. This architecture offloads the computational and network overhead of recursive resolution, making it suitable for resource-constrained devices like IoT sensors or mobile clients. In contrast, a full resolver is a standalone service that performs the entire recursive lookup independently, querying the necessary authoritative servers and caching the results for subsequent requests.

Glue records are a special type of DNS resource record that provide the IP address of a name server, allowing the resolver to follow a delegation chain. When a resolver encounters a referral to a name server during the resolution process, it needs the IP address of that name server to continue the lookup. Glue records, if present, supply this information, preventing the resolver from having to perform an additional query to obtain the name server's IP address. This improves the efficiency and speed of the overall resolution process.The delegation chain is a crucial aspect of the DNS resolution process. When a resolver queries a top-level domain (TLD) server, such as the .com or .org TLD, the TLD server may respond with a referral to the authoritative name servers for the specific domain being resolved. The resolver must then query these authoritative name servers to obtain the final IP address. This process of following the delegation chain, from the root servers to the TLD servers and then to the authoritative servers, is what allows the DNS system to scale and distribute the management of domain names across multiple organizations and administrative domains.

The root hints file is a critical component of the DNS resolution process, as it provides the resolver with the initial set of IP addresses for the 13 root DNS servers. These root servers form the starting point for all recursive resolution, as they are responsible for directing resolvers to the appropriate TLD servers. Resolvers must be configured with the correct root hints file to ensure they can properly bootstrap the resolution process and follow the delegation chain. Outdated or incorrect root hints can lead to resolution failures or suboptimal performance.

DNSSEC, or Domain Name System Security Extensions, is a set of protocols that provide cryptographic verification of DNS responses. DNSSEC uses digital signatures to ensure the authenticity and integrity of DNS data, protecting against cache poisoning attacks and other threats. During the recursive resolution process, the resolver must follow the DNSSEC trust chain, starting from the root zone and validating each response in the chain. This ensures the client receives accurate and trustworthy DNS data, even in the face of potential attacks or compromised servers.

The EDNS0 extension also enables the use of new resource record types, such as the EDNS Client Subnet (ECS) record. ECS allows resolvers to include information about the client's network location in their queries, which can help authoritative servers provide more accurate and localized responses. This is particularly useful for content delivery networks (CDNs) and other geographically-distributed services, as it allows them to serve the most appropriate resources to the client based on their network proximity.The recursive resolution process can be contrasted with the iterative resolution approach, where the client queries each DNS server in the resolution chain individually. In the recursive model, the local resolver on the client machine handles the full resolution process, querying the necessary servers and caching the results for future use. This offloads the complexity from the client application and provides a more seamless user experience. Iterative resolution, on the other hand, requires the client to actively manage the resolution steps, querying each server in turn until the final IP address is obtained. The recursive approach is the more common and widely-adopted model for DNS resolution.

Stub resolvers are a lightweight implementation of the DNS client, designed to operate on resource-constrained devices or in environments where the full recursive resolution process is not required. These stub resolvers rely on a separate, dedicated recursive resolver to perform the complete lookup on their behalf. By offloading the computational and network overhead of recursive resolution, stub resolvers can provide basic name resolution capabilities with a smaller footprint, making them suitable for use in IoT devices, mobile applications, or other scenarios where resource efficiency is a key concern.

The root hints file, also known as the root server hints, contains the IP addresses of the 13 root DNS servers that form the starting point for all recursive resolution. Resolvers must be configured with the correct root hints file to ensure they can properly bootstrap the resolution process and follow the delegation chain to the appropriate top-level domain (TLD) servers and ultimately the authoritative servers for the specific domain being resolved. Outdated or incorrect root hints can lead to resolution failures or suboptimal performance, as the resolver may be unable to locate the necessary servers to complete the lookup.