DNS Resolution Model

DNS names form a rooted tree. A domain is the subtree rooted at a name. A zone is an administrative portion of that tree served as authoritative data. Domain and zone are therefore not synonyms: a zone can delegate a child subtree and no longer contain its authoritative records.

Delegation and Authority #

The parent zone delegates child.example. by publishing NS records at that name. The child zone publishes its own apex SOA and NS records. A resolver asking the parent for data below that cut receives a referral with the child’s NS RRset in the Authority section.

If an NS target lies inside the delegated child zone, the parent also supplies glue A or AAAA records in the Additional section. Glue breaks the circular dependency of resolving the child name server before contacting it. A resolver must treat glue as bootstrap address data, not as authoritative data for the target’s address.

An authoritative server answers from its zone data. A recursive resolver answers clients from its cache or performs iterative queries. A stub resolver does not traverse delegations; it asks a configured recursive resolver to do so.

Response Semantics #

For a query, a server can return an answer, a referral, or an error response. NXDOMAIN states that the queried name does not exist. NOERROR with an empty answer can instead mean that the name exists but has no records of the queried type, commonly called NODATA.

A CNAME identifies its owner as an alias. No other data may coexist at that owner, because an alias must not also own independently authoritative data. Follow the CNAME target until obtaining the requested type, another alias, or an error. DNAME is different: it aliases an entire subtree and causes synthesized CNAME processing for names below its owner.

Caching and DNSSEC #

Resolvers cache RRsets according to TTL. Negative answers are cached according to SOA information. DNSSEC lets a validating resolver authenticate positive and negative answers through a DS-to-DNSKEY chain of trust from a configured trust anchor. NSEC or NSEC3 proofs authenticate denial; a bare NXDOMAIN response does not.

Use fully qualified names with a terminal dot in zone-file and protocol documentation examples when ambiguity with a configured origin would be harmful.

For packet encoding, see DNS Wire Format. For the operational configuration of a server, see BIND 9 Authoritative and Recursive DNS.