What is the difference between a DNS resolver and an authoritative DNS server?¶
title: "What is the difference between a DNS resolver and an authoritative DNS server?" card_id: "IP-037" status: "complete" source_document: "https://docs.google.com/document/d/1_p8ey_LmTw4wRWGeqDkkkVVX5RW7ND_RQCw0C8c7NQA/edit?usp=drivesdk"
What is the difference between a DNS resolver and an authoritative DNS server?¶
What is the difference between a DNS resolver and an authoritative DNS server?¶
A DNS resolver and an authoritative DNS server both answer DNS queries, but they perform different jobs.
The resolver works on behalf of the device asking the question.
When a laptop or phone needs information about a domain name, it normally sends the query to a configured resolver.
That resolver might be operated by an internet provider, mobile network, workplace or public DNS service. A home router may also act as a local resolver or forward queries to one elsewhere.
The resolver first checks whether it already has a usable answer in its cache.
If it does, it can return that answer immediately.
If it doesn't, the resolver follows the DNS hierarchy and contacts other DNS servers until it reaches a source that can provide the answer.
This is why it is often called a recursive resolver: it does the work required to resolve the name on behalf of the requesting device.
The authoritative DNS server has a different role.
It publishes the DNS records for a particular domain or DNS zone.
For example, the authoritative servers for ifdigital.co.uk may publish the records showing which IPv4 or IPv6 addresses are associated with that name.
They may be operated by the organisation controlling the domain, its DNS-hosting provider, a cloud platform or a content-delivery network.
An authoritative server doesn't normally search the wider DNS system on behalf of the device.
It answers from the records for which it is responsible.
“Authoritative” means that the server is an official DNS source for those records. It doesn't mean that every piece of information in the records is necessarily current, accurate or evidence of who operates a particular device.
The resolver and authoritative server may also see different parts of the lookup.
A resolver receiving a direct query may be able to see information about the device or network that asked it.
The authoritative server will often see the query arriving from the resolver—not from the original device.
This means that an authoritative DNS log may identify a provider or public resolver that requested the record, rather than the person whose device caused the lookup.
Caching creates another difference.
If the resolver already has the answer, it may not contact the authoritative server at all. Many devices can then receive the cached answer without generating a new query at the authoritative server.
Neither system’s logs automatically prove that the device subsequently connected to the named service.
The resolver finds the answer. The authoritative server publishes the answer.
Understanding which one produced a record is essential before deciding what that record can actually show.