DNS Lookup: Recursive & Iterative Architecture

Lesson Overview & Learning Objectives

Before a single TCP packet can be routed across the internet, your client must answer a fundamental question: What is the numeric IP address of the target hostname? The Domain Name System (DNS) is a globally distributed, hierarchical, fault-tolerant key-value database designed to resolve human-readable domains into machine-routable IPv4 and IPv6 addresses. In this guide, we break down the distinction between recursive and iterative resolution, explore the thirteen root nameserver clusters, inspect critical DNS record types, and review cryptographic security with DNSSEC.

1. The DNS Hierarchy: From the Root Dot to Subdomains

Domain names are structured in an inverted tree hierarchy, parsed strictly from right to left. Every fully-qualified domain name (FQDN) implicitly terminates in a trailing dot (draftsbook.com.), representing the DNS Root Zone:

Tier 1

Root Zone (.)

13 logical root server addresses (A through M), mirrored across thousands of Anycast nodes globally by ICANN/IANA.

Tier 2

Top-Level Domain (TLD)

Managed by registries (e.g. Verisign for .com and .net, Nominet for .uk). Maintains delegations for all domains.

Tier 3

Authoritative NS

Hosted by DNS providers (Cloudflare, Route 53, NS1). Contains the definitive master zone records for your specific domain.

Tier 4

Subdomains & Hosts

Host-level records defined inside the zone (e.g., api.draftsbook.com, cdn.draftsbook.com).

2. Recursive vs. Iterative Queries: How Resolution Actually Works

Understanding the mechanics of DNS requires distinguishing between two query patterns:

Recursive Query (Client → Recursive Resolver)

Your browser or operating system stub resolver issues a recursive query to a configured recursive DNS server (such as your ISP's resolver, Cloudflare 1.1.1.1, or Google 8.8.8.8). A recursive query asks: "Fetch the final answer for me; do not return until you have the IP or a definitive error (NXDOMAIN)."

Iterative Queries (Recursive Resolver → Hierarchy Servers)

The recursive resolver performs the actual legwork through a sequence of iterative queries. An iterative query asks: "Give me the answer, or refer me to the next authoritative server down the tree."

Query Root: Resolver asks Root Server (.) for draftsbook.com. Root responds with a referral to the .com TLD nameservers.
Query TLD: Resolver asks the .com TLD server. TLD responds with a referral to the authoritative nameservers for draftsbook.com (e.g., ns1.cloudflare.com).
Query Authoritative: Resolver asks the authoritative server. Authoritative server consults its zone database and returns the final A or AAAA record.
Cache & Return: Resolver caches the record for the designated Time-To-Live (TTL) and delivers the IP address back to your client stub.

3. Essential DNS Record Types

Record	Name / Meaning	Sample Value	Engineering Use Case
A	Address (IPv4)	104.21.48.91	Maps a hostname directly to a 32-bit IPv4 address
AAAA	IPv6 Address	2606:4700:3031::6815:305b	Maps a hostname to a 128-bit IPv6 address
CNAME	Canonical Name (Alias)	cdn.draftsbook.com → origin.aws.com	Aliases one domain to another. (Cannot coexist at apex/root @)
MX	Mail Exchange	10 mail.google.com	Specifies inbound SMTP mail servers with priority weights
TXT	Text Record	"v=spf1 include:_spf.google.com ~all"	Email security (SPF, DKIM, DMARC) and domain verification tokens
NS	Name Server Delegation	ns1.draftsbook.test	Delegates a DNS zone to authoritative nameservers
PTR	Pointer Record	91.48.21.104.in-addr.arpa	Reverse DNS lookup: resolves an IP address back to a hostname
SOA	Start of Authority	admin.draftsbook.com 2026030101 7200	Zone administration parameters, serial numbers, refresh timers

4. Security in DNS: DNSSEC & Cache Poisoning

Historically, DNS operated over unencrypted UDP on port 53 without cryptographic verification. This design permitted DNS Cache Poisoning (Kaminsky attacks), where attackers spoofed UDP response packets to trick recursive resolvers into caching malicious IP addresses.

To guarantee authenticity and data integrity, the internet standards introduced DNSSEC (DNS Security Extensions). DNSSEC signs DNS records using public-key cryptography (RRSIG records verified against DNSKEY records). Resolvers establish a unbroken Chain of Trust anchored at the Root Zone trust anchor, mathematically proving that a DNS response was generated by the legitimate domain owner and was not altered in flight.

Key Takeaway for Web Engineers

Modern web browsers also leverage DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) to encrypt DNS queries between your local computer and the recursive resolver, preventing local Wi-Fi eavesdroppers and ISPs from tracking domain names you visit.