DNS التكراري

The Recursive Resolution Process

When a DNS ResolverA server that receives DNS queries from clients and resolves domain names by querying the DNS hierarchy on their behalf. Public resolvers like 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) are widely used alternatives to ISP resolvers. receives a query it does not have cached, it begins recursive resolution. Starting from a root hint file (a list of root server IP addresses built into resolver software), it sends an iterative query: "Do you know the answer to www.example.com?" The root server responds with a referral to the .com TLD servers. The resolver queries a .com server, which refers it to example.com's Authoritative DNS ServerA DNS server that holds the original, definitive DNS records for a domain zone. It provides answers directly from its zone data rather than querying other servers, serving as the source of truth for that domain. servers. Finally, the authoritative server returns the A RecordA DNS record that maps a domain name to an IPv4 address (e.g., example.com -> 93.184.216.34). The most fundamental DNS record type for resolving domain names to IP addresses.. The resolver caches each referral and the final answer, then returns the result to the client.

This process typically completes in 20-200ms for uncached queries, depending on network latency to each server in the chain.

Public Recursive Resolvers

Several organizations operate large-scale public recursive resolvers:

These resolvers offer advantages over ISP resolvers: better uptime, faster response from global anycast infrastructure, and (for some) privacy commitments. Quad9 also blocks malicious domains using threat intelligence feeds.

DNSSEC Validation

A validating recursive resolver verifies DNSSEC signatures as it traverses the hierarchy. Each zone signs its records with a private key; the resolver checks signatures using public keys retrieved from the DNS and validated up to the trusted root anchor. This prevents cache poisoning — forged responses will fail signature verification. Cloudflare's 1.1.1.1 and Google's 8.8.8.8 both perform DNSSEC validation.

Use DNS Leak Test to verify that your DNS queries go to your intended recursive resolver and not an intercepting middlebox.