Résolveur DNS

Resolver Types

DNS resolvers come in two forms. A stub resolver is the minimal implementation built into every operating system — it sends queries to a configured resolver IP and waits for an answer without doing any recursion itself. The recursive resolver (also called a full-service resolver or recursor) does the actual work: it receives queries from stub resolvers and chases the DNSDomain Name System. The hierarchical, distributed naming system that translates human-readable domain names (e.g., example.com) into IP addresses (e.g., 93.184.216.34). Often called the "phonebook of the internet." hierarchy from root servers down to authoritative servers.

When you configure 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) as your DNS server, you're pointing your stub resolver at a public recursive resolver. When your ISP's router provides a DNS address via DHCPDynamic Host Configuration Protocol. A network protocol that automatically assigns IP addresses, subnet masks, gateways, and DNS servers to devices when they join a network., that's the ISP's recursive resolver.

Caching and Performance

Recursive resolvers cache answers according to each record's TTL. Popular domains are cached across millions of resolver instances worldwide, meaning resolution often returns from cache in a few milliseconds. Less-queried domains require the full recursive walk, which can take 50-200ms across multiple round trips to geographically distributed Authoritative DNS ServerA DNS server that holds the original, definitive DNS records for a domain zone. It provides answers directly from its zone data rather than querying other servers, serving as the source of truth for that domain. servers.

Cache poisoning attacks inject false records into resolver caches, redirecting users to malicious servers. DNSSEC (DNS Security Extensions) cryptographically signs zone data, allowing resolvers to verify authenticity. A resolver validating DNSSEC is called a validating resolver.

Privacy Implications

Traditional DNS is cleartext — your recursive resolver sees every domain you query. If you use your ISP's resolver, the ISP can log your browsing patterns. Public resolvers like 1.1.1.1 advertise privacy-preserving policies. DNS over HTTPS (DoH) encrypts queries between your stub resolver and the recursive resolver, preventing network-level observation.

Use DNS Leak Test to verify which resolvers handle your actual DNS queries.