DNS Delegation Explained: From Root to Authoritative Nameserver

When a recursive resolver looks up www.example.com, it follows referrals down a hierarchy until an authoritative nameserver can answer for the zone that contains the name.

Root, TLD, and delegation

The root zone knows which nameservers serve each TLD. The TLD returns the delegation for example.com: NS names and sometimes glue. The child zone begins at that delegation cut.

example.com. 172800 IN NS ns1.dns-host.example
www.example.com. 300 IN A 203.0.113.42

NS records and glue

An NS record names a server. Glue is an address supplied by the parent when the nameserver hostname lives inside the child zone, preventing a circular dependency.

Recursive resolvers and DNSSEC

A recursive resolver performs the root-to-authority walk, caches answers according to TTL, and returns the result to the client. DNSSEC adds signatures: a validating resolver follows DS, DNSKEY, and RRSIG records back to a trusted root. It authenticates DNS data but does not encrypt traffic. A broken chain can produce SERVFAIL, unlike NXDOMAIN.

Trace checklist

1. Ask the root for the TLD referral.
2. Ask the TLD for the child NS set and glue.
3. Query the exact record at the authoritative server.
4. Separate cached answers from authoritative answers.
5. Check TTLs and validate DS, DNSKEY, and RRSIG.