A machine room seen down a cold aisle, one adult operator standing mid-row with an open laptop

A cutaway · one query, end to end

Follow it down.

The question leaves, and does almost nothing on the way out. Six stops between pressing return and getting an address.

Stop five is a room like this one. The other five stops are somebody else’s room, and that is the whole arrangement.Photograph

01Your machine

The question leaves, and does almost nothing on the way out

The resolver on your laptop is a stub. It sends the whole name to one configured server, sets a bit asking for recursion, and waits. Everything below this line happens somewhere else.

Read this stop

A workstation screen showing a query trace, room lit by the monitor — A trace on screen is the only place a query’s passivity is visible: one message out, one message back, and no record of the route it took.Photograph

02The cache

Most questions stop here, and you never learn it

The recursive resolver checks what it already holds. If the record is there and its countdown has not finished, that is your answer and no other server is contacted — which is also why a change you made an hour ago is not visible to you yet.

Read this stop

Two adult engineers at a bench of network gear with a laptop between them — Two engineers reading the same bench from opposite ends. Neither of them can see what a resolver on somebody else’s network is still holding.Photograph

03The root

Asked, and it declines to answer

One of thirteen addresses replies with a referral: the servers responsible for .org, and their addresses. It has no opinion about anything inside .org and no way to find out.

Read this stop

An open rack door in a quiet facility with one machine lit — One machine, lit, in a facility answering on one of thirteen addresses and holding no answers of its own.Photograph

04The registry

Another referral, one label further down

The servers for .org name the servers for the zone, and publish their addresses too. Those addresses are the glue. Without them the resolver holds a name it cannot use.

Read this stop

A whiteboard with a delegation tree drawn on it in marker — A delegation drawn by hand is the only version of it anybody can read. The zone carries the version that counts.Photograph

05Authoritative

The one machine that actually holds the record

It answers from data it was given and resolves nothing on anybody’s behalf. tinydns answered from a single prebuilt file and refused the second job outright; NSD, Knot and the PowerDNS authoritative server all take the same position now.

Read this stop

A single rack unit with its status lights on in an otherwise dark cabinet — One rack unit. Everything the name resolves to lives on it, and it resolves nothing on anybody else’s behalf.Photograph

06Back, and stored

The countdown starts the moment you get the answer

The record arrives with a time to live, and the cache counts down. Until it reaches zero, that value is what the world sees, whatever you have since changed. The root’s own delegation records carry six days.

Read this stop

A wall clock above a rack in a machine room — A clock above the row. Nothing on this floor is counting your TTL down — the caches are, and the caches are elsewhere.Photograph

Answering for a zone and resolving on somebody’s behalf are two different jobs.

In 1999 that was an argument. It is now the ordinary position, and the reason a resolver’s cache cannot be poisoned into a zone’s authoritative data.

Why the two jobs were split apart

Kept running by

Resolvers, registrars, and operations teams whose work runs parallel to these pages.

Five servers, and what each was built to be good at

The implementations, compared honestly. There is no best nameserver — there are different answers to the same two questions.

A rack of mixed hardware with labelled shelves in a machine room

Five servers, and what each was built to be good at

BIND, NSD, Knot, Unbound and PowerDNS solve overlapping problems with different priorities, and the differences are architectural.

Five servers

A terminal showing a compact data file, warm desk lamp beside the screen

tinydns, and the file it answers from

The design that gives this domain its name answered from a single prebuilt constant database and refused to recurse in the same process.

Five servers

Two separate machines side by side on a bench, cabled independently

Why the two jobs were split apart

Keeping authoritative service and recursion in separate processes removed a whole class of failure, and the field eventually agreed.

Five servers

A hardware security module in a rack with a key switch on the front panel

What DNSSEC does, and what it does not

It proves an answer came from the zone; it does not make the answer private or the zone correct.

Five servers

Thirteen addresses, hundreds of sites

Anycast, and what the root actually is.

Thirteen addresses, hundreds of sitesThere are thirteen root addresses because of a packet size limit, and far more than thirteen machines because of anycast. What anycast actually doesThe same address announced from many places, and the routing table deciding which one you reach. The root zone, and who signs itThe file itself is small, published, and signed in a ceremony that is a matter of record.

An adult engineer at an open rack door in an exchange-point facility, hand on a labelled cable — Cable labels are the only place a delegation is written down in the physical world. Where they disagree with the zone, the zone wins and nobody finds out for months.Photograph

Where it actually breaks

Four failures account for most real outages, and all four are visible from outside the organisation that caused them.

Lame delegationA parent points at a server that will not answer for the zone, and everything below it goes quiet. Missing glueWhen the nameserver lives inside the zone it serves, the parent has to carry its address or the chain cannot start. The serial that never incrementedSecondaries only pull when the number goes up, so an edit that forgets it never leaves the primary. Expired at the registrarThe commonest total outage has nothing to do with the servers at all.

Everything, in one list