Planisys Cybersecurity

What is a DNS Resolver? #

A DNS resolver (also called a recursive resolver) is a server that receives DNS queries from clients and performs the work of locating the correct DNS records across the global DNS infrastructure.

Resolvers are typically operated by:

Internet Service Providers (ISPs)
enterprise networks
cloud providers
public DNS services

Instead of contacting multiple DNS servers directly, users send their query to a resolver, which performs the full lookup process.

How Recursive DNS Resolution Works #

When a resolver receives a query that is not already cached, it performs a sequence of DNS queries across the Internet.

A user sends a query for example.com to the resolver.
The resolver checks its cache. If the answer exists, it immediately returns it.
If the answer is not cached, the resolver queries the DNS root servers.
The root servers return a referral to the TLD servers responsible for the domain.
The resolver then queries the TLD servers.
The TLD servers return the authoritative nameservers for the domain.
The resolver queries the authoritative server and obtains the final record.
The resolver returns the result to the client and stores it in cache.

The Root DNS Servers #

The DNS root servers represent the starting point of the global DNS hierarchy.

There are 13 logical root server identities, named from A.root-servers.net to M.root-servers.net.

Each identity is operated by different organizations and distributed globally using DNS Anycast. This results in hundreds of physical root server instances located in Internet exchange points and data centers worldwide.

These servers do not know the IP address of every domain. Instead they provide referrals to the appropriate Top Level Domain (TLD) servers.

The root.hints File #

Recursive DNS resolvers need an initial list of root servers in order to start the DNS resolution process.

This list is stored in a file called root hints.

On Debian systems running BIND, the file is typically located at:

/usr/share/dns/root.hints

The file contains the names and IP addresses of the root servers, for example:

.                        3600000      NS    A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30

When a resolver starts, it loads this file to learn how to contact the root servers.

Once the resolver successfully queries the root zone, it can refresh this information dynamically.

Updating the Root Hints File #

The list of root server addresses rarely changes, but DNS operators periodically update the root hints file to ensure accuracy.

The official root hints file is published by InterNIC and IANA.

You can retrieve the latest version with:

curl https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints

Many administrators automate this process using a scheduled task.

#!/bin/bash

URL="https://www.internic.net/domain/named.cache"
DEST="/usr/share/dns/root.hints"

curl -fsSL $URL -o ${DEST}.new

if cmp -s ${DEST}.new $DEST; then
    rm ${DEST}.new
else
    mv ${DEST}.new $DEST
    systemctl reload bind9
fi

This script downloads the updated file and reloads BIND only if the content has changed.

DNS Resolver Caching #

Resolvers cache DNS responses to reduce latency and network traffic.

Caching provides several advantages:

faster DNS responses for frequently requested domains
reduced load on authoritative DNS servers
lower overall Internet traffic

The cache duration is controlled by the TTL (Time To Live) value defined in DNS records.

DNS Resolvers and Security #

Recursive resolvers are also an important security control point.

Many networks deploy advanced resolver features including:

DNSSEC validation to verify DNS authenticity
RPZ policy zones for DNS filtering
Protective DNS services that block malicious domains
encrypted DNS protocols such as DoT, DoH and DoQ

Because nearly every Internet connection begins with a DNS query, resolvers provide powerful visibility and control over network activity.

What is a DNS Resolver?