DNS series #2: recursive vs iterative DNS query

This is the second article in a series (see article 1 and article 3) of DNS troubleshooting articles that cover some important aspects of the DNS protocol that are worth knowing when troubleshooting application performance issues.

For various reasons (size of database, performance, redundancy, security), when trying to translate an FQDN (Fully Qualified Domain Name) into an IP address, a single DNS server cannot answer all requests by itself. To do that on his own, it would have to store all FQDNs defined worldwide and be able to handle all requests!

The Name Space Architecture

To handle this challenge, the DNS resolution process will use an architecture called the “Name Space”. To resolve any FQDN, the “Name Space” is based on a tree structure like the example shown hereunder:

In this tree structure, each zone is managed by Authoritative Name Servers that contain the mappings between domain names and related IP addresses in the zone itself as well as pointers to subsequent zones.

How iterative DNS resolution works

Apart from the information that is available in its local cache, the DNS client trying to convert the FQDN (e.g. www.accedian.com) into an IP address will take the following steps:

1. The DNS client (the PC on which the web browser is installed) will first contact the “.” Root Name Server (called “Root Hints”);
2. This Name Server will then send the IP address of the “.com” Name Server(s) to the client;
3. The client then contacts the next Name Server in the chain, up until the Name Server that contains the full FQDN is found and reached. This process is summarized in the following figure.

This process is called an “iterative” process as the client makes all needed requests up to the final FQDN resolution.

How recursive DNS resolution works

In practice though, when looking for the IP address of the FQDN “accedian.com”, the client will generally contact its local DNS server (configured in its IP stack) to ask for the IP address corresponding to “accedian.com”.

The client asks the local DNS server to perform all needed requests on its behalf. This is called a « recursive » DNS query.

How to distinguish iterative and recursive DNS queries

The client undertakes a recursive request by flagging a particular bit in the flag section of the DNS query “Recursion desired: Do query recursively”, as shown in the Wireshark trace hereunder.

In its response, the Name Server will confirm (or not) that it supports the recursive DNS query behavior by setting the flag “Recursion available: Server can do recursive queries” to 1 (to 0).