A recursive resolver finds answers for clients. An authoritative server publishes data for zones it serves. Both speak DNS, but they answer different questions from different sources of truth.
The short distinction
| Recursive resolver | Authoritative server |
|---|---|
| Acts on behalf of a client | Acts on behalf of a zone |
| Follows referrals or uses cached data | Answers from authoritative zone data or returns a referral |
| Caches eligible responses | Publishes configured resource records |
| May perform DNSSEC validation | Serves DNSSEC records and signatures when the zone is signed |
| Its answer is an observation from that resolver | Its answer is evidence from that authoritative service |
Current DNS terminology defines a recursive resolver as a system that receives recursive queries and resolves them, commonly using a cache. It distinguishes that role from authoritative servers, which have authoritative data for zones [1].
What the client usually asks
An operating system or application normally sends a recursive query to a configured resolver. That resolver may be operated by:
- a local router or organization;
- an internet service provider;
- a public resolver provider; or
- the same organization that operates other infrastructure.
The client asks for a final result. The recursive resolver may answer immediately from cache or contact several authoritative services to construct that result.
The identity of the resolver matters. Two resolvers can legitimately return different cached states at the same moment.
What an authoritative server knows
An authoritative server answers from zones it is configured to serve. For a name inside one of those zones, it can return:
- an authoritative positive answer;
- an authoritative negative answer;
- an alias that requires more resolution; or
- a referral at a delegation point.
It does not normally walk the hierarchy on behalf of the client. The original DNS architecture separates authoritative data maintenance from recursive query processing [2].
The AA response flag indicates that the responding server considers the
answer authoritative in the relevant response context. It does not mean that
every record elsewhere in the message is authoritative.
One machine can implement more than one role
“Resolver” and “authoritative server” describe roles, not necessarily separate hardware. Software can be configured to provide multiple DNS functions. Internet-facing deployments usually separate recursion from authoritative service because their trust, access, caching, and abuse-control requirements differ.
Do not infer a server’s role from its IP address alone. Inspect:
- whether it accepts recursion for the client;
- whether it is listed or referred to as authoritative for the zone;
- whether the response is authoritative or cached; and
- which exact name and record type were queried.
Why the answers can differ
Suppose the DNS host now publishes a new address with a TTL of 300 seconds:
- the authoritative server can show the new RRset immediately after its zone update;
- one recursive resolver may still hold the previous RRset until its cached lifetime ends;
- another resolver may have no cached copy and fetch the new answer;
- local policy or split DNS may deliberately produce another result.
The difference does not prove that the authoritative change failed. Compare like with like and record the observation point.
A safe troubleshooting sequence
- Query the intended recursive resolver and record its answer, TTL, response code, and observation time.
- Identify the authoritative servers from the parent referral.
- Query the authoritative service for the same name and type.
- If authoritative servers disagree, investigate zone publication or provider synchronization.
- If authoritative servers agree but a recursive answer differs, consider caching, resolver policy, validation, and local DNS context.
Never describe one recursive answer as global DNS state. Never assume a control panel value is published until an authoritative response confirms it.
What each result proves
Recursive result: what that resolver returned at that time, possibly from cache and subject to its policy.
Authoritative result: what that authoritative service returned for the query at that time.
Neither result alone: that TLS, HTTP, email, or another application protocol works after resolution.
Next step
Learn how zones, delegation, parent and child NS records, and glue connect authoritative services.