Support Library

Authoritative DNS vs Recursive DNS

Authoritative servers answer for their own zones; recursive resolvers look names up and cache them. How to tell them apart with dig.

Author
CategoryDNS Comparisons
Length3 minute read
UpdatedOctober 24, 2026

The short answer

An authoritative server holds a zone and answers for it from its own data. A recursive resolver holds no zones of its own: it takes a client's question, asks authoritative servers from the root down until it gets the answer, caches it for the record's TTL, and returns it. Your laptop talks to a recursive resolver; the recursive resolver talks to authoritative servers.

AuthoritativeRecursive
Answers forOnly the zones it hostsAny name, by looking it up
Data comes fromZone files, a database, or a provider's APIIts cache, filled from authoritative servers
Flag in the replyaa (authoritative answer)ra (recursion available), no aa
Who should reach itEveryone on the internetOnly its own users, unless it is a public service
ExamplesYour DNS host's name servers, the root and TLD serversYour ISP's resolver, 1.1.1.1, 8.8.8.8, 9.9.9.9

Telling them apart with dig

CommandWhat to look for
dig @1.1.1.1 example.com Ard ra in the flags, no aa: a cached, recursive answer, with the TTL counting down
dig +norecurse @hera.ns.cloudflare.com example.com Aaa in the flags and the full TTL: an authoritative answer
dig +trace example.com Adig acting as its own recursive resolver, following referrals from the root

Always use +norecurse when you query an authoritative server, so a server that also does recursion cannot hide a missing zone by looking the answer up elsewhere.

Why the difference matters

  • Troubleshooting. A correct answer from one authoritative server does not exclude a delegation, DNSSEC or reachability problem affecting a resolver. Compare every authoritative server and the requested RRsets, inspect validation errors, and check resolver policy. Wait for a TTL only when you have identified an otherwise healthy cached answer; repair incorrect authoritative data at its source.
  • Security. A recursive resolver open to the whole internet can be abused for amplification attacks. Restrict recursion to your own clients, and turn it off on authoritative servers.
  • DNSSEC. Authoritative servers sign; recursive resolvers validate. A validation failure shows up as SERVFAIL from the resolver, not from the authoritative server.
  • Privacy. The recursive resolver sees every name its users look up. Encrypted transports such as DoH and DoT protect the client-to-resolver hop only.

Types of DNS servers adds forwarders and stub resolvers to the picture, and how a DNS lookup works walks through one lookup step by step.

How DNS Panopticon helps

Domain Visualizer sees your domain the way users do: through a public recursive resolver (Cloudflare by default, or Google or Quad9). That means it reports what resolvers return, including cached answers, rather than what each of your authoritative servers holds. To check a server's own copy of the zone, query it directly with +norecurse.

Sources and further reading