edgeacademyCUSTOMER ENGINEERING
Workspace/Overview
MODULE 02 · LESSON 1 OF 5

URL to address: recursive and authoritative DNS

12 min read · Sources linked below

Theory and industry practice are explained below. Cloudflare-specific behavior links to official documentation. Customer examples are hypothetical.

Learning objectives

  • Distinguish recursive and authoritative DNS
  • Interpret cached and authoritative answers
  • Explain proxy status in the request path

The mental model

Typing a URL does not tell the browser which server to contact. The hostname must be translated into usable network information, often using cached results. A recursive resolver does the work of finding an answer for the client. Authoritative servers publish answers for the zones they serve. Those are different roles even when one company offers both services. DNS is also separate from HTTP: a valid address does not prove the website is healthy. During an incident, ask which resolver answered, which record type was requested, and whether the answer is current. Different users can temporarily receive different answers because caches expire at different times.

How it works

A typical lookup begins with local and resolver caches. On a cache miss, a recursive resolver follows DNS delegation from the root toward the authoritative servers for the name. A and AAAA records supply IPv4 and IPv6 addresses; a CNAME redirects name resolution to another name. The TTL controls how long an answer may normally be cached, so changing a record does not instantly replace every cached response. Negative answers can also be cached. Distinguish NXDOMAIN, which indicates a nonexistent name, from SERVFAIL, which indicates that resolution could not be completed successfully.

For a Cloudflare proxied record in an active zone, DNS returns Cloudflare addresses rather than the configured origin address. DNS-only records take a different traffic path. Verify actual record eligibility and proxy status instead of assuming every record is proxied. Diagnose with explicit queries for A, AAAA, CNAME, NS, and relevant DNSSEC status. Compare the recursive answer with the authoritative answer and record the remaining TTL. A browser may use a different resolver path than your command-line tool, including secure DNS settings. This difference is evidence to investigate, not proof that either tool is wrong.

Resolvers configured to serve stale data may reuse expired answers when they cannot refresh them; TTL is not a guarantee of global convergence (RFC 8767).

Applied example · hypothetical

Hypothetical example: a team changes an origin address and some offices continue reaching the old service. The authoritative server returns the new value, while one recursive resolver still returns the old value with time remaining on its TTL. Restarting the web application will not fix that observation. You verify whether the old origin can safely remain available through the transition and compare A and AAAA records. The exercise teaches that a migration plan must account for cached answers and both address families, not just the value visible in a dashboard.

In a customer engagement

A Cloudflare customer may confuse using 1.1.1.1 as a recursive resolver with using Cloudflare as authoritative DNS for a domain. Clarify the distinction and inspect the actual delegation. Then confirm whether the affected hostname is proxied. This determines whether the subsequent request should reach Cloudflare's HTTP edge and which logs can reasonably contain the request.

Interview relevance

Explain DNS as a delegated naming system with caching, then connect that model to a concrete failure. Interviewers value a comparison between authoritative truth and a recursive cached answer. Avoid saying propagation is a mysterious global broadcast; describe TTLs, delegation, and the specific evidence you would collect.

Common mistakes

  • Assuming DNS success proves HTTP success
  • Ignoring AAAA records during migration
  • Confusing recursive and authoritative Cloudflare services

Key terminology

Recursive resolver — A DNS service that resolves names on behalf of clients, usually using caching and delegation.

Authoritative DNS — A server role that supplies authoritative records for a zone.

DNS TTL — The normal freshness lifetime of a DNS answer. Serve-stale resolvers may reuse expired data when refresh fails.

Explain it without the page

  • How would you distinguish a stale cache from wrong delegation?
  • Why might a browser and dig produce different observations?

Further reading

Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.

Split timing boundaries

curl --output /dev/null --silent --show-error \
  --write-out 'dns=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n' \
  https://example.test/

Illustrative command for an authorized hostname. curl timing fields are cumulative from start, so subtract relevant milestones for stage durations. Connection reuse and redirects can change interpretation.