What is Recursive DNS?
Introduction
The Domain Name System (DNS) helps computers to map an easy-to-remember domain name to an IP address. Computers can make two types of DNS requests to get an IP address: recursive DNS requests and iterative DNS requests.
The key difference between recursive DNS requests and iterative DNS requests is that, in the recursive DNS query, the resolving name server doesn't need your computer’s explicit request every time. Instead, your computer authorizes it to make all further necessary DNS queries with the first request.
Let’s start with iterative DNS requests.
Iterative DNS requests
When your computer makes an iterative DNS request to a DNS resolver, sometimes called a resolving name server, that server first looks into its cache to see if it can return the IP address. If another computer has recently made the same request, the resolving name server will have a copy of the IP address in its cache.
If the IP address is not in the cache, the resolving name server responds to your computer’s iterative DNS request by providing the address to the root name server to ask.
Through the resolving name server, your computer makes several requests:
- Gets the IP address of the top-level domain (TLD) name server from the root name server.
- Gets the IP address of the authoritative name server from the TLD name server.
- Gets the IP address for the domain name from the authoritative name server.
Here is a diagram showing the resolution process for the domain bunny.net:
The key thing to note for iterative DNS requests is that every request must originate from your computer. In other words, the resolving name server can only act with your machine’s explicit instruction each and every time.
Recursive DNS requests
In a recursive DNS query to a resolving name server, just like in the iterative DNS request, the server checks its cache to see if it has an answer. If the resolving name server does not have an answer, instead of telling your computer which server it should go to next, the resolving name server makes queries to other DNS servers on your computer’s behalf until it finally gets the IP address to pass on to your computer.
How recursive DNS requests help
Recursive DNS requests shorten the amount of time needed to resolve a domain name’s IP address. Your computer authorizes the resolving name server to make requests on its behalf so every request doesn't need authorization. Furthermore, a resolving name server’s cache can quickly resolve a domain name’s IP address if already cached.
When recursive DNS requests go wrong
Recursive DNS requests are helpful, but they can be exploited by attackers. For example, attackers can fool DNS servers into thinking that a recursive DNS request from their computer is coming from yours by spoofing, or faking, your computer’s IP address when making the request. Attackers can command tens of thousands of computers to fake recursive DNS requests, causing all the responses to go to your computer instead of theirs. The sheer volume of responses can cause your computer to crash or become unresponsive.
Another exploit is when recursive DNS requests are intercepted by attackers who then return the IP address of a malicious website instead of the actual IP address of a domain name. If the malicious IP address enters a popular resolving name server’s cache, the cache is considered “poisoned." Every query to resolve that domain name returns the IP address of the malicious website and thousands of computers could be affected.
