About

A nameserver implements the DNS protocol (RFC1034, RFC1035 and numerous others). The DNS protocol allows, among other things, to map hostnames as used by humans (for example in an URL) to IP addresses as used by computers to find a server on the internet. A DNS query to one nameserver is often the first step that will happen for any activity online.

A nameserver can have two very different roles:

• authoritative: it holds all information about a given zone, and is the final authority on everything in the zone; it is publicly accessible and will only respond positively to requests about names in the zones it manages; each domain name has a small fixed set of nameservers, typically between 2 to 5, sometimes more, and all of them will be queried getting on average the same number of queries each (load balancing); a domain name lists the name of its authoritative nameservers.
• recursive: it is able to resolve any name by following a recursive algorithm starting from the root, to find authoritative nameservers at each label of the name being queried; it can be installed on each client computer (in that case it only replies to queries from the host), or the host can use the ones provided by its ISP (that will reply only to queries from clients of the ISP), or some big open ones (like those offered by Google, CloudFlare, Quad9, etc.); a given computer typically uses only one recursive nameserver, sometimes two for failover (second one will only be used if first one does not reply at all); it is configured with the IP address of the recursive nameserver it wants to use.

Some software (ex: bind) is able to be configured in both roles at the same time, or either one, where other software are only for recursive nameservers (ex: unbound) or only authoritative (ex: knot).

For security reasons, it is better not to have the same software doing both roles at the same time.