The DNS Glossary: Every Term Decoded, Zero Boring Textbook Vibes

DNS has its own dense little vocabulary, and a lot of it gets used casually in documentation without ever being properly explained. Here's the whole cast of characters, defined the way we wish someone had explained them the first time.

The core cast

Resolver — the piece of software that actually does the work of turning a domain name into an answer on your behalf. Your laptop, your router, and your ISP typically each run one, forming a chain.

Recursive resolver — a resolver that will do the full legwork of tracking down an answer from scratch, querying root servers, then TLD servers, then authoritative servers, so the client doesn't have to. Public examples: Google's 8.8.8.8, Cloudflare's 1.1.1.1.

Authoritative nameserver — the actual source of truth for a domain's records. When a recursive resolver finally reaches the right authoritative server, that answer is the real one, not a cached copy of it.

Zone — a distinct, administratively separate portion of the DNS namespace (typically a domain and its subdomains) that a set of authoritative nameservers is responsible for.

Root servers — the small set of servers (13 logical addresses, run by multiple operators, heavily distributed via anycast) that sit at the very top of the DNS hierarchy and know where to find the servers for every top-level domain.

TLD (top-level domain) — the last label in a domain name: .com, .io, .co.in. Each TLD has its own registry operator responsible for its zone.

The behind-the-scenes machinery

TTL (Time To Live) — how long, in seconds, a resolver is allowed to cache an answer before it has to ask again. Covered in depth in our propagation guide.

Negative caching — resolvers don't just cache successful answers; they also cache the fact that a record doesn't exist, for a duration set by the zone's SOA record. This is why a freshly-created record can sometimes appear to "not exist yet" even after it's published — a resolver may still be holding onto the previous "not found" answer.

Glue records — a nameserver's own IP address, published directly in its parent zone, needed specifically when a domain's nameserver is a subdomain of itself (like ns1.example.com being a nameserver for example.com) — without glue, resolving the nameserver's address would require... resolving the nameserver, a circular dependency DNS solves by shortcutting it.

Zone transfer (AXFR) — the mechanism secondary nameservers use to copy an entire zone from the primary. A zone transfer left open to the public internet is a real information-disclosure risk (it hands over your entire DNS configuration in one request), so it should always be restricted to known secondary servers.

Anycast — a routing technique where the same IP address is announced from many physical locations simultaneously, and network routing sends each query to the nearest one. Most large public resolvers and root servers use anycast, which is why they're both fast and resilient — no single physical location is a single point of failure.

The registration side

Registry — the organization that operates a TLD's authoritative infrastructure and maintains its master database (e.g., Verisign for .com).

Registrar — the company you actually buy a domain through, which is accredited to register names within a registry on your behalf. Your registrar and your DNS provider are very often different companies — a common source of confusion (see our DNS troubleshooting guide).

WHOIS / RDAP — protocols for looking up a domain's registration data (registrant info where public, creation/expiry dates, current registrar). RDAP is the modern, structured successor to the older WHOIS protocol.

The email-specific terms

SPF, DKIM, DMARC — the trio of records that authenticate outbound email and tell receiving servers what to do with mail that fails authentication. Full breakdown in our email authentication guide.

PTR / reverse DNS — a record mapping an IP address back to a hostname, the opposite direction of a normal lookup, and a meaningful signal in email deliverability. See our PTR guide.

The security layer

DNSSEC — a set of cryptographic extensions that let a resolver verify a DNS answer genuinely came from the correct authoritative source and wasn't tampered with. Full explainer here.

DoH / DoT (DNS-over-HTTPS / DNS-over-TLS) — protocols that encrypt the DNS query itself in transit, addressing confidentiality rather than authenticity (the thing DNSSEC handles). The two are complementary, not competing.

Keep this bookmarked

None of these terms are complicated in isolation — DNS documentation just tends to assume you already know them all at once. Next time one of these shows up in a scan result or a provider's dashboard, this is the page to come back to. And if you'd rather see them in context on a real domain than as abstract definitions, run a scan and DNSDecode will label everything it finds along the way.