- Part 1: The Local Resolver
- Part 2: Querying a DNS Server
- Alternate Query Responses
- How Iteration Works
- How Caching Works
Alternate Query Responses
The previous discussion of DNS queries assumes that the process ends with a positive response returned to the client. However, queries can return other answers as well. These are the most common:
-
An authoritative answer
-
A positive answer
-
A referral answer
-
A negative answer
An authoritative answer is a positive answer returned to the client and delivered with the authority bit set in the DNS message to indicate that the answer was obtained from a server with direct authority for the queried name.
A positive answer can consist of the queried RR or a list of RRs (also known as an RRset) that fits the queried DNS domain name and record type specified in the query message.
A referral answer contains additional resource records not specified by name or type in the query. This type of answer is returned to the client if the recursion process is not supported. The records are meant to act as helpful reference answers that the client can use to continue the query using iteration.
A referral answer contains additional data such as resource records (RRs) that are other than the type queried. For example, if the queried host name was "www" and no A RRs for this name were found in this zone—but a CNAME RR for "www" was found instead, the DNS server can include that information when responding to the client.
If the client is able to use iteration, it can make additional queries using the referral information in an attempt to fully resolve the name for itself.
A negative response from the server can indicate that one of two possible results was encountered while the server attempted to process and recursively resolve the query fully and authoritatively:
-
An authoritative server reported that the queried name does not exist in the DNS namespace.
-
An authoritative server reported that the queried name exists, but no records of the specified type exist for that name.
The resolver passes the results of the query—in the form of either a positive or negative response—back to the requesting program, and caches the response.
Note
If the resultant answer to a query is too long to be sent and resolved in a single UDP message packet, the DNS server can initiate a failover response over TCP port 53 to answer the client fully in a TCP connected session.
Disabling the use of recursion on a DNS server is generally done when DNS clients are being limited to resolving names to a specific DNS server, such as one located on your intranet. Recursion might also be disabled when the DNS server is incapable of resolving external DNS names, and clients are expected to fail over to another DNS server for resolution of these names.
For Windows 2000 Server, you can disable the use of recursion for DNS servers as needed by configuring in Advanced properties in the DNS console on the applicable server.
By default, Windows 2000 DNS servers use several default timings when performing a recursive query and contacting other DNS servers:
- A recursion retry interval of three seconds. This is the length of time the DNS service waits before retrying a query made during a recursive lookup.
- A recursion time-out interval of 15 seconds. This is the length of time the DNS service waits before failing a recursive lookup that has been retried.
Under most circumstances, these parameters do not need adjustment. However, if you are using recursive lookups over a slow-speed WAN link, you might be able to improve server performance and query completion by making slight adjustments to the settings.