Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between an authoritative DNS server and a recursive resolver?
Short answer
An authoritative DNS server produces, from its own data, answers only for the zones it hosts; it does not ask another server about a name it does not know. A recursive resolver, on the other hand, asks the relevant authoritative servers on behalf of the client, starting from the root servers, caches the result and returns it to the client (RFC 9499); the DNS servers that organizations and internet service providers give to clients are in this role. The DNS Service in TR7 GTM is an authoritative listener. When a DNS Forwarder Profiles profile is assigned to the service from the DNS Forwarder field, a separate resolver component runs in front of the authoritative server: the service's own zones are still answered from the authoritative server, and the other queries are forwarded to the upstream DNS servers in the profile; Frontend IP addresses marked DIRECT bypass this component.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → Service Management | DNS Service | Authoritative listener; it answers only for the service's domains |
| GTM → DNS Forwarder Profiles → Add | Forwarding Address, Domain Based Forwarding | The default and the domain-specific upstream servers to which the queries for which the service is not authoritative are forwarded |
| Service Management → service form | DNS Forwarder (default Disabled); DIRECT in the Frontend IP row | Assigning the profile to the service; limiting the selected addresses to authoritative answers only |
| GTM → GTM Services → service name → Dashboard | Forwarder tab | The rate of queries forwarded to upstream servers, bandwidth, cache and latency (visible only while a profile is assigned) |
Comparison
| Authoritative server | Recursive resolver | |
|---|---|---|
| Answer source | Its own zone data | The answer found by asking other servers |
| A name it does not know | Does not ask another server | Asks along the chain until it finds it |
| Cache | Not its core function | Its core function |
| In TR7 GTM | DNS service | The component that comes into play when a DNS Forwarder Profiles profile is assigned |
Query Flow When a Forwarder Is Assigned
- If the query comes to a Frontend IP address that is not marked DIRECT, it first reaches the resolver component.
- If the queried name belongs to one of the service's own domains, the answer is taken from the authoritative server.
- If the name matches a Domain Based Forwarding rule, the query is forwarded to the addresses of that rule, and if it matches none of them, to the addresses in the Forwarding Address list; if multiple rules match, the longest matching domain wins.
- A query coming to an address marked DIRECT bypasses the resolver and goes directly to the authoritative server; no recursion is done for the names outside the service's domains.
- The resolver component does not apply restrictions based on the client address, and it forwards the DNSSEC records coming from the upstream servers without validating them; for this reason, DIRECT is marked on the Frontend IP addresses open to the internet, and recursion is left on the addresses facing the internal network (DNS Forwarder Profiles · Operational Best Practices).
- In a cluster, each device runs its own resolver component; the profiles are transferred to the peer device.
Common Misconceptions
- "GTM resolves all of the users' DNS queries." The DNS service is authoritative only for its own domains; for the other names, a DNS Forwarder Profiles profile must be assigned to the service.
- "The forwarder profile also asks the upstream server about the service's own domains." The service's domains are always answered from the authoritative server; however, a Domain Based Forwarding rule more specific than the service's domain routes that subtree to the upstream server.
- "When a forwarder is assigned, all Frontend IP addresses perform recursion." The addresses marked DIRECT give only authoritative answers.
How it is done in the documentation
