Recursive DNS resolver
The DNS server that walks the chain from root → TLD → authoritative on behalf of a client and returns the final answer. Caches results aggressively.
A recursive DNS resolver is the server your OS asks when it needs to look up a hostname. It's the difference between "I have to walk the entire DNS tree" and "let someone else handle it and just give me an answer."
Who runs them
- Your ISP. Default for most home and office networks. Quality varies wildly. Some inject ads or block sites.
- Public resolvers. Cloudflare's 1.1.1.1, Google's 8.8.8.8, Quad9's 9.9.9.9. Free, fast, generally privacy-respecting.
- Corporate networks. Often run their own for internal name resolution + filtering.
- Operating systems. macOS, Windows, and modern Linux distros have a local DNS cache that sits between apps and the actual resolver.
What they do
For each query:
- Check local cache. If a fresh answer exists, return it.
- If not, walk the chain: root → TLD → authoritative for the zone.
- Cache the answer for the TTL.
- Return to the client.
Why your choice of resolver matters
- Speed. Some resolvers are faster than others. Public resolvers (1.1.1.1, 8.8.8.8) are typically faster than ISP defaults.
- Privacy. ISPs can log every domain you visit. Public resolvers vary on logging policy. Cloudflare claims 24h, no IP retention; Google retains for analytics.
- Filtering. Some resolvers block known malware/phishing domains (Quad9, Cloudflare for Families). Others let everything through.
- Censorship circumvention. Public resolvers often work in regions where ISP resolvers are tampered with.
For SaaS operators
You don't choose your users' resolvers — they do. But you can encourage faster resolution for them by hosting on anycast authoritative DNS so resolvers reach you quickly from anywhere.