Recursive DNS resolver

What it means

A recursive DNS resolver accepts a client's request to obtain DNS data and tries to return a useful answer, often following referrals to other DNS servers on a cache miss. It is not inherently authoritative for the name being requested. The resolver may serve a valid cached answer without contacting the authoritative zone again. Your ISP, workplace or a configured third-party provider can operate the resolver; different devices may use different resolvers. Resolver responsibilities Terminology

Try it

Example — two resolvers can disagree temporarily. This is a static cache illustration. Times are hypothetical and not measured.

At t=0: authoritative www.example.com A = 192.0.2.10, TTL = 300 s
        Resolver A caches that answer with a 300 s lifetime
At t=30: Resolver A has 270 s remaining
At t=60: authoritative A changes to 192.0.2.20
At t=90: Resolver A may return old 192.0.2.10 from its cache
         Resolver B, with no old cached answer, may fetch 192.0.2.20

In the illustration, Resolver A's cached answer is normally eligible until the stored lifetime expires; lowering the new TTL does not retroactively reset it. Real behavior depends on the resolver's policy and query history, so this is not a prediction of what every visitor sees. Both IPv4 values belong to documentation-only TEST-NET space.

What a cache can store

Negative caching matters when a new hostname is created after users previously received NXDOMAIN. The negative response can remain cached with a lifetime derived from the zone's SOA information; it is not simply the prospective new record's TTL. Negative caching

RFC 8767 describes serve-stale behavior, under which a resolver can retain and conditionally answer with expired information to maintain service when fresh DNS lookups encounter difficulties. Do not assume every resolver enables it or that a stale response proves the authoritative zone is outdated. Serve stale

In practice

If one visitor sees an old address and another sees a new one, compare their resolver answers for the same name and type, including TTL and response status. Next query an authoritative nameserver to establish what the zone currently serves. Avoid describing this as a single global propagation process: caches expire independently, configurations differ, and negative/stale replies introduce other possibilities.

The existing DNS TTL model shows one intentionally bounded resolver. See DNS change not visible for diagnosis and authoritative nameserver for the source of zone answers.