What Is Authoritative DNS?

At a glance

Recursive resolvers follow DNS delegations to the authoritative nameservers. NS records identify the servers responsible for a zone.

Why authoritative DNS supplies the final answer

Authoritative servers hold a zone's published records and identify their answers as authoritative. Recursive resolvers follow root and top-level-domain delegations to obtain final A, MX, TXT and other data. An authoritative server normally does not recursively resolve unrelated Internet names for users.

A parent delegates using NS and, where necessary, glue addresses. SOA describes the child zone's primary information and synchronization parameters. Authoritative nodes should serve consistent versions. Providers can use Anycast and global nodes to improve resilience and response times.

From parent delegation to child zone

• The top-level domain returns NS delegation. Nameservers inside the delegated domain need parent-side glue addresses to avoid circular dependencies.
• A recursive resolver selects an authoritative node and may try another on failure. Multiple nodes are only a foundation: networks and zone data must actually remain independently available.
• Primary and secondary zones synchronize through AXFR/IXFR or provider mechanisms. SOA serial numbers help secondaries identify updates.
• With DNSSEC, parent DS and child DNSKEY must form a continuous trust chain. Correct delegation alone does not prove valid signatures.

Changing DNS providers without an outage

Import and verify the complete zone at the new provider first. Keep old and new authorities serving consistent answers, then change NS delegation at the registrar. Wait for old delegation caches to expire before closing the old zone; deleting it immediately can break resolvers still using cached NS records.

Common faults include parent-child NS disagreement, stale zone versions, incorrect glue, blocked TCP port 53 and omitted non-web records such as CAA or TXT. Compare SOA and important records across authoritative nodes to diagnose them.

Practical use and interpretation

NS hostnames and ASN can identify a likely provider; multiple nodes and Anycast give architectural clues. Branded nameservers may be white-label third-party services, so also inspect address ownership, SOA and provider patterns.

Nameserver presence does not prove every node is healthy. Consistent authoritative answers from each node support a stronger reliability assessment. Incomplete coverage leaves that question unknown.

Points to consider

Nameserver names can suggest a DNS provider, but provider identity alone does not establish operational reliability.

Frequently asked questions

How is authoritative DNS different from public DNS?

Authoritative DNS publishes official zone records. Public DNS usually means recursive resolvers that find and cache answers on users' behalf.

Do two NS records guarantee high availability?

No. Shared networks, common failure points or inconsistent zone data can negate the apparent redundancy.

Why do parent and child NS records differ?

A migration or misconfiguration may be responsible. Parent NS controls the delegation path; the child NS set should normally remain consistent with it.