Difference Between Iterative and Recursive
Difference Between Iterative and Recursive
Search
HOME PAGE ABOUT US CONTACT US ARCHIVE ARCHIVES SECURITY NOTES TECHNICAL NEWS
NETWORKING
Home Archives difference between iterative and recursive dns query difference between iterative and recursive dns query
In this post, we will walk through different types of queries that a client uses to get different types of
information from the DNS server.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
1. recursive query
2. iterative query OR Nonrecursive query
3. Inverse queries
Lets understand the entire process of recursive queries by the following steps.
Suppose you want to browse www.example.com, and your resolve.conf file has got the following entry.
The above resolve conf entry means that,Your DNS servers are 172.16.200.30 & 31. Whatever application
you use, the operating system will send DNS queries to those two DNS servers.
STEP 1: You enter www.example.com in the browser. So the operating system's resolver will send a DNS
query for the A record to the DNS server 172.16.200.30 .
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
STEP2: The DNS server 172.16.200.30 on receiving the query, will look through its tables(cache) to find the
IP address(A record) for the domain www.example.com. But it does not have the entry.
STEP 3: As the answer for the query is not available with the DNS server 172.16.200.30, this server sends a
query to one of the DNS root server,for the answer. Now an important fact to note here is that root server's
are always iterative servers.
STEP 4: The dns root server's will reply with a list of server's (referral) that are responsible for handling the
.COM gTLD's.
STEP 5: Our DNS server 172.16.200.30 will select one of the .COM gTLD server from the list given by the
root server, to query the answer for "www.example.com"
STEP 6: Similar to the root server's , the gTLD server's are also iterative in nature, so it replies back to our
DNS server 172.16.200.30 with the list of IP addresses of the DNS server's responsible for the
domain(authoritative name server for the domain) www.example.com.
STEP 7: This time also our DNS server will select one of the IP from the given list of authoritative name
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
servers, and queries the A record for www.example.com. The authoritative name server queried, will reply
back with the A record as below.
STEP 8: Our DNS server 172.16.200.30 will reply us back with the ip domain pair(and any other resource if
available). Now the browser will send request to the ip given, for the web page www.example.com.
As you can see from the above figure. Our DNS server(172.16.200.30) queries through other dns server's on
behalf of us.
Note: The above explained scenario of recursive query happened, only because, our DNS server
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
172.16.200.30 was configured as a recursive name server. You can also disable this feature for your DNS
server.
How does the name server select one from the given list of servers to query?
In the above case, you might have seen that our DNS server 172.16.200.30, had to select one server, from
the given list of servers to query, multiple times.
For example there are 13 root servers(Well when i say 13 root servers, 13 is the number of addresses that is
universal. There are Hundreds of servers at different locations in the world. These 13 root server addresses
are anycasted addresses.), which root server will be queried, for an answer?
Almost all DNS server's uses an algorithm, to select one from the list, in order to distribute the load and
response time.
The most Famous DNS server software BIND uses a technique called as rtt metric(Round Trip Time metric).
Using this technique, the server tracks the RTT of each root server, and selects the one,with lower RTT.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
What is an iterative or Non-recursive query?
Before beginning the explanation for iterative query. An important thing to note is that, all DNS server's must
support iterative(non-recursive)query.
In an iterative query, the name server, will not go and fetch the complete answer for your query, but will give
back a referral to other DNS server's, which might have the answer. In our previous example our DNS server
172.16.200.30, went to fetch the answer on behalf of our resolver, and provided us with the final answer.
But if our DNS server 172.16.200.30 is not a recursive name server(which means its iterative), it will give us
the answer if it has in its records. Otherwise will give us the referral to the root servers(it will not query the root
server's and other servers by itself.).
Now its the job of our resolver to query the root server, .COM TLD servers, and authoritative name server's,
for the answer.
STEP 1: You enter www.example.com in the browser. So the operating system's resolver will send a DNS
query for the A record to the DNS server 172.16.200.30 .
STEP 2: The DNS server 172.16.200.30 on receiving the query, will look through its tables(cache) to find the
IP address(A record) for the domain www.example.com. But it does not have the entry.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
STEP 3: Now instead of querying the root server's, our DNS server will reply us back with a referral to root
servers. Now our operating system resolver, will query the root servers for the answer.
Now the rest of the steps are all the same. The only difference in iterative query is that
if the DNS server does not have the answer, it will not query any other server for the answer, but rather it
will reply with the referral to DNS root server's
But if the DNS server has the answer, it will give back the answer(which is same in both iterative and
recursive queries)
in an iterative query, the job of finding the answer(from the given referral), lies to the local operating
system resolver.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
It can be clearly noted from the above figure, that in an iterative query, a DNS server queried will never go and
fetch the answer for you(but will give you the answer if it already has the answer). But will give your resolver a
referral to other DNS server's(root server in our case).
We will be discussing inverse queries in another post. Hope this post was helpful in understanding
iterative(non-recursive) & recursive DNS queries.
52 Comments
Add a comment...
Akash Dubey
You may prefer to add numbering to the work flow diagram to ease the pain for someone who would not have seen a
dns server in action , or a guy like me, As I jumped to the diagram to choose if I want to read the article further
and I find it totally worthy reading.
Like Reply 3 Jan 12, 2013 7:41am
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
good explanation of DNS.
Like Reply Jan 12, 2013 10:35pm
Niven Peter
Thanks for the explanation, very well described
Like Reply Sep 29, 2013 7:30pm
Ksven Nero Networking Engineer at KDDI - Ho Chi Minh Global Network Operations Center
thank you very much... very helpful... :">
Like Reply Oct 15, 2013 7:27am
Amina Mubeen
thanks for sharing. steps were very clear and easy to understand. and the drawings aided a lot in understanding the
process.
Like Reply Dec 21, 2013 4:04pm
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Like Reply Jan 23, 2014 3:23am
Comments
DNS Queries
Permalink Submitted by Sameer Gawde on Tue, 04/30/2013 - 14:56
Very good artical explaning minute details regarding DNS queries and clearling all doubts .
Thanks a ton
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
reply
Very good and nicely explained article on DNS queries with proper steps and diagrams made my day.
Thanks a lot.
reply
It is a very good article. Bu tell me examples for resolvers under debian. I mean the last diagram where the
resolver get a list of DNS and tries to query the DNS by yourself.
Is it a service? How can I find if it is running on my system?
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Hi bbo,
Permalink Submitted by Sarath Pillai on Mon, 07/01/2013 - 21:44
Hi bbo,
We are happy to know that you liked the article. Resolver libraries in Linux are almost the same across
distributions.
However udns library is the most commonly used while running commands such as "host"(the udns
library is aviailable online for download.)
Regards
Sarath
reply
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Great work!!!!!!
Permalink Submitted by Aziz on Thu, 07/25/2013 - 13:25
Great work!!!!!!
reply
Hi Sir,
Very good documentation. what is advantage & disadvantage of both queries,which is one best &why? will
iterative queries decrease load of DNS server? I am confuse. Both queries gives surely answer then what is
advantages & disadvantages?
reply
Hi Rupesh,
Permalink Submitted by Sarath Pillai on Sat, 08/03/2013 - 00:34
Hi Rupesh, Good to know that you liked the article. And a warm welcome to slashroot!! Lets get back to
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
your question ! Recursive queries: these kind of queries are used most commonly when we set up an
internal DNS server for a domain, or say for example a company. The client computers or say normal
desktops that the employees are using in the company on a day to day basis generate huge amount of
DNS requests. So those servers are mostly configured in recursive manner( because the question is
asked by desktops which are normal internal clients ) and we need to provide our clients with an exact
answer to the query correct. Another important fact to note about recursive queries is that you need to
very carefully restrict which clients/subnets that are allowed to do a recursive query. You know why ?
Because there is a dangerous risk involved if you configure publicly available DNS servers in a
recursive model. Now lets say we have around 1 lakh DNS servers in the world which are available
publicly and are able to do recursive queries, an attacker can change the source address to the target
of his desire, and send junk DNS requests to those publicly available DNS servers which will cause the
target server to be under attack ( because these 1 lakh servers will sit and reply to that incorrect source
address, which the attacker forged to make it the target ). Such kind of an attack is called as DNS
reflection attack !!! All authoritative name servers, root name servers, TLD servers are always iterative in
nature ( ofcourse these servers are not made to go and fetch the answer for a query correct ! ) Hope that
explains. Thanks & regards Sarath
reply
This is the simplest way to explain the differences of DNS query were as i have read the others post and
their is lots of confusion to understand the actual concepts of DNS query hows it resolves but you have
explain it thorougly which is very useful.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Regards,
Afzal Ashrafi.
System Administrator.
reply
Hi Afzal Ashrafi,
Permalink Submitted by Sarath Pillai on Tue, 11/05/2013 - 18:11
Hi Afzal Ashrafi,
reply
Very good
Permalink Submitted by Nikhil Rupanwar on Wed, 11/27/2013 - 23:33
Greate explanation I was confused about iterative and recursive queries it helped me alot. thanks
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
reply
One of our clients requests that we have a local DNS server on our linux host and this DNS server should be
iterative, not recursive. So I left in the resolv.conf the only single string "nameserver 127.0.0.1" and insttalled
bind. In the options section of named.cond I have "allow-recursion { 127.0.0.1; };" and in this case all works
fine. But when I disable recursion completely (according to client's requierements) by removing "allow-
recursion { 127.0.0.1; };" and adding instead "recursion no;" all the applications on the host cannot resolve
anything, saying "unknown host" (not surprisingly though).
So the question is how to switch properly named from recursive to iterative mode and to preserve the linux
resolver's ability of resolving any hostnames from local applications?
reply
Hi,
So you are trying to disable recursion completely and still enable your local LAN servers to successfully
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
resolve requests. Unfortunately fullfilling your requirement with any BIND name server package later
than version 9.5+ is not possible. This is because bind version later to 9.5+ are now not replying with a
referral to DNS root servers for queries which it does not have an answer.
(even when recursion no; was specified) would return a referral to the root servers (since these
would, most likely, b e availab le in the cache). Since BIND 9.5+ such queries are now failed with
REFUSED status
So try using an older version of bind (probably 9.4 or something) if you really need that feature.
I would like to make one more point here. Why dont you allow recursion for your local intranet or say
trusted hosts with an argument like allow-recursion. Basically the idea behind disabling recursion is
due to the following reasons.
Dos attacks (publicly available dns servers can be targeted by attackers with huge amounts of
requests to consume resources)
DNS amplification attacks(if there are hundreds of publicly available dns servers, which accepts
recursive queries, an attacker can use all of them to amplify traffic their specified target by
sending forged requests to all of them)
And cache poisoning.
But yeah if your dns server is not a publicly available one, then these threats are not on your radar. But
yeah its better to make your dns server do recursive queries for your trusted subnets. Hope that
answers your question.
Regards
Sarath
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
great post
Permalink Submitted by imanuel on Tue, 01/21/2014 - 12:34
reply
Easy to understand
Permalink Submitted by Kumpon on Wed, 01/22/2014 - 10:12
It's very very great to see your post because i doubt the recursive and the iterative dns for long time. Thank
you
reply
Perfect explanation. Thank you so much for providing such a nice explanation. :)
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
reply
kalakiteenga thala
Permalink Submitted by saravanan subra... on Wed, 02/12/2014 - 12:45
I would like to thank you for serving the people who are all in the complicated
situation in understanding the concepts in depth. this helps not only me but for all the basic networking
learners, because DNS is very important for every thing.
Thank you
Saravanan
reply
thanks
Permalink Submitted by vijay pratap singh on Tue, 03/25/2014 - 17:00
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Question: Iterative lookup
Permalink Submitted by tokol on Mon, 04/21/2014 - 05:16
A question regarding iterative lookup: How will our configured (iterative) DNS server populate its cache if the
resolver is responsible for doing the queries against the root DNS servers, TLD servers and the
authoritative name servers?
From the article it seems like our iterative DNS server never "sees" the A records returned from the
authoritative name servers, since the resolver does the query itself. Any help/clarification is highly
appreciated.
reply
DNS
Permalink Submitted by gt on Fri, 04/25/2014 - 11:52
awesome explanation which is in very easy terms ..which can be understand by a newbie
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
too good :)
Permalink Submitted by sri on Fri, 05/09/2014 - 19:54
reply
reply
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
what is Inverse queries
Permalink Submitted by shinu on Thu, 07/17/2014 - 13:04
reply
Hi,
reply
using forwaders
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Permalink Submitted by george on Sat, 02/14/2015 - 06:54
Excellent article, I just have one question. If I am using a chain of DNS forwarders are those requests
considered recursive? Say my client machine's primary DNS server is a domain controller configured to
forward DNS requests to my ISP's DNS severs which in turn forwards requests to Google's public DNS
recursors. Are the requests between those three DNS servers considered recursive?
reply
To clarify if forwarded requests are considered recursive then would one expect the response to
traverse backwards in the chain?
Client > Primary DNS > ISP DNS > Google DNS (found in cache) > ISP DNS > Primary DNS > Client.
However if forwarded requests are iterative, the request goes up the chain and when an answer is
found it would go directly back to my client.
Client > Primary DNS > ISP DNS > Google DNS (found in cache) > Client
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Great Work!!
Permalink Submitted by Karthik on Mon, 06/29/2015 - 11:24
Thanks a lot!!
reply
Very Useful...!!!
Permalink Submitted by Shubham Shah on Fri, 07/31/2015 - 11:47
Thanks a lott...
Please come up with the new articles on all the types of VPN fundamentals, Protocols and Firewall
fundamentals with packet capture
reply
Awesome explanation.
Permalink Submitted by Vishesh on Sun, 08/09/2015 - 18:30
Awesome explanation.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
reply
excellent article
Permalink Submitted by azmat shaikh on Wed, 09/09/2015 - 12:39
reply
Wow dude,
Permalink Submitted by bajay j. on Fri, 09/18/2015 - 18:02
Wow dude,
this is amazing - for the first time I clearly understand the machinery behind dns in very simple terms.
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Permalink Submitted by Shahnwaz on Thu, 10/08/2015 - 12:44
Thanks a lot for this easy and simple explanation of DNS. Really great.
reply
Good explanation
Permalink Submitted by Anonymous on Tue, 11/03/2015 - 20:21
reply
Nyc Explanation
Permalink Submitted by Atul Girishkumar on Tue, 05/17/2016 - 10:46
Thanks a lot for this easy and simple explanation of DNS. Really awesome.
reply
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Good Explanation
Permalink Submitted by Vinodh on Wed, 09/21/2016 - 17:09
Good One. Can I get a similar kind of explanations on what exactly happens when you type google.com in
browser and apply all the concept of ARP,TCP handshake,DNS. In each layer how the packet is carrier.
reply
good explanat
Permalink Submitted by Anonymous on Sun, 10/09/2016 - 17:59
good explanationn
reply
Excellent explanation
Permalink Submitted by Neeraj on Tue, 11/29/2016 - 08:54
Excellent explanation
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
reply
One of the best DNS queries explanations I've ever came through.
Well done.
reply
Good
Permalink Submitted by Ajay sharma on Fri, 04/14/2017 - 00:10
reply
JAVA code
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Permalink Submitted by Abdul Rehman on Tue, 05/02/2017 - 22:28
reply
Thanks
reply
Your name
Subject
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Comment *
Word verification *
Type the charac ters you see in the picture above; if you can't read them, submit the form and a new image will be generated. Not case sensitive.
Save Preview
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Searc h Artic les ... Search
* indicates required
Email Address
*
First Name
Last Name
Subscribe
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
IPERF: How to test network
Speed,Performance,Bandwidth
Arc hives - 15 comment(s)
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Most Commented Top Rated Articles
How Does Traceroute Work and Example's of using EIGRP (Enhanced Interior Gateway Routing Protocol)
traceroute command
Networking - 69 comment(s)
Average: 5 (5 votes)
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
SAN vs NAS - Difference between a Storage Area
Network and Network Attached Storage Introduction to git version control system
Average: 5 (3 votes)
difference between iterative and recursive dns query
Arc hives - 42 comment(s) Netstat command examples and its usage
Average: 5 (3 votes)
Average: 5 (2 votes)
Average: 5 (2 votes)
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
examples of using basic linux regular expressions
Average: 5 (2 votes)
Ph: +917303074400
Follow us on Twitter
Email: sarath@slashroot.in
Be a fan on Facebook
*
Subscribe
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Recent Posts Last Viewed
Difference Between Segments, Packets and Frames password protection for a file in linux through vim
Netw orking - 3 days 7 hours ago Security Notes - last view 2 sec ago
How is TCP & UDP Checksum Calculated? YUM repository and package management: Complete
Tutorial
Netw orking - 4 days 9 hours ago
Archives - last view 24 sec ago
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com