What is the difference between a recursive and an iterative DNS query?
Show the answer
Say this first
A recursive query asks for the final answer or an error, and the server does all the work. Stubs on laptops send recursive queries with the RD (recursion desired) bit set. An iterative query accepts a referral, "ask that server next". Resolvers send iterative queries to root, TLD and authoritative servers, which answer only from their own data. Authoritative servers should not offer recursion to the internet.
Go deeper
The flags
| Flag | Set by | Meaning |
|---|---|---|
| RD | client | recursion desired |
| RA | server | recursion available on this server |
| AA | server | authoritative answer |
A typical resolver reply shows flags: qr rd ra. A query sent with dig +norecurse straight to an
authoritative server returns flags: qr aa.
Keep the roles apart
- Recursive resolvers serve your own clients and cache.
- Authoritative servers publish your zones to the world and should refuse recursion. In BIND that is
recursion no;on the authoritative instance, orallow-recursionlimited to internal clients.
Why it matters
An open resolver (recursion for anyone) gets used for DNS amplification: small spoofed queries, large answers aimed at the victim. It also gives attackers a cache to try to poison. Resolver defences against poisoning include source port randomisation and DNSSEC validation.
They will ask next
How do you query an authoritative server directly?
dig @ns1.example.com www.example.com +norecurse. Check thataais in the flags. If it is missing, that server is not authoritative for the zone, which points at a lame delegation.Why is an open resolver dangerous for you, not only for the victim?
Your bandwidth and your address become the attack source. Upstream providers will rate-limit or block you, and your address ends up on abuse lists.
Traps
- Saying stubs send iterative queries.