Octet

Say this first

The stub resolver on the client checks its own cache and hosts file, then sends one recursive query (RD bit set) to its configured resolver. If the resolver has nothing cached, it walks the tree itself: a root server refers it to the .com servers, a .com server refers it to example.com's name servers, and an authoritative server for example.com returns the A record. The resolver caches the answer and the referrals for their TTLs and hands the record back to the client.

Go deeper

The walk

Output

PC1 stub  -- recursive query, RD=1 -->  resolver 10.0.0.53
resolver  -- www.example.com A? ---->  a root server        referral: com. NS plus glue
resolver  -- www.example.com A? ---->  a .com TLD server    referral: example.com. NS plus glue
resolver  -- www.example.com A? ---->  ns1.example.com      answer, AA bit set
resolver  -- answer, RA=1 ---------->  PC1

With QNAME minimisation (RFC 9156) the resolver asks the root only about com. and the TLD only about example.com., so the full name is not leaked to servers that do not need it.

Details interviewers probe

Root addresses come from the root hints built into the resolver: 13 names, a to m.root-servers.net, each served by many anycast instances worldwide.
Glue: ns1.example.com lives inside the zone it serves. The .com servers include its A and AAAA records in the referral, otherwise the resolver could never reach it.
Caching: the next query for mail.example.com skips root and TLD, because the example.com NS set is already cached.
Transport: UDP 53, with TCP 53 for answers too big for UDP.
Client side: the hosts file is checked first on most systems, the OS has its own cache (the Windows DNS Client service, systemd-resolved on 127.0.0.53), browsers keep another, and search domains get appended to short names.

They will ask next

What is the AA bit?
Authoritative Answer. Only a server authoritative for the zone sets it. An answer from a resolver's cache does not have it, so aa in dig's flags tells you that you reached the source of truth.
What is a forwarder, and a conditional forwarder?
A forwarder is a resolver that hands its recursive queries to another resolver instead of walking from the root, for example AD DNS forwarding to a central resolver. A conditional forwarder does that only for one domain, such as a partner's zone reached over a VPN.
What is split-horizon DNS?
The same name gets different answers depending on who asks: internal clients get the private address of a server, the internet gets the public one. It is done with separate zones or views.

Traps

Saying the client walks the tree itself. A stub sends one recursive query and the resolver does the iterative work.
Saying there are only 13 root servers. There are 13 root server names, run as many anycast instances.

How did you do?Book 9.3 Infrastructure Applications