Root zone vs TLD vs authoritative DNS

Introduction

The Domain Name System is organized as a hierarchical, distributed database. No single server knows all the answers. Instead, authority is delegated downward from the root through TLDs to the name servers that hold the records for individual domain names.

This guide explains each layer, what data it holds, and how a recursive resolver walks the hierarchy to resolve a query like www.example.com.

The DNS hierarchy

DNS names are read right to left. The trailing dot in www.example.com. represents the root. Each label separated by a dot corresponds to a level in the hierarchy:

• . (root) — the starting point of every DNS lookup.
• com. — a top-level domain delegated from the root.
• example.com. — a second-level domain delegated from the .com TLD.
• www.example.com. — a host record within the example.com zone.

At each level, the responsible servers know only about the next level down. The root servers know about TLDs. TLD servers know about second-level domains. This delegation pattern is what makes DNS scalable.

The root zone

The root zone is the top of the DNS hierarchy. It contains delegation records (NS and associated glue records) for every TLD. It does not contain records for individual domains like example.com.

• The root zone file is maintained by IANA (a function of ICANN) and distributed by Verisign as the root zone maintainer.
• It currently contains delegations for over 1,500 TLDs.
• The root zone is served by 13 root server identities (A through M), operated by 12 independent organizations.
• When a recursive resolver has no cached information, the root is its first point of contact.

Top-level domains

Top-level domains are the first labels below the root. They come in several categories:

• Generic TLDs (gTLDs) — .com, .org, .net, and the newer gTLDs like .app, .dev, .blog.
• Country-code TLDs (ccTLDs) — .uk, .de, .jp, .br, and others assigned to countries or territories.
• Infrastructure TLDs — .arpa, used for reverse DNS and other infrastructure purposes.
• Sponsored TLDs — .edu, .gov, .mil, restricted to specific communities.

Each TLD has its own set of authoritative name servers. When a recursive resolver queries the root for example.com, the root returns a referral to the .com TLD servers. The resolver then queries those servers for the next piece of the answer.

TLD name servers hold NS records that delegate authority to the authoritative name servers for each registered second-level domain (like example.com).

Authoritative name servers

Authoritative name servers are where the actual DNS records for a domain live. When a resolver reaches this layer, it gets the final answer to the query.

• A records map names to IPv4 addresses.
• AAAA records map names to IPv6 addresses.
• MX records direct email delivery.
• CNAME records create aliases.
• TXT records hold verification strings, SPF policies, and other metadata.

Domain owners choose their authoritative name servers, which may be run by a hosting provider, a DNS service like Cloudflare or AWS Route 53, or self-hosted infrastructure. The domain registrar records the NS delegation at the TLD level to point to these servers.

Unlike root and TLD servers, which only provide referrals, authoritative name servers provide definitive answers for the zones they serve.

How they work together

A recursive resolver follows the delegation chain from the root downward. For a query to www.example.com:

• Step 1. The resolver queries a root server. The root responds with a referral to the .com TLD servers.
• Step 2. The resolver queries a .com TLD server. It responds with a referral to the authoritative name servers for example.com.
• Step 3. The resolver queries the authoritative name server for example.com. It responds with the A or AAAA record for www.example.com.

Caching at every layer reduces repeat work. A busy resolver may rarely need to contact the root because TLD referrals and domain answers persist in cache for hours or days based on their TTL values.

This three-layer architecture is what makes DNS both distributed and resilient. No single point controls all the data, and failures at one layer do not necessarily prevent resolution if cached information is available.

Further reading

RFC 1034 defines the original DNS concepts including the hierarchical namespace. RFC 9499 provides current DNS terminology. The IANA Root Zone Database lists all delegated TLDs and their name servers.