What is a root server?

Introduction

DNS root servers answer queries about the root zone — the very top of the Domain Name System hierarchy. When a recursive resolver needs to look up a domain name and has no cached information to work from, the root is where it begins.

A root server does not know the IP address of every website. Instead, it knows the name servers responsible for top-level domains like .com, .org, and .uk. It responds with a referral: a set of NS records that direct the resolver to the next step in the lookup chain.

How root servers fit into DNS

DNS resolution is a hierarchical process. When you type a domain name into a browser, the following chain of events unfolds:

• Stub resolver — The DNS client on your device sends a query to a recursive resolver (often provided by your ISP or a public DNS service).
• Recursive resolver — If the resolver has no cached answer, it queries a root server for the top-level domain.
• Root server — Returns a referral containing the NS records and glue addresses for the queried TLD (e.g., the name servers for .com).
• TLD name server — Returns a referral to the authoritative name server for the specific domain.
• Authoritative name server — Returns the final answer: the IP address (or other record) for the queried name.

The recursive resolver follows this chain from root to TLD to authoritative, caching each answer along the way so future queries for the same zone can skip earlier steps.

Root zone content

The root zone is a small, tightly controlled DNS zone file. Its contents include:

• NS records — Delegation records for every TLD. These point resolvers from the root to the name servers responsible for each top-level domain.
• Glue records — A and AAAA records for TLD name servers whose names fall within their own TLD (e.g., the name server for .com that is itself named under .com).
• DS records — DNSSEC delegation signer records that chain trust from the root to each signed TLD.
• SOA record — The root zone's serial number, refresh timers, and administrative metadata.

The root zone is signed with DNSSEC. The root zone trust anchor (the KSK public key) is the global starting point for DNSSEC validation. IANA publishes and maintains the root zone under the oversight of ICANN, with Verisign serving as the root zone maintainer.

Who operates them

The 13 root server identities are operated by 12 independent organizations. No single entity controls the root server system. The operators include:

• Verisign — Operates A-root and J-root
• USC-ISI — B-root
• Cogent Communications — C-root
• University of Maryland — D-root
• NASA Ames Research Center — E-root
• Internet Systems Consortium (ISC) — F-root
• U.S. DoD (DISA) — G-root
• U.S. Army Research Lab — H-root
• Netnod — I-root
• RIPE NCC — K-root
• ICANN — L-root
• WIDE Project — M-root

Each operator independently manages infrastructure, staffing, funding, and geographic distribution for their root server identity. This organizational diversity is a deliberate design choice that improves the resilience of the root server system as a whole.

For detailed profiles of each operator, see the Operators page.

Further reading

IANA maintains the canonical list of root server identities and addresses. RSSAC publishes guidance and recommendations on root server operations. RFC 7720 documents the DNS root name service protocol requirements, and RFC 9609 covers resolver priming.