With millions of domains, a single DNS server cannot store all domain-to-IP mappings. Without a hierarchical structure, DNS would be a bottleneck and single point of failure for the entire internet.
DNS uses a hierarchical distributed database structured like a tree: Root servers → TLD servers → Authoritative servers. Each level is responsible for a portion of the namespace, making the system scalable and fault-tolerant.
The DNS hierarchy has four levels:
-
Root Servers (13 logical servers globally): Know locations of TLD servers
- Answer: “Where is .com server?”
-
TLD Servers (Top-Level Domain): Manage domains under a TLD (.com, .org, .net)
- Answer: “Where is google.com server?”
-
Authoritative Servers: Know the actual IP for a specific domain
- Answer: “google.com = 142.250.xx.xx”
-
Recursive Resolvers (ISP): Do the work of querying down the hierarchy
- Root servers are anycast (same IP, multiple physical locations)
- TLD servers handle specific top-level domains
- Authoritative servers are authoritative for specific domains
- Distributed design prevents single point of failure
- Built from: Recursive DNS — recursive resolvers navigate the hierarchy
- Related: DNS Root Server — the top level of the hierarchy
- Related: DNS TLD Server — intermediate level for each TLD
- Related: DNS Authoritative Server — bottom level with actual records
- Builds into: DNS Lookup — hierarchy is queried during DNS resolution
- Root server compromise would be catastrophic (but heavily protected)
- Some countries operate their own root servers (not part of ICANN)
- DNS hijacking can redirect at any hierarchy level
- Anycast allows multiple servers to share the same IP address