When a DNS resolver doesn’t know where to find a domain, it needs a starting point. Without root servers, there would be no way to begin the DNS resolution process for unknown domains.
DNS root servers are the top of the DNS hierarchy—13 logical servers (labeled A through M) that know the locations of all TLD servers. They are the starting point for all recursive DNS lookups.
- Query Received: Recursive resolver has a new domain to resolve
- Contact Root: Resolver sends query to a root server
- Response: Root server returns the TLD server for the domain’s extension
- For
google.com, root returns.comTLD server address
- For
- Next Step: Resolver now queries the TLD server
Root servers don’t know the final IP—they only know which TLD server to ask next.
- 13 logical servers (A-M), hundreds of physical servers via anycast
- Managed by different organizations (ICANN, Verisign, etc.)
- Only return TLD server addresses, never final IPs
- Root zone file contains all TLD server addresses
- Built from: Recursive DNS — resolvers query root servers
- Builds into: DNS TLD Server — root points to TLD servers
- Related: DNS Hierarchy — root is the top level
- Related: Anycast — root servers use anycast for redundancy
- Root server compromise would break the entire internet
- Root servers are heavily DDoS protected
- Some countries operate alternative root systems (not ICANN-recognized)
- Anycast allows multiple physical servers to share one IP