DNS Hierarchy and Root Servers
DNS is not a single database. It is a distributed, hierarchical system where authority is delegated downward from the root of the internet to individual domain owners.
Why Decentralization Matters
A single central DNS server would be:
- A single point of failure — if it goes down, the internet breaks.
- Unable to scale — billions of devices cannot query one server.
- Globally slow — users in India would wait for a server in the US.
“If the whole internet breaks, I’m not sure about you, but I’ll go crazy.” — Day 30 CKA Video
The Three Levels of DNS Authority
┌─────────────────────────────────────┐
│ Root Name Servers (13 logical) │
│ Managed by: ICANN / IANA │
└─────────────────┬───────────────────┘
│ Delegates by TLD
┌─────────────────▼───────────────────┐
│ TLD Name Servers (.com, .dev, .org)│
│ Managed by: Registry operators │
└─────────────────┬───────────────────┘
│ Delegates by domain
┌─────────────────▼───────────────────┐
│ Authoritative Name Servers │
│ Managed by: Registrars / Owners │
│ (Cloudflare, GoDaddy, Google) │
└─────────────────────────────────────┘
Root Name Servers
There are 13 logical root name servers, labeled A through M:
| Server | Operator | Example IP |
|---|---|---|
| A | Verisign | 198.41.0.4 |
| B | USC-ISI | 199.9.14.201 |
| C | Cogent | 192.33.4.12 |
| … | … | … |
| M | WIDE Project | 202.12.27.33 |
13 Is Not Really 13
Although there are only 13 hard-coded IP addresses, each root server is actually a cluster of hundreds of physical machines distributed worldwide using anycast.
“A.root-servers.net can internally have 10 servers, but all 10 advertise the same IP address. This is done using anycast.” — Day 30 CKA Video
Anycast allows multiple physical servers to share the same IP. Internet routing protocols automatically direct a user’s query to the nearest instance, providing both load distribution and low latency.
TLD Name Servers
The root servers delegate to Top-Level Domain (TLD) servers based on the domain extension:
| TLD | Registry Operator | Example Use |
|---|---|---|
.com | Verisign | Commercial domains |
.dev | Developer-focused | |
.org | PIR | Non-profits |
.net | Verisign | Network infrastructure |
When querying piyushgarg.dev:
- Root server says: “I don’t know
piyushgarg.dev, but ask the.devTLD server.” - The resolver contacts the
.devTLD server.
Authoritative Name Servers
The TLD server delegates to the authoritative name server for the specific domain:
| Registrar | Example Authoritative NS |
|---|---|
| Cloudflare | lara.ns.cloudflare.com |
| Google Domains | ns1.googledomains.com |
| GoDaddy | ns01.domaincontrol.com |
This is where the actual DNS records live: A, CNAME, MX, TXT, etc.
“Whosoever is your registrar — Google, Cloudflare, GoDaddy — it goes there and searches the DNS records.” — Day 30 CKA Video
Full Query Walkthrough
Query: piyushgarg.dev
| Step | Server | Action |
|---|---|---|
| 1 | Browser | ”I need piyushgarg.dev. I don’t know the IP.” |
| 2 | Local Resolver | Checks cache; misses. |
| 3 | Root Server | ”Ask the .dev TLD server.” |
| 4 | TLD Server (.dev) | “Ask ns1.googledomains.com (authoritative).“ |
| 5 | Authoritative Server | ”piyushgarg.dev → A record → 1.2.3.4” |
| 6 | Local Resolver | Caches result; returns IP to browser. |
| 7 | Browser | Opens connection to 1.2.3.4. |
Each level also caches the result, so subsequent queries for .dev or piyushgarg.dev skip earlier steps. See DNS Caching.