DNS Hierarchy and Root Servers

DNS is not a single database. It is a distributed, hierarchical system where authority is delegated downward from the root of the internet to individual domain owners.

Why Decentralization Matters

A single central DNS server would be:

  • A single point of failure — if it goes down, the internet breaks.
  • Unable to scale — billions of devices cannot query one server.
  • Globally slow — users in India would wait for a server in the US.

“If the whole internet breaks, I’m not sure about you, but I’ll go crazy.” — Day 30 CKA Video

The Three Levels of DNS Authority

┌─────────────────────────────────────┐
│  Root Name Servers (13 logical)      │
│  Managed by: ICANN / IANA           │
└─────────────────┬───────────────────┘
                  │ Delegates by TLD
┌─────────────────▼───────────────────┐
│  TLD Name Servers (.com, .dev, .org)│
│  Managed by: Registry operators     │
└─────────────────┬───────────────────┘
                  │ Delegates by domain
┌─────────────────▼───────────────────┐
│  Authoritative Name Servers         │
│  Managed by: Registrars / Owners    │
│  (Cloudflare, GoDaddy, Google)      │
└─────────────────────────────────────┘

Root Name Servers

There are 13 logical root name servers, labeled A through M:

ServerOperatorExample IP
AVerisign198.41.0.4
BUSC-ISI199.9.14.201
CCogent192.33.4.12
MWIDE Project202.12.27.33

13 Is Not Really 13

Although there are only 13 hard-coded IP addresses, each root server is actually a cluster of hundreds of physical machines distributed worldwide using anycast.

“A.root-servers.net can internally have 10 servers, but all 10 advertise the same IP address. This is done using anycast.” — Day 30 CKA Video

Anycast allows multiple physical servers to share the same IP. Internet routing protocols automatically direct a user’s query to the nearest instance, providing both load distribution and low latency.


TLD Name Servers

The root servers delegate to Top-Level Domain (TLD) servers based on the domain extension:

TLDRegistry OperatorExample Use
.comVerisignCommercial domains
.devGoogleDeveloper-focused
.orgPIRNon-profits
.netVerisignNetwork infrastructure

When querying piyushgarg.dev:

  1. Root server says: “I don’t know piyushgarg.dev, but ask the .dev TLD server.”
  2. The resolver contacts the .dev TLD server.

Authoritative Name Servers

The TLD server delegates to the authoritative name server for the specific domain:

RegistrarExample Authoritative NS
Cloudflarelara.ns.cloudflare.com
Google Domainsns1.googledomains.com
GoDaddyns01.domaincontrol.com

This is where the actual DNS records live: A, CNAME, MX, TXT, etc.

“Whosoever is your registrar — Google, Cloudflare, GoDaddy — it goes there and searches the DNS records.” — Day 30 CKA Video


Full Query Walkthrough

Query: piyushgarg.dev

StepServerAction
1Browser”I need piyushgarg.dev. I don’t know the IP.”
2Local ResolverChecks cache; misses.
3Root Server”Ask the .dev TLD server.”
4TLD Server (.dev)“Ask ns1.googledomains.com (authoritative).“
5Authoritative Serverpiyushgarg.dev → A record → 1.2.3.4
6Local ResolverCaches result; returns IP to browser.
7BrowserOpens connection to 1.2.3.4.

Each level also caches the result, so subsequent queries for .dev or piyushgarg.dev skip earlier steps. See DNS Caching.

Source