Short answer: A client usually asks a recursive resolver for a final answer. The resolver uses cached records, follows referrals itself, or forwards the question to another resolver. A successful answer may contain an address, an alias, or other record types, not just an IP address.
Before this: DNS hierarchy and record types.
A concierge who does the legwork for you
A recursive resolver, perhaps your organization's DNS service, your ISP's (Internet Service Provider's), or a public one like 8.8.8.8, acts like a concierge. You ask one question; they consult their notebook or ask others and return an answer. In the cold lookup below, with no useful cached records and no forwarding, they ask increasingly specific direction-givers: root, then TLD (Top-Level Domain), then authoritative. An ordinary stub client leaves that work to its resolver.
That distinction has a name. The client requests recursion: resolve the name and return an answer or error. In the illustrated hierarchy walk, the resolver sends iterative queries: a server can supply an answer or a referral to the next authority. A forwarding resolver instead asks another recursive resolver to finish the job, like one concierge consulting another. Its onward query need not be iterative.
| Step | Who asks | Who answers | Query type |
|---|---|---|---|
| 1 | Client | Recursive resolver | Recursive: do the whole job for me |
| 2 | Resolver | Root server | Iterative: "who handles .com?" |
| 3 | Resolver | TLD server | Iterative: "who's authoritative for example.com?" |
| 4 | Resolver | Authoritative server | Iterative: "what's the A record?" |
| 5 | Resolver | Client | Final answer, now cached |
Read a DNS answer
Consider this illustrative record for a documentation-only hostname. It is not a live lookup or a command result:
portal.example. 300 IN A 192.0.2.80portal.example. is the fully qualified name; 300 is the TTL in seconds; IN is the Internet class; A means an IPv4 address. The address is from a documentation range. If a resolver cached this answer 40 seconds ago, a response might carry about 260 seconds of remaining TTL. The concierge's notebook keeps the answer and an expiry time, not a permanent guarantee.
To query your configured resolver on Windows, use Resolve-DnsName example.com -Type A -DnsOnly. On Linux with BIND's dig installed, use dig example.com A. Real answers and timing vary. In dig's response flags, rd means recursion was requested, ra means the server supports recursion, and aa marks an authoritative answer. Neither rd nor ra proves that a fresh hierarchy walk occurred.
Distinguish an absent name from a failed lookup
| Result | Meaning | Next check |
|---|---|---|
| NXDOMAIN | The queried name, or the final target of a CNAME chain, does not exist according to the answer | Check spelling, aliases, search suffixes, the authoritative zone, and whether a VPN uses private DNS. |
| NODATA: NOERROR with no requested records, not a referral | The name exists but has no record of that type. NODATA is not a separate response code. | Compare A and AAAA and inspect the answer and authority sections. An empty answer alone can also be a referral. |
| SERVFAIL | The resolver could not complete the lookup | Check resolver logs, authoritative reachability, delegation, and DNSSEC validation. It does not mean the name is absent. |
| Timeout | No response arrived within the client's wait | Check the configured resolver and permitted UDP/TCP 53 path. The resolver may be unreachable, filtering, or still waiting upstream. |
A concierge who reports "no such office" (NXDOMAIN) differs from one who cannot contact the directory (SERVFAIL), or never answers you (timeout). Negative answers can also be cached under rules based on the zone's SOA record. Browsers may use DNS over HTTPS and a different resolver from a command-line tool, so compare the actual query path before calling two answers inconsistent.
Resolvers cache answers and delegations subject to their TTLs and local policy. Even when the requested A record is missing, a cached delegation may let the resolver start at the authoritative server instead of the root. How often queries hit cache depends on traffic and TTLs; an unfamiliar name does not necessarily mean an entirely cold resolver.
Related topics and sources
Continue with how DHCP supplies resolver settings or DNS in a complete page load.