Cybersecurity glossary
What is an Authoritative DNS Server?
Learn what an authoritative DNS server is, how it differs from a recursive resolver, how zone delegation works, and which controls protect authoritative answers.
Definition
An authoritative DNS server is a name server that holds and serves the official DNS data for one or more zones, answering queries with records it is configured to publish rather than by recursively discovering answers elsewhere.
Why authoritative DNS matters
Recursive resolvers can only be as correct as the zones they ultimately reach. An authoritative DNS server is where official records live: A/AAAA addresses, MX mail routers, TXT policy, NS delegations, and more.
If authoritative data is wrong, hijacked, or unavailable, applications fail even when origin servers are healthy. That makes authoritative DNS both a product dependency and a security control plane.
Authoritative vs recursive roles
| Aspect | Authoritative server | Recursive resolver |
|---|---|---|
| Primary job | Publish official zone records | Discover and cache answers for clients |
| Data source | Configured or transferred zone files/API state | Queries across the DNS hierarchy |
| Typical operator | Domain owner or DNS hosting provider | ISP, public DNS, or enterprise DNS |
| Security focus | Change control, signing, availability | Poisoning resistance, privacy, abuse controls |
How authority is established
Register and create a zone
The organization defines which names and records belong under a domain.
Publish NS delegation
Parent zones list the child zone’s name servers with NS records.
Provide glue when needed
If name servers are in-bailiwick, parent glue A/AAAA records help bootstrap reachability.
Serve answers from auth hosts
Queries that reach those hosts receive AA (authoritative answer) data for the zone.
Replicate to secondaries
Additional authoritative servers receive zone copies for resilience.
Sign and monitor changes
DNSSEC signatures and change alerts protect integrity and detect unexpected edits.
Building blocks of an authoritative deployment
Primary source of truth
API, database, or master zone file where operators create and update records.
Secondary / anycast edges
Distributed authoritative instances that answer with the same zone data.
Delegation integrity
Correct NS and DS records at the parent so resolvers find and validate the zone.
Operational telemetry
Query volume, NXDOMAIN spikes, serial changes, and regional reachability checks.
Hardening checklist
- Separate authoritative service from open recursive resolution on the same public listeners.
- Require phishing-resistant MFA and least privilege for DNS hosting and registrar accounts.
- Use multi-provider or multi-site authoritative capacity for critical domains.
- Enable DNSSEC for zones where validation benefits outweigh operational cost.
- Restrict and monitor zone transfers; prefer authenticated AXFR/IXFR channels.
- Alert on unexpected NS, DS, MX, and high-impact A/AAAA changes.
- Keep registrar locks enabled and document emergency restore procedures.
- Test failover by withdrawing a site or provider during planned exercises.
The practical takeaway
An authoritative DNS server publishes the official records for a zone. Resolvers trust that delegation path to learn where services live.
Operate authoritative DNS as critical infrastructure: control who can change it, replicate it for availability, sign it when appropriate, and watch it continuously. If authority is wrong, every system that follows the name inherits the mistake.
Related security terms
Recursive DNS Resolver
Finds answers on behalf of clients by querying authoritative servers.
DNS Zone
The administrative slice of namespace an authoritative server publishes.
NS Record
Delegates a zone to its authoritative name servers.
SOA Record
Marks zone authority metadata such as primary and serial.
DNSSEC (Domain Name System Security Extensions)
Cryptographically signs authoritative zone data for validation.
Frequently asked questions
What is an authoritative DNS server in simple terms?
It is the official source of DNS answers for a domain zone. When a resolver asks who owns www.example.com, an authoritative server for that zone provides the published records.
How is authoritative DNS different from recursive DNS?
Authoritative servers publish zone data they control. Recursive resolvers chase referrals across the DNS hierarchy and cache answers for clients.
What are primary and secondary authoritative servers?
A primary (master) holds the editable zone source. Secondaries (slaves) receive copies—often via zone transfer—and also answer authoritatively for the same zone.
How do resolvers find the authoritative servers?
They follow NS delegations from the root and TLD down to the domain’s listed name servers, using glue records when needed.
Does authoritative mean the answer is secure?
No. Authoritative only means the server is designated to publish that zone. Integrity still depends on access control, change processes, and optionally DNSSEC.
Can one server be authoritative for many zones?
Yes. DNS hosts commonly serve thousands of customer zones from shared authoritative infrastructure.
Should authoritative servers also recurse for the public?
Generally no. Mixing open recursion on authoritative hosts increases abuse risk and blurs operational boundaries.
References
Explore authoritative guidance and frameworks related to authoritative dns server.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.