Cybersecurity glossary
What is a DNS Resolver?
Learn what a DNS resolver is, how stub and recursive resolvers differ, how caching and forwarding work, and which security and privacy controls matter.
Definition
A DNS resolver is software or a service that answers DNS lookups for clients—ranging from a simple stub that asks another server, to a full recursive resolver that discovers answers across the DNS hierarchy and caches results.
Why resolvers sit on the critical path
Every named connection starts with a question: where is this host, mail exchanger, or service? A DNS resolver answers that question for clients. If the resolver is slow, wrong, or compromised, applications fail before they ever reach your servers.
Resolvers are therefore both a performance feature and a security chokepoint.
Resolver roles explained
Stub resolver
Lives on the device or OS; usually forwards queries to a recursive service.
Recursive resolver
Walks root → TLD → authoritative servers to obtain answers for clients.
Caching layer
Stores positive and negative answers according to TTL to reduce latency and load.
Forwarding resolver
Sends some or all queries to upstream resolvers instead of full recursion.
Typical lookup path
App asks the stub
A browser or service requests records for a hostname.
Stub queries a resolver
The configured resolver address receives the question over classic DNS or encrypted DNS.
Cache check
If a fresh answer exists, it returns immediately.
Recurse or forward
Otherwise the resolver discovers authority or asks an upstream.
Validate and apply policy
Optional DNSSEC validation, filtering, or rewrite rules run.
Return and cache
The client receives the answer; the resolver stores it for the TTL window.
Security and privacy focus areas
| Risk | Why it matters | Mitigation |
|---|---|---|
| Cache poisoning | Forged answers redirect many clients | Source port randomization, DNSSEC validation, patched software |
| Open recursion | Enables amplification abuse | Authenticate clients; avoid public open resolvers |
| Cleartext path | Observers see queried names | DoT/DoH/DoQ to trusted resolvers |
| Centralized logging | Resolver operator learns query patterns | Policy review, local resolvers, retention limits |
Operational checklist
- Know which resolvers every network segment and VPN profile uses.
- Prefer resolvers that validate DNSSEC for integrity-sensitive environments.
- Encrypt stub-to-resolver traffic where devices leave trusted networks.
- Disable open recursion on any host not intentionally public.
- Monitor resolver latency, SERVFAIL rates, and sudden NXDOMAIN spikes.
- Document filtering and rewrite policies so troubleshooting stays honest.
- Separate recursive and authoritative roles on public services.
- Test failover to secondary resolvers before outages force the lesson.
The practical takeaway
A DNS resolver is the client-facing engine of name resolution—stub, recursive, caching, or forwarding. It decides how quickly and how safely names become addresses and policies.
Treat resolver choice as an architecture decision: performance, privacy, filtering, and trust all meet there. If the resolver is wrong, everything built on names inherits that error.
Related security terms
Recursive DNS Resolver
A resolver that fully chases referrals to obtain authoritative answers.
Authoritative DNS Server
Publishes official zone data that resolvers ultimately query.
DNS over HTTPS (DoH)
Encrypted HTTPS transport between clients and a resolver.
DNS Spoofing / Cache Poisoning
Attacks that target resolver caches with forged answers.
NXDOMAIN
Negative answers resolvers cache and return when names do not exist.
Frequently asked questions
What is a DNS resolver in simple terms?
It is the component that turns a hostname into useful DNS data for your device, usually by asking other DNS servers and remembering recent answers.
Is every resolver recursive?
No. A stub resolver typically asks a configured recursive service. Forwarders may also pass queries onward without walking the full tree themselves.
What is the difference between a resolver and an authoritative server?
Resolvers find and cache answers for clients. Authoritative servers publish the official records for zones they control.
Why do people use public resolvers?
For performance, filtering features, privacy policies, or reliability when ISP DNS is poor—trading one operator’s visibility for another’s.
Can resolvers rewrite answers?
Yes. Some apply response policy zones, parental controls, or split-horizon views. That is powerful and must be governed carefully.
Does using a resolver encrypt DNS by default?
Not necessarily. Classic DNS to a resolver is often cleartext unless DoT, DoH, or DoQ is configured.
Where do devices get resolver addresses?
From DHCP, VPN configuration, static settings, or application-specific encrypted DNS settings.
References
Explore authoritative guidance and frameworks related to dns resolver.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.