🔁 Query types: recursive, iterative, forwarding

$ dig @1.1.1.1 example.com A

RFC 1035 section 4.1.1 defines the RD, RA, and AA bits in the header. RFC 1034 section 4.3.1 describes the recursive and iterative modes those bits select. RFC 9499 is the current DNS terminology glossary.

Recursive query (RD=1)#

client --RD=1--> resolver --...do the work...--> resolver --answer--> client

Every stub resolver sets RD by default. The client never speaks to an authoritative server directly; the resolver does the walking and returns one answer. The capture above is a recursive query: rd and ra are both set.

Iterative query (RD=0)#

client --RD=0--> resolver
                 returns whatever it has, with referrals if needed
                 client itself walks the next hop

A recursive resolver iterates on the client's behalf: root, then TLD, then the zone's authoritative servers. +norec on dig sets RD=0, for asking an authoritative server directly.

dig -4 @pns2.isitdns.net probe.isitdns.net SOA +norec

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ...
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
probe.isitdns.net. 5 IN SOA pns2.isitdns.net. hostmaster.isitdns.net. \
    2026082002 7200 3600 1209600 300

aa is set because pns2.isitdns.net owns probe.isitdns.net. rd is absent because the query sent RD=0, and the server leaves it unset in the response. The serial number changes on every zone edit, so it will differ from the capture above. Watch the walk itself with dig +trace (dig reference): each referral hop prints as its own block, root to TLD to authoritative.

Forwarding#

client --RD=1--> local resolver --RD=1--> upstream resolver --answer--> ...

The local resolver doesn't iterate: it passes the query to a configured upstream and returns whatever comes back. Forwarding requires recursion: a server with recursion disabled has nothing that reads its forwarders list. See forward for how forward zones are configured, including conditional forwarding by name.

Gotchas#

• rd without ra from an authoritative server is normal. Servers echo rd back even when they will not recurse.
• ad on its own proves nothing. Requesting +dnssec sets the DO bit, not ad; the resolver sets ad only when it validates, and it can be stripped on the path (RFC 6840 section 5.8).
• Forwarders enabled with an empty list still iterates from root. Confirm the path with dig +trace from the resolver itself.
• ra set on a server you expect to be authoritative-only usually means a middlebox is answering in its place, not the server itself: something on the path intercepts port 53 (captive portals, some routers) and responds directly.

See also#

• Anatomy of a DNS query: what a recursive walk looks like step-by-step
• DNS fundamentals: flags, rcodes, transports
• The full flags-line reference