Recursive vs Authoritative DNS: What's the Difference?

"DNS server" refers to two very different jobs. Mixing them up is behind a lot of confusing troubleshooting: you check a record, it looks right, yet users still get the old answer. Usually you asked one kind of server and your users are asking the other.

What is an authoritative nameserver?

An authoritative nameserver serves a zone. It holds the records you entered at your DNS provider and answers questions about them directly. It does not look anything up on your behalf: ask it about a name outside its zones and it will refuse, or point you elsewhere.

Answers from an authoritative server carry the aa (authoritative answer) flag. They are the source of truth—as soon as you save a change at your provider, its authoritative servers start returning it (allowing a moment for secondary servers to sync).

What is a recursive resolver?

A recursive resolver is what your laptop, phone or server actually talks to: your ISP's resolver, your company's, or a public one like 1.1.1.1, 8.8.8.8 or 9.9.9.9. When asked a question, it walks the DNS tree—root, TLD, your zone's authoritative servers—to find the answer, then caches it for the record's TTL.

That cache is the key difference. A resolver's answer is only as fresh as its last lookup. Different resolvers looked things up at different times, so for a while after a change they can legitimately disagree.

Many recursive resolvers also validate DNSSEC. If validation fails they return SERVFAIL rather than the data, even when your authoritative servers are working perfectly.

Seeing the difference with dig

Ask a public resolver and you get its view, possibly cached:

dig @1.1.1.1 www.example.com A

Ask your zone's authoritative server directly and you get the current data:

dig @ns1.example-dns.net www.example.com A +norecurse

Look at the flags line. The resolver's answer shows rd ra (recursion desired and available) and no aa. The authoritative answer shows aa. The TTL also differs: the authoritative server returns the full configured TTL, while a resolver returns the time left in its cache.

What "Non-authoritative answer" means in nslookup

Run nslookup example.com and the output usually starts with:

Server:   192.168.1.1
Address:  192.168.1.1#53

Non-authoritative answer:
Name:     example.com
Address:  192.0.2.10

It is not an error. It means the answer came from a recursive resolver, possibly from its cache, not straight from one of the domain's own nameservers. Almost every everyday lookup is non-authoritative. To get an authoritative answer, name one of the zone's nameservers as the server: nslookup example.com ns1.example-dns.net.

Which one should you check?

In the DNS lookup tool, choose a public resolver to see what users see, or "Authoritative nameservers" to bypass caches and read the zone directly.

Common traps

• Testing from your own machine. Your operating system and browser cache DNS too, and your local resolver may not be the one your users use. Results from your laptop alone prove little.
• Assuming a timeout means "no record". A timeout means no answer arrived—it says nothing about whether the record exists.
• Trusting one resolver. Large public resolvers run many independent caches at different locations, so even two queries to the same address can return different TTLs.
• Editing the wrong zone. If your registrar points to provider A but you edit records at provider B, the authoritative servers that matter never see your change. Compare the delegation with the nameserver check.