DNS – Recursive vs Non Recursive
You can cause yourself a lot of problems if you do not understand the difference between a recursive and non-recursive (iterative) DNS servers and when to use each. I will attempt to explain what each means and scenarios when you will be using recursive or non recursive setup.
A DNS server configured to be recursive would go out of the way to resolve a query for it’s client. If it is not authoritative for that domain, it will contact the root servers to find out where to get an answer. It will then query it from the authoritative server and provide you an answer. The only time a recursive server will give you an error is if the domain/host is non existent.
Non recursive server on the other hand is only responsible for the domains/zones it hosts. If the hostname you are trying to resolve does not belong to the domains hosted by a non recursive server then it will simply refer you to the one that does. It will not contact that server itself to get an answer for you.
So when to use each you ask ? The easy answer is that your internal DNS servers will always be recursive. Why? Because if your internal DNS server is non recursive then it may refer your end user computers to a different DNS server which in most cases is out of your network and trust me you do not want to allow external DNS lookups directly from your workstations or other servers. Reason being that it can allow someone to perform a DNS poisoning attack redirecting your workstations to fake hosts. Thus you always set internal DNS servers as recursive and then carefully create forwarders that point to your ISP’s DNS servers for anything that your server does not have an answer for.
Where as a public facing DNS server you have setup for your domain should ideally always be non recursive. Because you don’t want people to use your DNS server to resolve other hostnames such as www.google.com that don’t belong to you. You have set it up only to server records for your company/personal domain and you do not want to waste your precious system resources.
Again I hope this helps someone out there specially someone new to DNS. I will try and add more graphical representation of recursive and non recursive processes in the future.