DNS Deep Dive: Modern Architecture and Performance

DNS is on the critical path of every page load, but its architecture is easier to reason about when the roles are separated. A recursive resolver follows the delegation chain and caches answers; an authoritative nameserver is the source of truth for a zone. The resolver serves a cached answer until its TTL expires, and negative caching can remember that a name does not exist. Short TTLs make changes and failover visible sooner, while longer TTLs reduce upstream work and keep repeat lookups fast. Choose the value for the change you actually need, not as a universal performance setting.

At the authoritative and CDN edge, anycast places the same service address at multiple network locations, allowing routing to select a nearby, resilient endpoint. EDNS Client Subnet can provide a resolver’s truncated client subnet so location-aware services return a better regional address, although it has privacy and cache-sharing trade-offs. CNAME flattening resolves an alias at the zone apex and returns the final address, keeping the root record compatible with providers that require an alias.

Privacy-aware transports change the path, not the DNS roles: DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) protect stub-to-recursive traffic. DoQ combines QUIC’s encrypted transport with stream multiplexing, avoiding TCP head-of-line blocking. In practice, resolver reuse, sensible TTLs, healthy anycast capacity, and measured routing choices matter more than a fashionable protocol label. For the security side, see the separate DNSSEC and DDoS post.

Sources: RFC 8499, RFC 2308, RFC 7871, Cloudflare CNAME flattening, RFC 7858, RFC 8484, and RFC 9250.