DNS Deep Dive: Modern Architecture and Performance

DNS is on the critical path of every page load, but its architecture is easier to reason about when the roles are separated. A stub resolver on the laptop or phone sends a query to a recursive resolver. That resolver follows the root, TLD, and authoritative delegations, then caches the answer. An authoritative nameserver does not search the internet for an answer; it publishes the records for its zone. Negative caching can also remember that a name does not exist, which explains why adding a record may not become visible immediately.

TTL is a cache-control decision, not a speed switch. A 300-second TTL can help during a planned migration, but it increases refresh traffic and gives resolvers less time to serve a warm answer. A 3600-second TTL reduces upstream queries for stable records. Lower the TTL at least one cache interval before a planned move, wait for the old value to age out, change the record, and restore a longer value after verification. Do not expect a lower TTL to evict answers that were cached under a previous value.

A practical resolver tier might look like this:

client stub -> office/VPC resolver -> shared recursive resolver -> authoritative DNS

Keep the first tier close to clients for connection reuse and local policy. Use the shared recursive tier for caching, DNSSEC validation, logging, and upstream failover. Measure cache hit ratio, query latency by resolver, SERVFAIL rate, and timeouts separately. A fast authoritative service cannot compensate for a misconfigured local resolver that retries over a slow or unreachable path.

At the authoritative and CDN edge, anycast advertises the same service address from multiple network locations. Routing usually sends a query to a nearby site, while a failed site can be withdrawn. Anycast does not guarantee the geographically closest server, and route changes can move a resolver between sites. EDNS Client Subnet (RFC 7871) gives an authoritative service a truncated portion of the client subnet so it can choose a regional address. That can improve CDN placement, but it reduces privacy and fragments shared caches. Enable it only when measurements show a useful routing benefit.

CNAME flattening resolves an alias at the zone apex and returns the final address, which keeps the root record compatible with providers that require an alias. Check the provider’s refresh behavior before relying on it for rapid failover. For privacy-aware transport, DoT uses TLS on port 853, DoH carries DNS in HTTPS, and DoQ uses QUIC. These protect stub-to-recursive traffic, but they do not make an authoritative record private. DoQ can reduce transport head-of-line blocking, yet an encrypted resolver connection still needs sensible timeouts and fallback behavior.

Sources: RFC 8499, RFC 2308, RFC 7871, Cloudflare CNAME flattening, RFC 7858, RFC 8484, and RFC 9250.