WEB / WEB-03.01

DNS namespace and resolution

DNS is more than a domain-to-IP list: it combines a namespace, distributed authority and resolver roles. Follow who answers a question for notes.example.org.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Cold A · iterative referrals

Absolute question ready
Name/type/class are explicit. Application-to-local-stub call is not a separate network hop; the scene starts with the stub’s recursive-service request.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Selected cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Stub question reached recursive
The recursive resolver received the request. RD asks for recursion; it is not cryptographic validation.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
notes.example.org. / A / IN · RD=1 received
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Local cache-miss decision
This cold fixture requires iterative work. Root hints/server addresses/delegation selection are supplied; QNAME minimization is omitted.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
notes.example.org. / A / IN · local cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Root received the query
A separate query from the recursive resolver arrived. Root does not proxy it to the next authority.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
notes.example.org. / A / IN · local cache miss
Root · .
notes.example.org. / A / IN · RD=0 query received
TLD · org.
No query yet
Authority · example.org.
No query yet
Root referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Referral received · zone org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
TLD received the query
A separate query from the recursive resolver arrived. TLD does not proxy it to the next authority.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
notes.example.org. / A / IN · RD=0 query received
Authority · example.org.
No query yet
TLD referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Referral received · zone example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Zone authority received the query
The example.org zone role can decide from its own data. These are not claimed current example.org records.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
notes.example.org. / A / IN · query received
Local authoritative result
Zone lookup is local. The positive A record is selected fixture data.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR · A 198.51.100.200 · TTL 120 · AA=1
Authority response reached recursive
The result is now in recursive context. NODATA is inferred with NOERROR; NXDOMAIN is a separate name-error RCODE.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Authority result received · NOERROR · A 198.51.100.200 · TTL 120
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR · A 198.51.100.200 · TTL 120 · AA=1
Final result prepared locally
Selected caching is summarized as positive TTL 120; full resolver policies and DNSSEC are omitted.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Final result ready · NOERROR · A 198.51.100.200 · TTL 120
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR · A 198.51.100.200 · TTL 120 · AA=1
Recursive result reached stub
Result delivery completed. An address/type/name result is not a reachability or user-permission verdict.
Stub / client
Final result received · NOERROR · A 198.51.100.200 · TTL 120
Recursive resolver
Final result ready · NOERROR · A 198.51.100.200 · TTL 120
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR · A 198.51.100.200 · TTL 120 · AA=1

Warm A · cache hit

Absolute question ready
Name/type/class are explicit. Application-to-local-stub call is not a separate network hop; the scene starts with the stub’s recursive-service request.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Selected cache ready
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Stub question reached recursive
The recursive resolver received the request. RD asks for recursion; it is not cryptographic validation.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
notes.example.org. / A / IN · RD=1 received
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Local positive-cache lookup
The selected entry is usable. No root/TLD/authority exchange occurs; TTL is not executed as a live timer.
Stub / client
notes.example.org. / A / IN · no result
Recursive resolver
Cache hit · A 198.51.100.200 · TTL 120−30=90
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Cached answer reached stub
Delivery completed; an address result is not HTTP success or validated service identity.
Stub / client
Cached A 198.51.100.200 · TTL 90 received
Recursive resolver
Cache hit · A 198.51.100.200 · TTL 120−30=90
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet

NXDOMAIN · name absent

Absolute question ready
Name/type/class are explicit. Application-to-local-stub call is not a separate network hop; the scene starts with the stub’s recursive-service request.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Selected cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Stub question reached recursive
The recursive resolver received the request. RD asks for recursion; it is not cryptographic validation.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
missing.example.org. / A / IN · RD=1 received
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Local cache-miss decision
This cold fixture requires iterative work. Root hints/server addresses/delegation selection are supplied; QNAME minimization is omitted.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
missing.example.org. / A / IN · local cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Root received the query
A separate query from the recursive resolver arrived. Root does not proxy it to the next authority.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
missing.example.org. / A / IN · local cache miss
Root · .
missing.example.org. / A / IN · RD=0 query received
TLD · org.
No query yet
Authority · example.org.
No query yet
Root referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Referral received · zone org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
TLD received the query
A separate query from the recursive resolver arrived. TLD does not proxy it to the next authority.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
missing.example.org. / A / IN · RD=0 query received
Authority · example.org.
No query yet
TLD referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Referral received · zone example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Zone authority received the query
The example.org zone role can decide from its own data. These are not claimed current example.org records.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
missing.example.org. / A / IN · query received
Local authoritative result
Zone lookup is local. No alias; the negative result carries an SOA summary.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NXDOMAIN · name absent · AA=1
Authority response reached recursive
The result is now in recursive context. NODATA is inferred with NOERROR; NXDOMAIN is a separate name-error RCODE.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Authority result received · NXDOMAIN · name absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NXDOMAIN · name absent · AA=1
Final result prepared locally
Selected caching is summarized as min(300,60)=60 negative seconds; full resolver policies and DNSSEC are omitted.
Stub / client
missing.example.org. / A / IN · no result
Recursive resolver
Final result ready · NXDOMAIN · name absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NXDOMAIN · name absent · AA=1
Recursive result reached stub
Result delivery completed. An address/type/name result is not a reachability or user-permission verdict.
Stub / client
Final result received · NXDOMAIN · name absent
Recursive resolver
Final result ready · NXDOMAIN · name absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NXDOMAIN · name absent · AA=1

NODATA · AAAA

Absolute question ready
Name/type/class are explicit. Application-to-local-stub call is not a separate network hop; the scene starts with the stub’s recursive-service request.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Selected cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Stub question reached recursive
The recursive resolver received the request. RD asks for recursion; it is not cryptographic validation.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
v4only.example.org. / AAAA / IN · RD=1 received
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Local cache-miss decision
This cold fixture requires iterative work. Root hints/server addresses/delegation selection are supplied; QNAME minimization is omitted.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
v4only.example.org. / AAAA / IN · local cache miss
Root · .
No query yet
TLD · org.
No query yet
Authority · example.org.
No query yet
Root received the query
A separate query from the recursive resolver arrived. Root does not proxy it to the next authority.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
v4only.example.org. / AAAA / IN · local cache miss
Root · .
v4only.example.org. / AAAA / IN · RD=0 query received
TLD · org.
No query yet
Authority · example.org.
No query yet
Root referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Referral received · zone org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
No query yet
Authority · example.org.
No query yet
TLD received the query
A separate query from the recursive resolver arrived. TLD does not proxy it to the next authority.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Local next authority selected · org.
Root · .
Referral prepared · org.
TLD · org.
v4only.example.org. / AAAA / IN · RD=0 query received
Authority · example.org.
No query yet
TLD referral reached recursive
The authority-section referral names the next zone, not a final address answer. AA=0 is a role summary; server addresses are supplied separately.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Referral received · zone example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Local referral follow-up selection
The recursive resolver selects the receiver of its next query. This lookup is not a network message.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
No query yet
Zone authority received the query
The example.org zone role can decide from its own data. These are not claimed current example.org records.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
v4only.example.org. / AAAA / IN · query received
Local authoritative result
Zone lookup is local. No alias; the negative result carries an SOA summary.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Local next authority selected · example.org.
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR / NODATA · AAAA absent · AA=1
Authority response reached recursive
The result is now in recursive context. NODATA is inferred with NOERROR; NXDOMAIN is a separate name-error RCODE.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Authority result received · NOERROR / NODATA · AAAA absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR / NODATA · AAAA absent · AA=1
Final result prepared locally
Selected caching is summarized as min(300,60)=60 negative seconds; full resolver policies and DNSSEC are omitted.
Stub / client
v4only.example.org. / AAAA / IN · no result
Recursive resolver
Final result ready · NOERROR / NODATA · AAAA absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR / NODATA · AAAA absent · AA=1
Recursive result reached stub
Result delivery completed. An address/type/name result is not a reachability or user-permission verdict.
Stub / client
Final result received · NOERROR / NODATA · AAAA absent
Recursive resolver
Final result ready · NOERROR / NODATA · AAAA absent
Root · .
Referral prepared · org.
TLD · org.
Referral prepared · example.org.
Authority · example.org.
NOERROR / NODATA · AAAA absent · AA=1

ACTORS · STATE · DATA FLOW

Why separate names from addresses?

Permanently binding an application to a numeric address pushes address changes into user choices and configuration. DNS provides a shared hierarchical namespace with typed data; a question has QNAME, QTYPE and QCLASS. A can request an address while other types describe mail or naming authority. DNS is neither a routing nor an application-permission database.

Our synthetic question is notes.example.org. / A / IN. A result of 198.51.100.200 can be followed by connectivity and service-identity work. Receiving the address does not establish reachability, expected TLS identity or a user’s permissions, so those layers remain separate.

Labels, domains, subdomains and FQDNs

The presentation form notes.example.org. contains labels notes, example, org and the root’s empty label. Tree hierarchy reads root → org → example → notes. It is a subdomain of example.org because of label boundaries, not an arbitrary substring match. A domain name can serve as a host name, but not every DNS node must be a web host.

The final dot explicitly represents root in strict presentation form. Applications commonly display notes.example.org and call it an FQDN; omission of the dot is not automatic proof of a relative name. A short name such as notes can be completed through search/origin context. We supply an absolute question rather than inventing that context.

Namespace and zones have different scopes

A domain describes subtree relationships; a zone scopes authoritative data management. A subdomain can remain in its parent zone without separate delegation. A dot therefore does not necessarily introduce another server or security tenant. Our example.org zone directly contains notes.example.org.

The root is not a central catalog of every host address; delegations guide a resolver toward closer authority. The .org TLD role points toward example.org authority. An authoritative server answers from its zone knowledge; a recursive resolver obtains or caches information from other roles.

Separate stub and recursive resolver work

A stub generally cannot perform the full referral process and asks a configured recursive resolver for the result. Application-to-local-resolver calls need not be DNS packets; they may be OS/library interfaces. Browsers can have their own resolver/cache choices. We draw one selected stub-to-recursive path rather than asserting universal browser behavior.

A recursive request asks with RD=1; RA separately indicates offered recursion support. These bits do not themselves assert TLS or DNSSEC validation. An authoritative server need not provide recursion. Because DNS server alone hides its role, actor labels state each task.

A recursive result can require iterative exchanges

In the cold fixture the stub question reaches the recursive resolver. It queries root and receives a referral, then separately queries TLD and receives another referral, then queries the authoritative server and receives an answer. Root does not forward the question as a proxy to TLD. The resolver returns a final result to the stub.

This path uses full-question summaries and omits QNAME minimization, forwarders, retries, priming, glue-address lookup, anycast and DNS transport details. Delegation/server-address selection is supplied. A warm cache may need no root/TLD/authoritative exchange; not every page request performs a cold resolution.

Results: answer, name error or missing type

The positive-cache example starts at TTL 120 and is examined after 30 seconds, leaving a selected TTL of 90. Cache lookup is local; DNS record TTL differs from IP packet TTL. It bounds cache use without consulting the source again, while application/resolver policy can discard data earlier.

NXDOMAIN for missing.example.org. is a name error. If v4only.example.org. exists without AAAA, the fixture shows NODATA using NOERROR, no relevant answer and a zone SOA; NODATA is not a separate wire RCODE. SERVFAIL or timeout is not NXDOMAIN: inability to resolve does not establish absence. Aliases can change which name a negative result concerns; these negative cases contain no aliases.

Read every scenario without motion

Authority boundary

The question scope was defined
notes.example.org. A/IN is an absolute question. The notes label is not automatically a delegated zone or application tenant boundary.
Question evidence
A / notes / example.org.
Result interpretation
No trust conclusion
Application gate
No application grant
The result class is read separately
AA is set on the authoritative answer but not on the recursive reply, where RA indicates recursion support. The difference identifies answering roles; AA is not a cryptographic-authenticity result.
Question evidence
A / notes / example.org.
Result interpretation
AA = authority role, not proof
Application gate
No application grant
An unsupported promotion was stopped
Promoting an address answer to verified service identity or resource permission skips higher-layer gates. Resolution informs target selection only.
Question evidence
A / notes / example.org.
Result interpretation
AA = authority role, not proof
Application gate
Service identity separately required
A referral is not the final answer
Root org. and TLD example.org. referrals have aa=false. The resolver continues to another authority; the root has not personally verified the application address.
Question evidence
Referral ≠ application answer
Result interpretation
AA = authority role, not proof
Application gate
Service identity separately required
The control preserved source and scope
The application retains result classification separately from resolver source/cache context. HTTPS/TLS and object-policy decisions are not completed by a plain DNS role diagram.
Question evidence
Referral ≠ application answer
Result interpretation
Question / result / source separate
Application gate
Service identity separately required
A supported conclusion was selected
The notes A answer supplies 198.51.100.200. This inert answer is not a service-identity or browser-origin-enforcement test.
Question evidence
Referral ≠ application answer
Result interpretation
Question / result / source separate
Application gate
Address result supplied; identity unknown

Type boundary

The question scope was defined
The question is AAAA/IN for v4only.example.org.; the artifact supplies existingA=198.51.100.201. An absent requested type does not erase all data at the name.
Question evidence
AAAA / v4only
Result interpretation
No trust conclusion
Application gate
No application grant
The result class is read separately
NOERROR with empty answers gives NODATA, requested-type-absent. That differs from NXDOMAIN name-absent; empty answers alone do not imply the same verdict.
Question evidence
AAAA / v4only
Result interpretation
NODATA / AAAA only
Application gate
No application grant
An unsupported promotion was stopped
Promoting absent AAAA to an absent name wrongly closes an existing A path. Policy must use only the absence supported by the question tuple.
Question evidence
AAAA / v4only
Result interpretation
NODATA / AAAA only
Application gate
Name-wide denial unsupported
A referral is not the final answer
Root org. and TLD example.org. referrals have aa=false. The resolver continues to another authority; the root has not personally verified the application address.
Question evidence
Referral ≠ application answer
Result interpretation
NODATA / AAAA only
Application gate
Name-wide denial unsupported
The control preserved source and scope
The application retains result classification separately from resolver source/cache context. HTTPS/TLS and object-policy decisions are not completed by a plain DNS role diagram.
Question evidence
Referral ≠ application answer
Result interpretation
Question / result / source separate
Application gate
Name-wide denial unsupported
A supported conclusion was selected
Absent AAAA data is known in this supplied case; A data remains present. No resource availability or authorization denial is added.
Question evidence
Referral ≠ application answer
Result interpretation
Question / result / source separate
Application gate
AAAA absent; name exists

ASSUMPTION · BOUNDARY · CONTROL

Broken assumption: a written name is trusted identity

A name is a resource-selection input; trust decisions need roles and validated evidence. Its appearance does not replace routing, authentication or object access. Data provenance and the selected resolver policy are part of the trust boundary.

Name the necessary condition precisely: an application needs an appropriate result for its intended name, then validates service identity and authorization. We show where a conclusion goes wrong without answer manipulation or external-domain probing.

Broken assumption: every subdomain is independent authority

Equating the name tree with zone cuts, deployment and tenant boundaries creates the wrong scope. The notes label is not a delegated zone in this fixture. Subdomain relationships follow label suffixes rather than visually similar text.

The control question belongs to configuration review: does naming authority agree with application scope, and who manages the intended name? Answer it through the inert namespace without enumeration or ownership-takeover reproduction.

Broken assumption: an empty answer proves name absence

Referral, NOERROR/NODATA and NXDOMAIN differ. An empty answer with an NS referral can leave resolution unfinished; SOA and RCODE context change interpretation. The authoritative-answer bit is not cryptographic authenticity.

A negative fixture supports its question scope. Failure to obtain A does not decide all AAAA data; missing AAAA proves neither total name absence nor an unavailable application. Name the needed type/result evidence without running real queries.

Read every scenario without motion

Negative types

The observed path was selected
NXDOMAIN for missing.example.org. A/IN and NODATA for v4only.example.org. AAAA/IN carry different question/result tuples.
Resolution evidence
NXDOMAIN / NODATA tuples
Result classification
No classification
Coverage review
No review
The source role was marked
The stub receives a recursive reply; an authoritative answer belongs to another observation point. rd/ra/aa do not show that one actor sees every upstream exchange.
Resolution evidence
NXDOMAIN / NODATA tuples
Result classification
Stub reply ≠ upstream capture
Coverage review
No review
Negative SOA context was preserved
Both negative summaries have an SOA for example.org. With SOA TTL 300 and MINIMUM 60, the selected negative lifetime is 60 seconds. Empty answers alone explain neither that calculation nor the result class.
Resolution evidence
NXDOMAIN / NODATA tuples
Result classification
min(300,60)=60
Coverage review
No review
Ordinary absence was not made an alarm
Cache responses may lack observed root/TLD exchanges from coldTrace. Missing AAAA in NODATA also does not remove existingA; deviations are judged within the same scope.
Resolution evidence
NXDOMAIN / NODATA tuples
Result classification
min(300,60)=60
Coverage review
Cache / type absence can be normal
Missing coverage was stated separately
The artifact provides no transport, DNSSEC or HTTP outcome. Their absence in a plain role trace does not show those layers are disabled in an actual deployment.
Resolution evidence
UNKNOWN: transport/validation
Result classification
min(300,60)=60
Coverage review
Cache / type absence can be normal
Resolution regression was bounded
Cold referrals, warm TTL and NXDOMAIN/NODATA classification remain separate controls. A supplied DNS answer does not mean certificate or user-permission regression has passed.
Resolution evidence
UNKNOWN: transport/validation
Result classification
min(300,60)=60
Coverage review
Name/type results distinct; higher layer unknown

Warm cache

The observed path was selected
The cache entry arrived with a 120-second TTL and has aged 30 seconds, leaving 90 seconds. Not seeing an upstream root query is therefore consistent with ordinary cache reuse.
Resolution evidence
Cache 120−30=90
Result classification
No classification
Coverage review
No review
The cache entry matched the question
The warmCache entry has name=notes.example.org., type=A and class=IN, matching the stub question. The recursive resolver reads it locally; no new authoritative answer is shown. The entry supplies cache provenance rather than TLS or DNSSEC validation.
Resolution evidence
Cache 120−30=90
Result classification
name/type/class match
Coverage review
No review
Positive TTL lifetime was computed
This positive entry supplies receivedTtl=120 and elapsedSeconds=30, leaving remainingTtl=90. The negative SOA TTL 300 / MINIMUM 60 calculation belongs to another case and does not replace this A answer’s lifetime with 60 seconds.
Resolution evidence
Cache 120−30=90
Result classification
Positive remainingTtl=90
Coverage review
No review
The upstream query steps were skipped
The selected fresh cache entry answers the same question, skipping root, TLD and authoritative queries in this branch. A stub seeing the cached reply does not observe how the resolver originally learned it. No new upstream record is ordinary for this baseline.
Resolution evidence
Cache 120−30=90
Result classification
Positive remainingTtl=90
Coverage review
Fresh cache / no new upstream query
Missing coverage was stated separately
The artifact provides no transport, DNSSEC or HTTP outcome. Their absence in a plain role trace does not show those layers are disabled in an actual deployment.
Resolution evidence
UNKNOWN: transport/validation
Result classification
Positive remainingTtl=90
Coverage review
Fresh cache / no new upstream query
Resolution regression was bounded
Matching name/type/class and remaining TTL support cache-use expectations in this branch. They do not establish a current authoritative exchange, accepted certificate or verified user permission. Actual cached-response review must correlate resolver, time and provenance for the same operation.
Resolution evidence
UNKNOWN: transport/validation
Result classification
Positive remainingTtl=90
Coverage review
Cache expectation agrees; higher layer unknown

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

A resolution trace needs roles and results

The artifact separates query sender/receiver, QNAME/QTYPE, referral zone and final result. Resolver-to-stub and authoritative-to-resolver answers have different roles. Trace fields are an original teaching schema, not a DNS product log or hex capture.

Real observations need resolver identity, cache source, time, question tuple and response context. One observer may not see upstream exchanges. Do not infer encrypted transport from this role diagram; transport and validation evidence are separate.

Cold, warm and negative baselines

The cold path follows root/TLD referrals; the warm branch answers from a selected cache entry. No root query can be normal with answer or delegation-cache reuse. Its absence alone does not prove DNS was unused.

NXDOMAIN concerns a missing name; NODATA concerns missing AAAA at an existing v4only name. The negative authority summary carries SOA and selected cache lifetime min(SOA TTL 300, MINIMUM 60)=60. This is a basic boundary; full negative-cache policy and DNSSEC validation are separate lesson scopes.

A good review is more than one hostname result

Retain absolute-name and label boundaries in namespace review, zone scope in authority review, and recursion/cache provenance in resolver review. In the cold trace the root referral returns to the recursive resolver, which sends a new query to TLD. Root does not forward it as an application proxy. In the warm branch a fresh entry skips those upstream steps.

A DNS result supports its question and response scope only. RCODE, relevant answers and authority context distinguish missing name from missing requested type. Certificates, browser origin, outbound policy and user authorization need separate observations at their layers. Do not record the resolver reply and authoritative answer as the same observation point.

An application consuming DNS results should retain name/type/class with the result. AAAA NODATA for v4only.example.org. does not establish that its A record is missing; NXDOMAIN for missing.example.org. reports name absence. Turning both into one permanent invalid-hostname state can incorrectly disable a normal IPv4 path. Verify these distinct expected results separately, and do not keep treating an expired negative-cache result as a current decision.

NOW APPLY IT TO THE CASE

How do authority roles and negative-answer scope differ?

notes.example.org. resolves within example.org. authority. Missing AAAA data for v4only.example.org. does not remove its existing A record. A resolver reply informs address selection rather than deciding application identity.

Does a DNS answer establish the case’s correct book result? Separate the end of name-resolution knowledge from the start of HTTP and application observations.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Namespace and resolution decision trace

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "question": {
    "name": "notes.example.org.",
    "type": "A",
    "class": "IN",
    "stubRd": true
  },
  "labels": [
    "notes",
    "example",
    "org",
    ""
  ],
  "authoritativeZone": "example.org.",
  "coldTrace": [
    {
      "from": "stub",
      "to": "recursive",
      "kind": "query",
      "rd": true
    },
    {
      "from": "recursive",
      "to": "root",
      "kind": "query",
      "rd": false
    },
    {
      "from": "root",
      "to": "recursive",
      "kind": "referral",
      "zone": "org.",
      "aa": false
    },
    {
      "from": "recursive",
      "to": "tld",
      "kind": "query",
      "rd": false
    },
    {
      "from": "tld",
      "to": "recursive",
      "kind": "referral",
      "zone": "example.org.",
      "aa": false
    },
    {
      "from": "recursive",
      "to": "authoritative",
      "kind": "query",
      "rd": false
    },
    {
      "from": "authoritative",
      "to": "recursive",
      "kind": "answer",
      "aa": true,
      "rcode": "NOERROR",
      "records": [
        {
          "owner": "notes.example.org.",
          "type": "A",
          "class": "IN",
          "ttl": 120,
          "rdata": "198.51.100.200"
        }
      ]
    },
    {
      "from": "recursive",
      "to": "stub",
      "kind": "answer",
      "aa": false,
      "rd": true,
      "ra": true,
      "rcode": "NOERROR"
    }
  ],
  "warmCache": {
    "name": "notes.example.org.",
    "type": "A",
    "class": "IN",
    "receivedTtl": 120,
    "elapsedSeconds": 30,
    "remainingTtl": 90,
    "source": "selected-positive-cache-entry"
  },
  "negativeCases": [
    {
      "id": "NXDOMAIN",
      "question": {
        "name": "missing.example.org.",
        "type": "A",
        "class": "IN"
      },
      "rcode": "NXDOMAIN",
      "answers": [],
      "soaSummary": {
        "owner": "example.org.",
        "ttl": 300,
        "minimum": 60
      },
      "classification": "name-absent",
      "selectedNegativeTtl": 60
    },
    {
      "id": "NODATA",
      "question": {
        "name": "v4only.example.org.",
        "type": "AAAA",
        "class": "IN"
      },
      "rcode": "NOERROR",
      "answers": [],
      "soaSummary": {
        "owner": "example.org.",
        "ttl": 300,
        "minimum": 60
      },
      "classification": "requested-type-absent",
      "existingA": "198.51.100.201",
      "selectedNegativeTtl": 60
    }
  ],
  "limits": [
    "synthetic authority/delegation summaries; not current example.org DNS",
    "server-address selection supplied",
    "no alias in negative cases",
    "no transport, DNSSEC or HTTP outcome"
  ]
}

labels / authoritativeZone: Separates the name tree from managed zone scope.
coldTrace.from / to / kind: Identifies the sender/receiver roles of query or response arrivals.
rd / ra / aa: Recursion request/availability and authoritative-answer context, not validation proof.
warmCache.remainingTtl: Selected positive-cache arithmetic, not a live clock or OS cache.
negativeCases: Distinct name/type conditions for NXDOMAIN and NOERROR/NODATA.

Inert role trace and selected results. No DNS bytes, actual example.org records, QNAME minimization, glue/priming, full caching, DNSSEC or application outcome.

Two reality checks

A recursive resolver repeats root→TLD→authority for every query.

Usable answer/delegation caches or another resolver path can change upstream work; the cold path is one selected condition.

An empty AAAA answer means the domain does not exist.

NOERROR/NODATA can mean a missing type at an existing name; NXDOMAIN is a name error, while timeout/SERVFAIL differ.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

An AAAA answer for v4only.example.org is NOERROR with empty answers. Is the name absent?

No; the selected record is NODATA and an A record exists.
Yes; empty answers always means NXDOMAIN.

Read the explained answer

No; the selected record is NODATA and an A record exists. — NOERROR with empty AAAA is absence of the requested type in this example, not name-absent.

Do the root referral and authoritative answer serve the same role?

Selected lesson artifact fields; teaching example

coldTrace[2]: {"from":"root","to":"recursive","kind":"referral","zone":"org.","aa":false}
coldTrace[6]: {"from":"authoritative","to":"recursive","kind":"answer","aa":true,"rcode":"NOERROR","records":[{"owner":"notes.example.org.","type":"A","class":"IN","ttl":120,"rdata":"198.51.100.200"}]}

The referral directs resolution to the next authority; the authoritative answer supplies a resource record.
The root referral is the final IP answer for the book server.

Read the explained answer

The referral directs resolution to the next authority; the authoritative answer supplies a resource record. — The root referral for org. has AA=false. The selected authority supplies the notes A answer with AA=true.

Why is a root lookup not required when the warm cache has remainingTtl=90?

Read the explained answer

The resolver can answer the same question from a fresh positive entry. A cached response is not a newly queried authoritative answer. This example does not measure DNSSEC, transport or HTTP-server availability; learning an address is not application success.

□ I distinguished a cache hit from a new authority query.

□ I did not equate a DNS result with HTTP success.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

RFC 1034 — DNS concepts2.2 DNS design goals · 3.1 Namespace specifications and terminology · 3.6.2 Aliases and canonical names · 4.2 How the database is divided into zones · 4.3.1 Queries and responses · 4.3.2 Algorithm · 5.3.1 Stub resolvers
RFC 9499 — DNS terminology2 Names: FQDN and labels · 5 Resource Records: TTL · 6 DNS Servers and Clients: stub, recursive, iterative, authoritative · 7 Zones
RFC 1035 — DNS specification3.3.1 CNAME · 3.3.9 MX · 3.3.11 NS · 3.3.12 PTR · 3.3.13 SOA · 3.3.14 TXT · 3.4.1 A · 3.5 IN-ADDR.ARPA · 4.1.1 Header · 4.1.2 Question · 4.1.3 Resource record
RFC 2308 — DNS negative caching2.1 Name Error · 2.2 No Data · 3 Negative Answers from Authoritative Servers · 4 SOA Minimum Field · 5 Caching Negative Answers
RFC 2181 — DNS clarifications5.1 RRsets · 8 Time to Live · 10.1 CNAME resource records · 10.2 PTR records · 10.3 MX and NS records
RFC 2606 — Reserved example domains3 Reserved Example Second Level Domain Names
RFC 5737 — Documentation IPv43 Documentation Address Blocks

YOUR NOTES / THIS BROWSER

DNS namespace and resolution

1. Core · Mechanism

Cold A · iterative referrals

Warm A · cache hit

NXDOMAIN · name absent

NODATA · AAAA

Why separate names from addresses?

Labels, domains, subdomains and FQDNs

Namespace and zones have different scopes

Separate stub and recursive resolver work

A recursive result can require iterative exchanges

Results: answer, name error or missing type

2. Red · Trust & Impact

Authority boundary

Type boundary

Broken assumption: a written name is trusted identity

Broken assumption: every subdomain is independent authority

Broken assumption: an empty answer proves name absence

3. Blue · Secure development & defense

Negative types

Warm cache

A resolution trace needs roles and results

Cold, warm and negative baselines

A good review is more than one hostname result

How do authority roles and negative-answer scope differ?

Two reality checks

An AAAA answer for v4only.example.org is NOERROR with empty answers. Is the name absent?

Do the root referral and authoritative answer serve the same role?

Why is a root lookup not required when the warm cache has remainingTtl=90?

Sources and scope