8 Recursion: discovering an answer

8.1 Iteration from the root

A recursive resolver turns one client request into a bounded sequence of queries. For www.example.com. A, a cold lookup is approximately:

stub → recursive resolver
          ├─ root:       who serves com?
          ├─ com server: who serves example.com?
          └─ example:    what is www.example.com A?
     ← final answer

The resolver follows referrals, resolves nameserver addresses when glue is insufficient, handles aliases, retries servers and transports, and detects loops. It caches useful RRsets so later clients may skip most of this path.

Root hints are not answers to every name. They are bootstrap addresses for reaching the root authority. They need periodic maintenance because the set can change, though names and anycast make changes infrequent.

8.2 The cache is part of correctness

A cache key includes at least name, type, and class. A cached positive RRset expires according to TTL. Negative results also have bounded lifetimes derived from SOA data. Delegation and nameserver-address caches help the iterative algorithm navigate efficiently.

Capacity is as important as time. An attacker can generate endless distinct names. An unbounded cache converts traffic into memory exhaustion. A practical resolver bounds response cache bytes, nameserver cache entries, recursion depth, referral work, packet sizes, concurrent operations, and timeouts.

src/bin/dnscache.rs uses Hickory’s recursive zone handler inside rgbdns’s process and policy shell. It configures:

• randomized query-name letter case;
• a bounded response cache, defaulting to 16 MiB;
• a bounded nameserver cache;
• bounded ordinary and nameserver recursion depth;
• a 1232-byte EDNS payload;
• UDP and TCP listeners;
• loopback-only clients by default, expanded through ALLOW_NETS.

Configuration values are parsed with explicit minimums and maximums. A typo such as an enormous cache size fails startup rather than silently allocating an operator’s mistake.

8.3 Forward zones and djbdns roots

Private namespaces and split DNS often need selected suffixes sent to specific servers. rgbdns reads forward-zone configuration from the environment and the djbdns-style ROOT/servers directory. The filename identifies a suffix and the file lists bounded server addresses.

The special servers/@ file represents root servers. Hickory consumes a root hints file in master-file syntax, so PreparedRoots translates djbdns’s plain address list into a private temporary file. Creation uses restrictive permissions and cleanup occurs when the prepared object is dropped. This adapter preserves the external configuration contract without weakening the library boundary.

Forwarded private zones disable strict case-randomization response matching because legacy authorities may canonicalize owner case. They retain TCP retry and a bounded cache. This is a scoped compatibility decision, not a global removal of query hardening.