Design DNS at Scale

DNS, the Domain Name System, is the internet's address book: it turns a name a human types, like www.example.com, into the IP address a machine connects to. Two very different jobs hide inside that one sentence. An authoritative nameserver is the source of truth for a domain: it holds the real records for example.com and answers "the address for www.example.com is this" with authority, because it owns those records. A recursive resolver is the errand-runner that sits between a user and those authoritative servers. When your laptop wants a name, it asks a resolver, and the resolver walks the DNS hierarchy to find the answer and caches it. Cloudflare runs a famous public resolver at the address 1.1.1.1, and it also runs authoritative DNS for a large share of the web's domains.

This design sits close to Cloudflare's mission of helping build a better Internet. DNS is the very first thing that happens on almost every connection, so a slow or unreliable lookup makes everything after it feel slow. It also reuses the edge machinery from the CDN design. Users reach the nearest point of presence, usually shortened to PoP, by Anycast, and the PoP answers from local memory or cache whenever it can. Candidates are frequently told to prepare networking and DNS specifically for Cloudflare, so this is worth treating as a core design rather than a niche one.

The Cloudflare angle

Authoritative DNS and a recursive resolver are two different jobs, and the strong answer names that split in the first two minutes instead of blurring them into "design DNS." Authoritative service is a lookup in data you own. A customer's zone lives in your storage, and any query for it is answered directly and definitively. Recursion is the opposite shape. 1.1.1.1 owns none of the answers, so it finds them by asking the root servers, then the TLD servers for .com, then the domain's own authoritative servers. It earns its speed by caching what it learns.