Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about DNS some days ago and learned how the requests are processed. If you surf to, then a request will go to the Root Name Servers to see who owns that .com address, then another request will go to another, more local, DNS server to see who owns the address and so on.

How is it technically possible that the 13 Root Name Servers can handle all requests done by earth's billions of Internet users simultaneosly without beeing ddos:ed?

share|improve this question
By the way, your summary of the way the DNS works is wrong. The question asked to the root name server is not "who owns .com?" but "what is the IP address of" (the root name server replies by a reference to the owner of .com). The root name server sees the entire query (which is useful for statistics, data mining, etc). – bortzmeyer Mar 3 '13 at 8:45
@bortzmeyer The main reason the entire name is sent to the root servers is that not every dot in the name is necessarily a boundary of authority. In practice I believe there always is a boundary of authority just below the TLD, but in principle it is not guaranteed. Hence at some point in the future it might be decided to introduce a special TLD where the second layer is handled by the root servers such that when you query the root servers for a.b.c.example you will be told who is responsible for c.example rather than who is responsible for example. – kasperd Dec 16 '15 at 23:35
up vote 43 down vote accepted

They're 13 highly available clusters of servers, not simply 13 servers.

Among other things, root nameserver operators are required to have enough capacity to handle three times their normal traffic load (RFC 2870). This leads to rather large clusters.

However, the root nameservers only serve responses for the top level domains themselves, i.e. com., net., uk., ae., etc., and the nameservers which query the root can cache this information up to 48 hours, which dramatically reduces the load at the root nameservers. This leads to smaller clusters.

The root nameservers are in over 130 physical locations in 53 countries; with only 13 server names, this is done through the magic of IPv4 anycast.

The root nameservers also have their own web site, which you may find interesting reading.

share|improve this answer
48 h is the TTL of the NS records at the root. But it can be overriden by the name servers of the TLD itself. For instance, for .jp, it is only 24 h. – bortzmeyer Mar 3 '13 at 8:46
Well, we are talking about the root nameservers here. :) – Michael Hampton Mar 3 '13 at 8:47
RFC 2870 is quite outdated today. Because of the dDoS attacks, a root name server has to be ready to answer much more than three times its normal traffic. – bortzmeyer Mar 3 '13 at 8:47
53 countries? is it a coincidence or they chose it just like the DNS query port?? :D – amyassin Mar 3 '13 at 13:34

They don't. The root nameservers just have to tell you what nameservers handle com. From then on, you don't need to go to them to handle any domain inside com. The root nameservers have no idea who owns They're root nameservers, not com nameservers.

What slimsuperhero said is also true. Many high-volume nameservers use anycast to have a single IP address served by a number of servers around the world.

share|improve this answer
But if 1 billion users were surfing to different .com adresses at the same second, would the root name servers handle all requests? – Rox Mar 3 '13 at 8:27
No. For one thing, users only talk to recursive nameservers (those that connect to other nameservers to get answers) and the root nameservers aren't recursive (they only serve local information they already know). Users talk to their own nameservers (usually provided by their ISP) who only need to ask the root nameservers once for the servers that handle com. – David Schwartz Mar 3 '13 at 8:29
@DavidSchwartz is correct - so instead of one billion requests from one billion users they'd only get roughly one million requests from one million ISPs, each of which serves a thousand users. – Shadur Mar 3 '13 at 11:08
@Shadur: Now, the nameservers for com on the other hand must take a much more massive beating. – David Schwartz Mar 3 '13 at 11:16
And I'm fairly sure they're scaled and clustered appropriately. – Shadur Mar 3 '13 at 11:18

Each root server is not actually a server, they are huge clusters of servers. In addition to this, DNS answers are cached so not every request reaches the root server.

share|improve this answer

Note that you do not use the root servers. You usually use the DNS server provided by your Internet Service Provider which usually can respond immediately if the information you need is in their local cache. Only if not cached, their upstream DNS server is asked and only eventually is the root server asked (and that response is then cached)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.