Root Nameservers

The Top of the Delegation Tree

Root nameservers don't know the IP address of thedns.guru. What they do know is which nameservers are responsible for every top-level domain — .com, .net, .guru, and the hundreds of others. Their job is purely referral.

Despite the "13 addresses" constraint (imposed by the 512-byte UDP limit of early DNS), the root server infrastructure today spans over 1,600 physical nodes across more than 170 countries, all reachable via anycast routing. This means a "query to a.root-servers.net" is answered by whichever physical node is closest to you — not one server in Virginia.

Root zone content is maintained by IANA (a function of ICANN) and distributed to all root server operators. The root zone contains about 1,500 TLD delegations and is updated multiple times per day.

Anycast is a routing technique where multiple physical servers share the same IP address. BGP routing protocols direct each query to the topologically nearest node. If one node goes offline, BGP automatically reroutes traffic to the next-closest instance — with no change needed at the resolver or client.

This architecture means a DDoS attack targeting a single root server address affects only the nodes serving that attack's traffic. The 2016 Mirai botnet attack sent 1+ Tbps at several root operators — the attacks were largely absorbed by anycast spreading the load across hundreds of nodes.

Recursive resolvers also mitigate root server load heavily: modern resolvers cache root NS records for up to 6 hours (518,400 seconds — the root zone's NS TTL). In practice, a busy resolver may go days without querying a root server.

The root hints file is bundled with resolver software (BIND, Unbound, PowerDNS) and tells the resolver how to reach root servers before any queries have been made. It is refreshed periodically via priming queries.