The DNS hierarchy, root servers, TLDs, and how delegation actually works

DNS is hierarchical. You knew that. But what does the hierarchy actually look like? Who controls each level? Where do the root servers live? And what does it mean to "register a domain"?

This article gets concrete.

The tree

DNS is a tree. The root is at the top. Every domain name is a path from the root down to some leaf or internal node.

                          .  (root)
                          |
        +----+----+----+----+----+----+----+
        |    |    |    |    |    |    |
       com  org  net   uk   jp   io   ...   (TLDs)
        |
       myserver  (your domain)
        |
       play   (a subdomain)

The full name play.myserver.com. (with the dot at the end) reads from leaf to root: play → myserver → com → root.

Names are typically written without the trailing dot, but the dot is there implicitly.

The root

At the top is the root zone. It's a small zone (a few thousand records) that knows nothing about ordinary domains. It only knows about TLDs and where to find their nameservers.

The root is served by 13 logical nameservers, named a.root-servers.net through m.root-servers.net. Each "logical" nameserver is actually a cluster of physical servers using anycast (one IP advertised from many locations). In practice, there are over 1000 root server instances worldwide.

Who runs them? A small set of organizations:

• A: Verisign
• B: USC-ISI
• C: Cogent
• D: University of Maryland
• E: NASA Ames
• F: Internet Systems Consortium
• G: U.S. Department of Defense
• H: U.S. Army Research Lab
• I: Netnod (Sweden)
• J: Verisign
• K: RIPE NCC (Netherlands)
• L: ICANN
• M: WIDE Project (Japan)

Different organizations, different countries, different funding models. None of them owns "the root"; they each operate a piece of the redundancy.

ICANN coordinates the root zone's contents. IANA (a function of ICANN) maintains the master "root zone file." Verisign actually distributes the file to the root server operators. Changes to the root require IANA approval.

When ICANN adds a new TLD (like .app in 2018), the root zone is updated to delegate that TLD to its registry's nameservers.

TLDs

There are about 1500 TLDs as of 2026. They fall into categories:

Original gTLDs (generic TLDs): .com, .org, .net, .edu, .gov, .mil, .int. These have existed since DNS was created.

ccTLDs (country-code TLDs): .uk, .jp, .de, .fr, .us, etc. Two letters, one per country. Some are administered loosely (.tv, .io, .me are widely used by anyone). Others have residency restrictions.

New gTLDs: .app, .dev, .tech, .shop, .online, .xyz, and many more. ICANN expanded the gTLD space starting in 2014. Some have specific themes; many are general-purpose.

Brand TLDs: .google, .apple, .amazon. Companies bought their own TLD.

Each TLD is operated by a registry: an organization that runs the TLD's nameservers and maintains the database of registered domains.

• Verisign operates .com and .net.
• PIR (Public Interest Registry) operates .org.
• Country registries vary; .uk is operated by Nominet.

The registry doesn't sell domains directly (mostly). They wholesale to registrars (GoDaddy, Namecheap, Cloudflare Registrar, Google Domains, etc.), who sell to consumers.

Registrars

When you "buy" a domain, you're paying a registrar for a delegation. The registrar:

1. Charges you (typically $8 to $30/year for .com).
2. Contacts the registry, requesting the registration.
3. Adds an entry to the registry's database saying "this domain belongs to this customer, with these nameservers."

The TLD's nameservers then include an NS record pointing your domain at the nameservers you specified.

This delegation is what gives you control of your domain. Once you've registered myserver.com and pointed it at your nameservers, you can configure any records you want for it.

Registrars vary in:

• Pricing.
• Renewal terms.
• Privacy options (WHOIS privacy).
• Support.
• Bundled services.

Some registrars (Cloudflare in particular) sell domains at registry cost (no markup), making money on other services. Others (GoDaddy) mark up significantly but provide more upsells.

WHOIS and the public registry data

For every registered domain, certain information is recorded in the registry:

• Domain name.
• Registrar.
• Registration date.
• Expiration date.
• Nameservers.
• (Historically) the registrant's name and contact info.

This data was traditionally publicly queryable via whois. Anyone could look up who owned a domain. Useful for security researchers, lawyers, and spammers.

GDPR (2018) changed this for European registrants: contact info is no longer public. Most registrars now offer "WHOIS privacy" globally, masking your name behind a privacy service. Some TLDs make this free; some charge.

Bottom line: registering a domain no longer broadcasts your address to the world unless you opt in.

What "controlling a domain" means

After you register myserver.com and point it at your chosen nameservers:

• The registrar maintains the registration.
• The TLD's nameservers delegate queries about myserver.com to your nameservers.
• Your nameservers answer all queries.

If your nameservers go down, your domain is "unreachable" (lookups fail). If you fail to renew, the registrar marks it for deletion (usually with a grace period to recover).

You can change nameservers at any time by updating the registrar. The change propagates to the TLD's zone within minutes to hours.

You can transfer a domain between registrars (typically requires an auth code from the current registrar; takes 5 to 7 days). The domain itself, and its records, remain with you.

Authoritative nameservers

The nameservers you point your domain at are called authoritative for your zone. They are the source of truth for everything under myserver.com.

Common choices for nameservers:

• Your registrar's nameservers. Bundled, usually adequate, sometimes limited features.
• A dedicated DNS host. Cloudflare, Route53, Hurricane Electric, etc. Specialized services with better tooling, faster servers, more features (DDoS protection, advanced routing, etc.).
• Your own nameservers. Possible but requires running BIND, PowerDNS, or NSD on your own infrastructure. Rarely worth it for hobbyists.

For most users, using Cloudflare or your registrar's free DNS hosting is fine.

Resolvers vs authoritative servers

Two roles, often conflated:

Authoritative servers know the answers for a specific domain. They have the records you configured.

Resolvers (also called recursive servers) don't have records of their own. They look up answers on your behalf by querying authoritative servers. They cache results.

You typically use both, in different ways. Your computer uses a resolver. The resolver in turn talks to authoritative servers worldwide.

Public resolvers like 1.1.1.1 serve as recursive resolvers for billions of users. They're not authoritative for anyone in particular; they're middlemen.

The cache poisoning era

A historical note: in the 2000s, DNS resolvers had vulnerabilities that allowed attackers to inject false records into resolvers' caches. If successful, attackers could redirect users to fake sites.

Modern DNS (with various mitigations like source-port randomization, DNSSEC) is much harder to poison. It's not a routine threat for ordinary users, but DNS-related attacks still occasionally happen, usually targeting registrars or registries directly.

The lesson: choosing a competent resolver and registrar matters for security.

DNSSEC

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. If your resolver supports DNSSEC validation and your domain has DNSSEC enabled, the resolver can verify that the records it received are genuine and unaltered.

DNSSEC is technically powerful and operationally complex. Adoption has been slow but real. Most major TLDs support it. Most domains don't enable it (because of the operational complexity).

For most users, DNSSEC is invisible. For high-stakes domains (banks, governments), it's strongly recommended.

What you don't have to know

The DNS protocol itself has many details that don't matter for daily use:

• The exact wire format of DNS queries.
• The specific algorithm for resolver iteration.
• The protocols for zone transfers (AXFR/IXFR).
• The intricacies of dynamic DNS updates.

You only need to know these if you're running your own authoritative server or building DNS-aware software. For ordinary use, the mental model is: register a domain, point it at nameservers, configure records, queries resolve.

The system, summarized

The DNS hierarchy is a delegation chain:

1. The root knows about TLDs.
2. TLDs know about registered domains.
3. Each domain's owner controls its records via authoritative nameservers.

Each layer is run by different organizations. The system is genuinely distributed. There's no single point of failure (though there are critical points: ICANN, major registries, major DNS hosts).

This design has been remarkably resilient. DNS has scaled from a few thousand names in the 1980s to hundreds of millions today, without a fundamental architecture change. The original designers got the model right.

Coming up

Next: a closer look at DNS record types. We've mentioned A, AAAA, CNAME, MX, SRV, TXT. The next article walks through each in detail, with practical examples of when you use them.