title: Manually doing a recursive DNS query
body: <p>In my ongoing experiments to understand DNS, I'm trying to understand how a nameserver does a recursive query.  I get the basic idea - you start with a top level dns server, then it sends you a list of authoritative nameservers to contact, then you contact those servers, etc., until you get a authoritative response.</p>
  
  <p>Sounds simple enough.</p>
  
  <p>But when I try it in practice, I get stuck after the first step.  I'm just doing this manually with command line tools - (I make sure to turn <em>off</em> recursion.)</p>
  
  <p>Okay, so step 1: start with a root name server.  I randomly picked <code>198.41.0.4</code> (Verisign) from the list of <a href="http://en.wikipedia.org/wiki/Root_name_server" rel="noreferrer">root name servers on Wikipedia</a>.</p>
  
  <p>I send it a request to resolve "google.com".</p>
  
  <p>It sends me back the following:</p>
  
  <pre><code>+---------------------------------------------------------------------------+
  | 47547 | QR: 1 | OP: 00 | AA: 0 | TC: 0 | RD: 1 | RA: 0 | Z: 0 | RCODE: 00 |
  +---------------------------------------------------------------------------+
  | QDCOUNT:     1,   ANCOUNT:     0,   NSCOUNT:    13,   ARCOUNT:    15      |
  +---------------------------------------------------------------------------+
  
  ANSWERS : 0
  
  AUTHORITIES:
  NS: m.gtld-servers.net
  NS: l.gtld-servers.net
  NS: k.gtld-servers.net
  NS: j.gtld-servers.net
  NS: i.gtld-servers.net
  NS: h.gtld-servers.net
  NS: g.gtld-servers.net
  NS: f.gtld-servers.net
  NS: e.gtld-servers.net
  NS: d.gtld-servers.net
  NS: c.gtld-servers.net
  NS: b.gtld-servers.net
  NS: a.gtld-servers.net
  
  ADDITIONAL:
  A: 192.55.83.30
  A: 192.41.162.30
  A: 192.52.178.30
  A: 192.48.79.30
  A: 192.43.172.30
  A: 192.54.112.30
  A: 192.42.93.30
  A: 192.35.51.30
  A: 192.12.94.30
  A: 192.31.80.30
  A: 192.26.92.30
  A: 192.33.14.30
  AAAA: 2001:0503:231d:0000:0000:0000:0002:0030
  A: 192.5.6.30
  AAAA: 2001:0503:a83e:0000:0000:0000:0002:0030
  </code></pre>
  
  <p>Okay, so I'm not sure what the point of all those ADDITIONAL records are - they all appear to be local LAN addresses so I don't know what use they are to me.  But anyway, looking at the results returned in the authority section, I see another list of name servers.  Okay, so I guess the next step is I need to choose one of the name servers returned, and get it's IP. So I issue a request to resolve <code>a.gtld-servers.net</code>, and...</p>
  
  <p>...it just returns the exact same list of nameservers.</p>
  
  <p>So... I'm not sure how to proceed here.  How do I ultimately get to the authoritative name server for "google.com"?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Okay, so it appears those <code>192</code> addresses are not LAN addresses as I wrongly assumed, but they are other nameservers.  I'm assuming I can contact those nameservers to get closer to the authority.  But, how am I supposed to know to use these nameservers?  I thought that the ARCOUNT section was just for additional information... why are all those nameservers placed in the ADDITIONAL section instead of as answers or authorities?  Is it just some convention that referrals to other nameservers go in the ADDITIONAL section?</p>