The 13 Internet Root Servers

Frequently asked questions about root servers

How many DNS root servers are there?

There are 13 root server identities, named A to M, but each one is a cluster of many machines spread around the world using anycast. In total there are more than 1,700 root server instances in over 130 countries, so a query from Madrid, Cairo or Tokyo is answered by a nearby node rather than by a single computer in the United States.

Why exactly 13?

Because of a limit in the original DNS protocol: a UDP response had to fit in 512 bytes, and 13 name-and-address records is what fits alongside the question. Rather than add more identities, operators multiplied each one with anycast, which is why 13 names hide more than 1,700 servers.

Who operates the root servers?

Twelve organisations: Verisign (A and J), USC-ISI (B), Cogent (C), the University of Maryland (D), NASA (E), the Internet Systems Consortium (F), the US Department of Defense (G), the US Army Research Lab (H), Netnod (I), RIPE NCC (K), ICANN (L) and the WIDE Project (M). ICANN and IANA coordinate the root zone, and Verisign publishes it as Root Zone Maintainer.

Where are they physically?

Everywhere. The city in the table is the operator's home base, but every letter has instances on every continent, hosted at internet exchange points. Three operators are outside the United States (Netnod in Stockholm, RIPE NCC in Amsterdam, WIDE in Tokyo), and there are instances of several letters in Spain and in most European countries.

Can I use a root server as my DNS, like 198.41.0.4?

No. Root servers are authoritative only for the root zone: they do not resolve names for you, they only reply with a referral to the servers of the top-level domain you asked about (.com, .es, .org). A computer configured with a root server as its DNS cannot browse. What you need is a recursive resolver such as 1.1.1.1, 9.9.9.9 or 8.8.8.8.

What does a root server actually answer?

Only one thing: which name servers are authoritative for a top-level domain. When your resolver looks up example.com for the first time, the root tells it where the .com servers are, .com tells it where example.com's servers are, and those give the final answer. Resolvers cache the .com referral for two days, so in practice they ask the root very rarely.

What happens if a root server goes down or is attacked?

Very little. Traffic to the affected letter shifts to other anycast instances, and the other twelve letters keep answering. Resolvers also cache the top-level domain referrals for 48 hours, so even a total outage would take time to become visible. The large DDoS attacks of 2002, 2007 and 2015 caused no noticeable disruption for users.

Is the root zone signed with DNSSEC?

Yes, since July 2010, and the root key (KSK) was rolled for the first time in October 2018. Validating resolvers like Quad9, Cloudflare and Google check the signature chain starting from the root, which is what makes it possible to detect forged DNS answers.