What’s the difference between authoritative and recursive DNS?

When you add an SPF record, set up DKIM, or point your domain to a mail server, you're working with two different types of DNS servers. They have separate jobs, and knowing which does what saves a lot of head-scratching when changes don't seem to take effect.

Authoritative DNS is what you actually configure. These are the servers that store the official records for your domain. Your MX record (which tells the internet where to deliver your mail), your SPF, DKIM, and DMARC records, your CNAME records. All of these live on authoritative DNS servers. When you log into your domain registrar or DNS host and publish a new record, that's the authoritative server you're updating.

Recursive DNS is what does the looking up. When a mail server wants to know where to send email for your domain, it asks a recursive DNS server. That recursive server doesn't store your records. It goes and fetches them from the authoritative server, then caches the answer for a while so it doesn't have to ask again for every single lookup.

Here's where this gets practical. Say you update your MX record to point to a new mail server. Your authoritative DNS reflects that change immediately. But recursive DNS servers across the internet have cached your old record. Until that cache expires (based on the TTL value on your record), some mail servers will still see the old setup. That's DNS propagation, and it's why changes can feel slow even when you've done everything right.

As a domain owner, you configure authoritative DNS. You never touch recursive DNS directly. That part is managed by ISPs, Google, Cloudflare, and others on behalf of their users.

If you want to check what recursive resolvers are currently seeing for your domain's records (as opposed to what you just published), our free SPF checker pulls the live resolved value so you can spot any gap between what you set and what the world sees.