Resolver or authoritative server, public DNS or your internet provider's, private DNS on a VPS: what a DNS server does, which one to use on your device and for your domain, and how to fix failures.
By Mouhamed BANKOLE, CEO at ITNET Technologies · Updated October 28, 2026 · Reading time: 11 min
A website that won't load, emails that never arrive, a router that "has no Internet" even though the Wi-Fi works: very often, the culprit is a DNS server. Yet the term covers two very different machines: the one that answers for your domain name, and the one your computer asks to find everyone else's. Here is what a DNS server does, how a lookup works, which DNS server to use on your device and for your domain, and how to fix the usual failures.
In short
- A DNS server translates a domain name (example.com) into an IP address that machines can reach.
- There are two kinds: the resolver, which your computer queries, and the authoritative server, which holds your domain's DNS zone.
- On your computer or router, your internet provider's resolver is often enough; a public DNS (Quad9, DNS4EU, Cloudflare, Google) should be chosen for its logging policy and filtering.
- For your domain name, your registrar's or host's DNS servers are authoritative: that is where you manage A, MX, CNAME and TXT records.
- Running your own DNS server (private DNS) mainly makes sense for a company network, a lab or custom filtering on a VPS.
Contents
- What is a DNS server?
- Resolver or authoritative server: what is the difference?
- How does a DNS lookup work, step by step?
- Which DNS server should you use on your computer or router?
- Public DNS or your internet provider's DNS: which should you choose?
- How do you change DNS servers on Windows, macOS or Linux?
- Which DNS servers should you use for your domain name?
- Should you run your own DNS server (private DNS)?
- How do you troubleshoot a DNS server problem?
What is a DNS server?
A DNS server is a machine that answers the question "which IP address matches this domain name?", so your browser or email client knows where to connect. DNS (Domain Name System) works as the Internet's directory: people remember names, machines use IP addresses.
A DNS server is used to:
- find a website's IP address (A or AAAA record);
- know where to deliver a domain's email (MX record);
- create aliases such as www or blog (CNAME record);
- publish proofs and policies: SPF, DKIM, DMARC, domain verification (TXT record);
- sign answers with DNSSEC, so nobody can forge them.
Without a reachable DNS server, your connection works but no name resolves: that is the well-known "DNS server isn't responding" message on Windows.
Resolver or authoritative server: what is the difference?
The resolver looks up the answer on behalf of your computer, while the authoritative server holds the official answer for a given domain. The reference DNS terminology clearly separates these two roles (RFC 9499, IETF).
| Resolver (recursive) | Authoritative server | |
|---|---|---|
| Role | Asks the questions and caches the answers | Answers for the domains whose zone it manages |
| Who uses it | Your computer, phone, router | Resolvers all over the world |
| Who provides it | Internet provider, public DNS, company network | Registrar, DNS host, your own server |
| What you set there | The resolver address in your network settings | Your domain's A, MX, CNAME, TXT records |
| Typical question | "Which DNS should I set on my router?" | "Which DNS servers for my domain?" |
Pro tip: when someone asks for "your DNS servers", check which role they mean. A hosting provider means your domain's authoritative servers; a network technician means your device's resolver.
How does a DNS lookup work, step by step?
Your computer queries a resolver, which walks down the DNS hierarchy (root, extension, domain) to the authoritative server, then sends you the answer and keeps it in cache.
The steps, for www.example.fr:
- the browser checks its own cache and the system's;
- if nothing is there, it queries the configured resolver (router, internet provider or public DNS);
- the resolver asks the root servers who manages the .fr extension;
- it queries the .fr servers, which point to example.fr's authoritative servers;
- it queries those authoritative servers, which return the IP address;
- it caches the answer for the time set by the record's TTL, then passes it to your browser.
This cache is what people call "DNS propagation": after a zone change, some resolvers keep serving the old answer until the TTL expires. To learn more about the zone and its records, see our domain name guide.
Which DNS server should you use on your computer or router?
Your internet provider's resolver is fine in most cases; switch to a public DNS if you want malicious-domain filtering, a clearer logging policy or a fallback during troubleshooting. The "best" DNS server depends on what you expect from it.
| Public resolver | IPv4 addresses | What the operator says |
|---|---|---|
| Quad9 | 9.9.9.9 and 149.112.112.112 | Blocks known malicious domains, based in Switzerland, no IP address stored (Quad9) |
| DNS4EU (protective profile) | 86.54.11.1 and 86.54.11.201 | European resolver operated by Whalebone, IP address anonymised before logging (DNS4EU) |
| DNS4EU (unfiltered) | 86.54.11.100 and 86.54.11.200 | Same service without security filtering (DNS4EU) |
| Cloudflare | 1.1.1.1 | Logs deleted within 25 hours, full IP address not kept (Cloudflare) |
| Google Public DNS | 8.8.8.8 and 8.8.4.4 | Temporary logs with IP address deleted within 24 to 48 hours (Google) |
What to look at:
- the logging policy: what is kept, for how long, with or without your IP address;
- filtering: blocking of malicious domains, parental control, ads;
- the operator's location and the law that applies to it;
- encryption of queries (DNS over HTTPS or DNS over TLS);
- speed from your own network, measured rather than assumed.
Note: DNS4EU states that its public service is meant for individuals and is not suited to organisations, and that court-ordered blocks apply to all its profiles, including the unfiltered one (DNS4EU).
Public DNS or your internet provider's DNS: which should you choose?
Keep your internet provider's DNS if it works well, and choose a public DNS to add filtering, work around an outage or separate your DNS lookups from your provider. Neither is better in absolute terms.
| Situation | Suggested choice |
|---|---|
| Home use, no issues | Internet provider's DNS |
| Protection against malicious sites | Filtering resolver (Quad9, DNS4EU protective profile) |
| Provider DNS down or slow | Public DNS as a fallback while you troubleshoot |
| Company network, managed devices | Internal resolver or private DNS, with controlled filtering |
| Need for internal names (local servers) | Private DNS |
Pro tip: always enter two addresses (primary and secondary), ideally from the same operator, so both apply the same filtering policy.
How do you change DNS servers on Windows, macOS or Linux?
You change the DNS server in the device's network settings, or once for the whole household in the router's interface. Changing it on the router is simpler, but some routers do not allow it.
On Windows:
- open Settings, then Network & Internet;
- pick the connection (Wi-Fi or Ethernet), then Hardware properties;
- click Edit next to DNS server assignment;
- switch to Manual, turn on IPv4 and enter both addresses;
- flush the cache with the
ipconfig /flushdnscommand.
On macOS: System Settings, Network, your connection, Details, then the DNS tab, where you add addresses with the "+" button.
On Linux with systemd-resolved: set the addresses in /etc/systemd/resolved.conf (DNS= line), restart the service, then check with resolvectl status.
On the router: look for the DHCP or DNS section of the admin interface. If it is locked, set DNS device by device.
Which DNS servers should you use for your domain name?
For your domain name, use the authoritative DNS servers of your registrar or DNS host, declared to the extension's registry: they are the ones publishing your zone. A public DNS such as 8.8.8.8 cannot play that role.
What to check with your DNS provider:
- an interface that handles every record type (A, AAAA, MX, CNAME, TXT);
- DNSSEC available, to sign the zone;
- several name servers, spread out, for redundancy;
- the freedom to change DNS servers without changing registrar, and vice versa.
At Wayhost, every domain name includes full DNS management for A, MX, CNAME and TXT records, unlimited subdomains and DNSSEC security (checked on October 28, 2026 on the domain names page). Our article What is DNSSEC and how to enable it explains why you should turn it on.
If your domain is elsewhere and you want domain and DNS zone in one place, a domain transfer causes no downtime as long as the zone stays the same during the move.
Should you run your own DNS server (private DNS)?
Running your own DNS server is only useful if you have a specific need: internal names, custom filtering, controlled logging or a technical lab. For a brochure website or a small business without an internal network, your registrar's DNS is enough.
When a private DNS makes sense:
- resolving internal names (servers, NAS, applications) that must not be public;
- filtering for a whole team with a tool such as Pi-hole, AdGuard Home or Unbound;
- keeping control of the query logs of your devices;
- running a secondary authoritative server, for the redundancy of your zones;
- learning and testing without touching production.
| Option | For whom | Watch out for |
|---|---|---|
| Registrar DNS | Websites, email, public domains | Pick a provider with DNSSEC and a full interface |
| Private resolver on a router or mini-PC | Home, small office | Availability limited to the local machine |
| Resolver or authoritative DNS on a VPS | Teams, agencies, developers | Updates, firewall, never leave a resolver open to the whole Internet |
A VPS with full root access and a choice of Linux distribution is suitable for this kind of service (checked on October 28, 2026). To compare hosting types before you decide, see our guide Web hosting: how it works and how to choose.
Pro tip: a recursive resolver open to everyone can be abused for amplification attacks. Restrict it to your IP addresses or your private network.
How do you troubleshoot a DNS server problem?
Compare the answer from your usual resolver with the one from another resolver and from the authoritative server: the difference tells you where the fault is. Three commands are enough in most cases.
Useful commands:
nslookup example.fr: the answer from your current resolver (Windows, macOS, Linux);nslookup example.fr 9.9.9.9: the same question asked to another resolver;dig NS example.fr: the authoritative servers declared for the domain;dig @authoritative-server example.fr: the official answer, with no cache in between;ipconfig /flushdnsorresolvectl flush-caches: flush the local cache.
The most common symptoms:
- "DNS server isn't responding": resolver unreachable, try another resolver or restart the router;
- the site loads for you but not elsewhere: old answer in cache, wait for the TTL to expire;
- emails stop arriving: MX record deleted or wrong in the zone;
- DNSSEC validation error: expired signature or key wrongly declared to the registry.
Frequently asked questions
What is a DNS server in simple terms?
It is the Internet's directory. You give it a domain name, it returns the IP address of the server to reach. Without it, you would have to type IP addresses for every site.
What is the best DNS server?
There is no universal best DNS server. Choose based on the logging policy, filtering and the operator's location, then measure speed from your own connection.
Does changing DNS servers speed up the Internet?
It can speed up the first lookups if your current resolver is slow. Your connection's bandwidth does not change. The effect shows mostly when pages start loading, not on downloads.
Is it risky to change DNS servers?
No, the setting can be reversed at any time. The real choice is about trust: the resolver's operator sees the domain names you visit. Read its privacy policy before adopting it.
What does "DNS server isn't responding" mean?
Your device cannot reach the configured resolver. Restart the router, try another resolver, then flush the DNS cache. If the problem persists, the fault may lie with the router or the internet provider.
Which DNS servers should I set for my domain name?
Those of your registrar or DNS host, shown in your customer account. They are authoritative servers, not public resolvers. They are declared to the extension's registry.
What is a private DNS?
It is a DNS server you run yourself, on a router, a mini-PC or a VPS. It resolves internal names, filters for a team or keeps logs under your control. It needs updates and careful security settings.
How long does a DNS server change take?
On your device, the change is immediate once the cache is flushed. For a domain's DNS servers, you have to wait for resolvers around the world to renew their cache, which depends on the time-to-live (TTL) values in place.
Key takeaways
- A DNS server translates domain names into IP addresses: without it, no website or email can be found.
- The resolver serves your device, the authoritative server serves your domain: two separate settings.
- On a device or router, choose a resolver for its logging, filtering and location.
- For a domain, use your registrar's DNS servers with full record management and DNSSEC.
- A private DNS on a VPS makes sense for internal names, team filtering or a lab, provided you secure it.
To manage your domains' DNS zone with DNSSEC included and a full interface, explore Wayhost domain names.
Article written by Mouhamed BANKOLE, CEO at ITNET Technologies.