APNIC Finds Two Nameservers Cut DNS Repeat Queries

A large-scale measurement published by APNIC on 15 September 2026 found that serving a DNS zone from two authoritative nameservers instead of one cuts the average number of repeated queries from 3.43 to 2.57 per test. The same dataset shows the share of tests that complete with a single query for each query type rises from 58% to 71%. In plain terms, adding a second authoritative nameserver appears to make recursive resolvers, the servers that look up domain names on behalf of end users, much less likely to fire the same question over and over. The Domain Name System, or DNS, is the internet's address book that turns website names into IP addresses.

The result is a follow-up to an earlier APNIC study about the surprisingly large number of repeat queries in DNS, titled 'What part of ‘No!’ is so hard for the DNS to understand?' In that earlier work, researchers tasked many millions of users with resolving a unique DNS name, deliberately avoiding conventional caching. The follow-up measurement ran from 5 to 11 August 2026. APNIC's measurement setup divides the internet into six zones: North America, South America, Europe and Africa, India, Asia, and China. Each zone uses its own namespace, and initially each was served by one authoritative nameserver configured as a dual-stack server, meaning it can answer over both IPv4 and IPv6, the two versions of internet addressing.

Table 1 in the report summarises what happened with one authoritative nameserver. For response types that provide a definitive answer, including positive responses, NXDOMAIN (the name does not exist) and NOERROR/NODATA (the name exists but there is no record of the requested type), the repetition profile is similar. On average there are four queries per test; between 55% and 60% of tests finish with a single query, and when repetition occurs the average number of repeats is between four and six. The exact figures are: control 254,894,985 tests and 875,316,423 queries, an average of 3.43 per test; NXDOMAIN 115,750,503 tests and 509,410,787 queries, average 4.40; NODATA 115,571,398 tests and 454,213,932 queries, average 3.93. But when no definitive answer arrives, DNS resolvers slip into a repeating mode. SERVFAIL (server failure) produced 138,643,924 tests and an extreme 7,171,673,166 queries, or 51.73 per test. REFUSED produced 115,415,259 tests and 1,324,355,211 queries, or 11.47 per test. NO RESPONSE produced 116,050,253 tests and 9,685,775,212 queries, or 83.46 per test. The average repeat counts were equally striking: 51.29 for SERVFAIL, 16.32 for REFUSED and 83.38 for no response.

To test whether the number of authoritative nameservers changes this behaviour, APNIC repeated just the control measurement with two authoritative dual-stack nameservers. With one nameserver, the full control saw 254,894,985 tests, 147,233,117 single-query tests, 875,316,423 total queries, an average of 3.43 queries per test, 408,891,797 repeats and an average of 3.80 repeats. With two nameservers, the test saw 150,221,951 tests, 106,376,529 single-query tests, 385,725,364 total queries, an average of 2.57 queries per test, 112,191,597 repeats and an average of 2.56 repeats. The single-query completion rate rose from 58% to 71%. The addition of a second nameserver name and two additional IP addresses, one IPv4 and one IPv6, significantly reduced repeat queries, an outcome the author Geoff Huston describes as completely unexpected. A repeat is defined as a query with the same query name and query type. Normally one would expect an obsessive recursive resolver to query all authoritative nameservers with the same question to check consistency, increasing repeats, but the opposite occurred.

The report also looks at when repeats happen. In the first second of resolution, slightly more than 85% of duplicate queries arrive when there is one nameserver, but only 75% when there are two. With two nameservers, the repeat pattern shows a mild exponential backoff: small peaks at 0.75 seconds, 1.5 seconds and 3 seconds. Within five seconds, 90% of all repeated queries have been observed in both experiments. A closer view shows that with one nameserver, 17% of all repeated queries are observed within 10 milliseconds of the initial query, a rapid-fire duplication. With two nameservers that drops to 12%. Single-server timing shows local peaks at 100ms, 310ms and 800ms, while two-server timing shows peaks at 50ms, 100ms, 310ms, 370ms, 750ms and 800ms. A millisecond is one thousandth of a second.

To see whether this is caused by resolver farms or individual resolvers, Figure 3 normalises the two datasets and compares query repetition per resolver address. The main difference lies in the period from 10ms to 70ms after the initial query, where the single-server case shows significantly higher repeat volume, particularly from 10ms to 40ms. That interval is below most individual resolvers' User Datagram Protocol (UDP) timeout values, so the author asks why an individual resolver would repeat a query so quickly. One likely explanation is resolver farms. Large consumer Internet Service Providers often cannot handle query volume on a single platform, so they place a front-end dispatcher in front of many recursive resolvers, as seen with PowerDNS's DNSdist. A common configuration uses the front end with a public IP address to talk to the internet but private IP addresses to talk to the individual resolvers, so the whole farm appears as one public IP. In that case, the observed repetition may be the behaviour of the front-end systems, not of the recursive resolver implementations. When there is only one authoritative nameserver, a DNS front end might duplicate incoming queries across multiple resolver instances to try to improve speed and resilience. Huston notes this is speculative because DNS handles individual queries opaquely and there is no definitive explanation yet.

The unexpected result points to practical value in the long-standing operational advice to use a minimum of two nameservers for any zone in today's DNS. It appears to keep recursive resolvers happy. For site owners this is a reminder to check that your domain is actually served by at least two authoritative nameservers, ideally on separate infrastructure. For everyday users, the study shows that DNS is not a single lookup but often a burst of hidden retries, especially when servers fail or stay silent. While this experiment concerns authoritative servers rather than end-user resolvers, readers who run domains can reduce retry storms by following the same advice, and end users can keep their own lookups private with a privacy-first encrypted DNS resolver such as AEU DNS, which sends queries over DoH (DNS over HTTPS), DoT (DNS over TLS) or DoQ (DNS over QUIC) and keeps no logs.