DNS cold start: how resolvers bootstrap from an empty cache

A DNS cold start happens when a resolver begins with an empty cache, and a recent APNIC PING podcast episode, published on 20 August 2026, explores the circular dependency this creates. In that episode, APNIC Chief Scientist Geoff Huston and George Michaelson discuss how the Domain Name System, the internet's address book, behaves when none of its previous answers are remembered. The conversation was prompted by a talk by Ondřej Surý at the DNS Working Group during the RIPE 92 Meeting in Edinburgh.

A cache is a place where a computer keeps information from earlier work so it does not have to fetch it again. This technique matters because the different parts of a computer work at very different speeds. Frequently used data can be kept in fast memory close to the CPU, the central processing unit, instead of having to be read from slower memory, a disk or even tape storage. The size and performance of a cache can have a large effect on overall speed, and comparing a CPU's performance with and without cached data is a standard way to show its value.

In the DNS, caching avoids the need to wait for a remote system to respond over the network and all the round-trip delays that involves. A resolver, the software or service that turns a domain name like www.apnic.net into the numerical IP addresses computers use, can often build an answer from information it has retained from previous queries and responses. Cold start is a known problem in large distributed systems. Geoff Huston likens it to the "black start" challenge faced by power generators. Industrial systems such as coal-fired plants and gas turbines need time to start up, but during a black start they face an extra problem: energizing the generator's magnetic field coils. Those coils need a separate source of direct current (DC) power to excite the generator so that the turbine's rotational force can be converted into electrical energy. Without that initial power source, the generator may spin but will not produce electricity. The required DC power typically comes from an independent source, such as a small diesel generator, or from a part of the electricity grid that remains operational. Utilities contracted to provide this contingency power play a critical role, and if they are not available when needed, the consequences can be serious.

The DNS is not an electrical generation network, but it shows similar kinds of complex dependencies. Its job is to map a fully qualified domain name to the IP addresses associated with that name. The D in DNS stands for Domain, and the labels in a domain name form a hierarchy of administrative domains separated by dots. Each domain boundary can, in principle, be served by a different authoritative nameserver, the server that holds the official records for that part of the hierarchy and defines how names are managed beneath it. As a result, what looks like a simple query, such as "What is www.apnic.net?", can trigger a sequence of lookups. Resolving that name may require querying information about multiple domains in the hierarchy, potentially involving three or more separate steps before the final answer is obtained.

When a cache is available, it contains the name-to-address mappings you have already learned, including the addresses of nameservers for domains you have previously visited. Those nameservers can then provide the answers you are looking for, either directly or by referring you to another server. But what happens when there is no cache? Imagine asking for the nameservers of .net and being told they are a.net and b.net. How do you locate a.net and b.net when discovering .net is the very problem you are trying to solve? This circular dependency lies at the heart of the DNS cold-start problem: how do you begin resolving names when you do not yet know where any of the relevant servers are?

Geoff Huston has been exploring this cold-start behaviour and what it reveals about the choices operators make when naming hosts and services, and when designing the DNS infrastructure behind them. It also highlights how intermediaries that insert themselves into the DNS resolution process, as well as mechanisms intended to mitigate cold-start risks, can increase the overall query load for clients around the world. Further reading on the APNIC Blog includes a post by Geoff Huston titled "Cold start DNS" and Ondřej Surý's presentation at the RIPE 92 DNS Working Group.

For everyday users and website owners, cold start matters because it is the moment when your device is most dependent on the resolver you have configured. A privacy-first encrypted DNS service such as AEU DNS, which speaks DNS over HTTPS/TLS/QUIC and keeps no logs, can give that first lookup both a dependable upstream cache and privacy protection, without inserting extra query load beyond what is necessary.