The hidden circular puzzle inside DNS: APNIC podcast explains cold start

In a recent episode of the PING podcast, APNIC Chief Scientist Geoff Huston and George Michaelson examine a subtle but foundational problem in how the Domain Name System (DNS) starts from a completely blank state. The discussion, published on 20 August 2026, was prompted by a presentation from Ondřej Surý at the DNS Working Group during the RIPE 92 Meeting in Edinburgh. The podcast uses a historical photograph of a draught horse towing a Talbot motor car from around 1908, provided with permission from the State Library of Queensland, as a visual metaphor for the slow, effortful process of getting a stalled system moving again.

The Domain Name System is the internet's address book: it translates human-friendly names such as www.apnic.net into the numeric IP addresses that computers use to connect to each other. A central technique in this translation is caching. A cache is a storage area for information you have already obtained, kept close at hand to avoid repeating slow work. In general computing, caches hold frequently used data in fast memory near the processor, preventing the need to fetch it from slower memory, disk, or tape storage. The size and speed of a cache can greatly affect overall system performance, and comparing the same processor with and without cached data clearly shows its value.

In DNS, caching avoids waiting for a remote system to respond over the network with all the associated round-trip delays. Instead, a resolver, the software that receives a DNS query and finds the answer, can often build a response from information it retained from earlier queries and responses. When that cache is empty, the resolver faces what engineers call a cold start.

Cold start is a well-known challenge in large distributed systems, and the podcast compares it to the electrical power industry. Coal-fired plants and gas turbines need time to start up, but during a so-called black start they encounter an additional problem: the generator's magnetic field coils must be energized. These coils need a separate source of direct current (DC) power to excite the generator, allowing the turbine's rotational force to be converted into electrical energy. Without that initial source, the generator may spin but will not produce electricity. The required DC power usually comes from an independent source, such as a small diesel generator or a part of the electrical grid that remains live. Utilities that are contracted to supply this contingency power play a critical role, and if they fail to be available when needed, the consequences can be severe.

DNS is not an electricity generation network, but it has similar kinds of complex dependencies. Its job is to map a fully qualified domain name, the complete domain name including all its labels separated by dots, to the IP addresses associated with that name. The letter D in DNS stands for Domain, and the labels in a domain name form a hierarchy of administrative domains. Each domain boundary can, in principle, be served by a different authoritative nameserver, a server that holds the official records for names beneath that point in the hierarchy.

As a result, what looks like a simple query, such as 'What is www.apnic.net?', can trigger a sequence of lookups. Resolving the name may require querying information about multiple domains in the hierarchy, potentially involving three or more separate steps before the final answer is obtained. When a cache already contains the name-to-address mappings you have learned, including the addresses of nameservers for domains you have visited before, those nameservers can provide answers directly or refer you onward. But what happens when there is no cache? Imagine asking for the nameservers of .net and being told they are a.net and b.net. How do you locate a.net and b.net when discovering .net is the very problem you are trying to solve? This circular dependency lies at the heart of the DNS cold-start problem: how do you begin resolving names when you do not yet know where any of the relevant servers are?

Geoff Huston has been exploring this cold-start behaviour and what it reveals about the choices operators make when naming hosts and services, and when designing the DNS infrastructure behind them. The discussion also highlights that intermediaries inserting themselves into the DNS resolution process, as well as mechanisms intended to mitigate cold-start risks, can increase the overall query load for clients around the world. This matters because a resolver that struggles with a cold start can cause noticeable delays for a user's first visit to a new website, and poorly designed mitigation can add extra traffic to the global DNS infrastructure.

For everyday internet users, the key insight is that the DNS resolver you use matters. A well-run, privacy-first encrypted DNS service such as AEU DNS can provide more predictable and secure name resolution, because it supports encrypted DNS queries over HTTPS, TLS and QUIC and does not log your browsing activity. For website owners and IT teams, designing authoritative nameservers that are geographically distributed and consistently configured helps reduce cold-start pain for visitors. The APNIC blog post also points readers to Huston's earlier article 'Cold start DNS' and Surý's presentation at the RIPE 92 DNS Working Group for deeper technical detail.