Root Servers and TLD Servers: Who Actually Runs the Internet's DNS

Where This Fits in a DNS Lookup

When a device looks up a domain it hasn't seen recently, the very first question it needs answered is: which servers are authoritative for this domain's TLDTop-Level Domain — the last part of a domain name, such as .com or .rw.? Root serversOne of the DNS servers at the top of the hierarchy that direct a lookup toward the right top-level-domain servers. and TLD servers exist to answer exactly that, before anything specific to your actual domain gets involved. See How Domains Work for how this fits into the full lookup chain.

The 13 Root Servers

There are 13 named root server addresses, labeled a.root-servers.net through m.root-servers.net. That number is small by design, DNSThe Domain Name System — the internet's directory that translates domain names into the IP addresses of servers. was built decades ago with a deliberately tiny root, but it's misleading on its own: each named address is actually served by many physical machines worldwide using anycast, a routing technique that sends a query to whichever instance is geographically or topologically closest. In practice, hundreds of real servers around the world answer as "the root servers," not 13 individual machines.

Who Actually Operates Them

Twelve different organizations operate the 13 root server letters, including Verisign, ICANN, universities like the University of Maryland, and other independent operators, coordinated through shared technical standards but not owned or controlled by any single company or government. This distributed operatorship is intentional: no single entity can unilaterally take the root offline or alter it.

What a Root Server Actually Answers

A root server doesn't know where register.rw lives. It only knows which servers are authoritative for the .rw TLD as a whole, and points the resolverA DNS server, usually run by your ISP, that looks up domain names on your behalf and caches the answers. there. That's the entire job: one layer of indirection, repeated for every TLD on earth, so the root's own list stays small and stable.

TLD Servers: One Level Down

Below the root sits a TLD server for each top-level domain, holding the authoritative list of nameserversA DNS server that holds the authoritative records for a domain and answers where its website and email live. for every domain registered under it. For .rw, that's RICTA's infrastructure; for .com, it's Verisign's. This is also the level at which a registryThe organization that operates a top-level domain and maintains the master database of its registrations. like RICTA actually operates, distinct from the root above it and from any individual domain's own nameservers below it. See What Is RICTA? for how Rwanda's registry fits into this specific layer.

Redundancy by Design

DNS as a whole is built to survive individual failures without visible impact. Anycast means a root server instance going offline in one region simply routes queries to the next-nearest instance elsewhere. Heavy cachingStoring a copy of data or a page so it can be served faster next time instead of being regenerated. at every layer, resolvers, ISPs, individual devices, means most lookups don't even reach a root server on a given day; they're answered from a cached copy of an earlier lookup. The system tolerates far more failure than its small, famous list of 13 addresses might suggest.

Why This Is Invisible to Everyday Domain Owners

None of this layer is something a domain owner ever touches directly. Registering and managing a .rw domain happens entirely through a registrarAn accredited company that sells and manages domain registrations on a registry's behalf. like Register.rw, which handles the registry relationship with RICTA on your behalf; the root and TLD layers above that operate automatically, the same way for every domain on the internet, regardless of who registered it or where. Understanding the layer mainly helps explain why DNS, as a whole, is resilient rather than something with a single point of failure. For the layer that does involve day-to-day decisions, your domain's own nameservers and records, see DNS Records Explained.