Uploaded February 2026 | Updated September 2026, 1 day ago
What actually happens in a full DNS Recursive lookup, even behind the resolver? It's more than what we see at the client end and most network engineers don't see this critical part.
In this video, we follow a DNS query step by step through a recursive lookup — from the recursive resolver, to the root name servers, TLD servers, and finally the authoritative name server that has the real answer.
This is Part 3 in my DNS series, where we move beyond the basics and look at the real backend mechanics that make DNS work at scale.
Download the PCAP and follow along!
github.com/packetpioneer/youtube/blob/main/dns_full_recursion.pcapng
Next up in the series? What are current methods to secure all this and how do those options work?
// Get Wireshark Certified //
Check out the official training course
📘 GET TRAINING: packetschool.teachable.com/l/pdp/official-wireshark-certified-analyst?coupon_code=PACKETHEAD50
🔗 Learn more: wireshark.org/certifications
Hands-On Lab Prep for the WCA - wiresharklabs.org
00:00 Intro
00:44 DNS Recursive Lookup
03:59 DNS Packet Capture - Thanks Infoblox!
05:45 Configuring Wireshark for DNS Analysis
07:19 The Root Server
09:30 Flipping to TCP
12:30 Top Level Domain Servers
15:12 Authoritative Name Server
16:22 Final Response to Client
17:38 What's next?
What actually happens in a full DNS Recursive lookup, even behind the resolver? It's more than what we see at the client end and most network engineers don't see this critical part.
In this video, we follow a DNS query step by step through a recursive lookup — from the recursive resolver, to the root name servers, TLD servers, and finally the authoritative name server that has the real answer.
This is Part 3 in my DNS series, where we move beyond the basics and look at the real backend mechanics that make DNS work at scale.
Download the PCAP and follow along!
github.com/packetpioneer/youtube/blob/main/dns_full_recursion.pcapng
Next up in the series? What are current methods to secure all this and how do those options work?
// Get Wireshark Certified //
Check out the official training course
📘 GET TRAINING: packetschool.teachable.com/l/pdp/official-wireshark-certified-analyst?coupon_code=PACKETHEAD50
🔗 Learn more: wireshark.org/certifications
Hands-On Lab Prep for the WCA - wiresharklabs.org
00:00 Intro
00:44 DNS Recursive Lookup
03:59 DNS Packet Capture - Thanks Infoblox!
05:45 Configuring Wireshark for DNS Analysis
07:19 The Root Server
09:30 Flipping to TCP
12:30 Top Level Domain Servers
15:12 Authoritative Name Server
16:22 Final Response to Client
17:38 What's next?
