Authoritative DNS Server vs DNS Forwarder

When this is useful

This distinction matters when one DNS server must handle both private names and normal internet names. For example, a development workstation may need api.project.local to resolve locally while still resolving github.com, package feeds, documentation sites, and public APIs through upstream DNS.

Understanding authoritative answers and forwarding helps you avoid accidental leaks, unexpected NXDOMAIN responses, and confusing setups where local zones and public resolution compete with each other.

Authoritative answers

An authoritative DNS server answers for zones it owns. If DNS Server Sentinel has a zone named project.local, it can answer records such as api.project.local directly from the local configuration.

• Predictable local answers.
• Support for SOA and NS zone information.
• Useful for private networks and development domains.

Forwarding

Forwarding sends unknown questions to upstream DNS servers such as 8.8.8.8 or another resolver. This lets the same server answer local names and still resolve public domains.

Local zone: project.local -> answered locally
Public name: example.com  -> forwarded upstream

Cache and protections

Forwarded answers can be cached to reduce repeated upstream queries. Protections and allowlists help control who can use recursive forwarding.