DNS zones split up the authority over different segments of the DNS namespace—for instance, a domain and a subdomain—which gives administrators more precise control over DNS records, DNS name servers and other components. This partitioning can help streamline DNS management and orchestration and distribute workloads across name servers.

For example, the domain “example.com” can exist in the same zone as subdomains “blog.example.com” and “community.example.com.” If administrators need more granular control—maybe because of the number of devices connected to the community site and the volume of associated DNS records—they can partition the “community.example.com” subdomain into its own zone with its own authoritative name server.

A DNS zone specifies that a domain, or part of a domain, is managed by a specific administrator; however, a zone can encompass multiple subdomains and multiple zones can exist on the same authoritative DNS server. DNS zones do not imply physical separation but are used for control over different parts of the namespace.

Zones can help ease the administrative burden associated with a domain, distribute DNS query load and enhance the overall efficiency and scalability of DNS services. Effective zone management that uses security features such as DNSSEC and dynamic updates can strengthen DNS security and reduce security threats like DNS spoofing and hijacking attacks.

Some background knowledge on the domain name system, and how it operates, is important to understanding DNS zones.

The DNS is a hierarchical, decentralized component of the internet standard protocol responsible for converting human-friendly domain names into the internet protocol (IP) addresses computers use to identify each other on the network.¹

Often called the “phonebook for the internet,” a more modern analogy is that DNS manages domain names in much the same way as smartphones manage contacts. Phones save contact numbers in searchable contact lists and eliminate the need for users to memorize individual phone numbers. Likewise, the DNS enables users to connect to websites by using domain names instead of complex IP addresses.

When a user enters a domain name into a browser, the query (often called a DNS request or DNS lookup) begins. A recursive resolver—the middleman between the client device and authoritative servers—then queries a series of servers to find the information it needs to connect the user to the wanted website. Each of these servers is responsible for a segment of the domain namespace.

The query process begins with the root name server. Root name servers sit atop the DNS hierarchy and are responsible for managing the root zone. These servers answer queries for records stored within the root zone and refer requests to the appropriate top-level domain (TLD) name server.

TLD name servers direct queries to the authoritative name servers for the specific domains within their TLD. For example, the TLD name server for ".com" directs domains ending in ".com", the TLD name server for ".gov" directs domains ending in ".gov", and so on.

The domain name server (sometimes referred to as the second-level domain name server) holds the zone file with the IP address for the full domain name, such as “ibm.com.” This zone file might also hold information for a subdomain (such as blog.ibm.com) or that information might be partitioned to its own zone.

Each of these servers stores DNS records with information about the domain that the recursive resolver needs to continue, and ultimately resolve, its query.