Configure the NetScaler as an end resolver

Last published : Sep 22, 2026
A resolver is a procedure that is invoked by an application program that translates a domain/host name to its resource record. The resolver interacts with the LDNS, which looks up the domain name to obtain its IP address. The NetScaler can provide end-to-end resolution for DNS queries.
In recursive resolution, the NetScaler appliance queries different name servers recursively to access the IP address of a domain. When the NetScaler receives a DNS request, it checks its cache for the DNS record. If the record is not present in the cache, it queries the root servers configured in the ns.conf file. The root name server reports back with the address of a DNS server that has detailed information about the second-level domain. The process is repeated until the required record is found.
When you start the NetScaler appliance for the first time, 13 root name servers are added to the ns.conf file. The NS and Address records for the 13 root servers are also added. You can modify the ns.conf file, but the NetScaler does not allow you to delete all 13 records. At least one name server entry is required for the appliance to perform name resolution. The following diagram illustrates the process of name resolution.
Figure 1. Recursive resolution
Recursive Resolution
In the process shown in the diagram, when the name server receives a query for the address of s1.s2.s3.com, it first checks the root name servers for s1.s2.s3.com. A root name server reports back with the address of the .com name server. If the address of s1.s2.s3.com is found in the name server, it responds with a suitable IP address. Otherwise, it queries other name servers for s3.com, then for s2.s3.com to retrieve the address of s1.s2.s3.com. In this way, resolution always starts from root name servers and ends with the domain’s authoritative name server.
Note
For recursive resolution functionality, caching must be enabled.
Related information

Enable recursive resolution

To configure the NetScaler appliance to function as an end resolver, you must enable recursive resolution on the appliance. You must also add a DNS name server with the local option for the feature to work.

Enable recursive resolution by using the CLI

At the command prompt, type the following commands to enable recursive resolution and verify the configuration:
-  set dns parameter -recursion ENABLED  
-  show dns parameter  
Example:
> set dns parameter -recursion ENABLED
 Done
> show dns parameter
        DNS parameters:
            .
            .
            .
        Recursive Resolution : ENABLED
            .
            .
            .
 Done

Enable recursive resolution by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, select the Enable recursion check box, and then click OK.

Add a name server (when the NetScaler appliance acts as a resolver) by using the CLI

At the command prompt, type:
add dns nameServer ((<IP> [-local]) | <dnsVserverName>)
Example:
add dns nameServer 10.102.9.19 -local
show dns nameServer
1)  10.102.9.19 LOCAL -  State: UP  Protocol: UDP
Done
Local - Mark the IP address as one that belongs to a local recursive DNS server on the NetScaler appliance. The appliance recursively resolves queries received on an IP address that is marked as being local. For recursive resolution to work, the global DNS parameter, recursion, must also be set. If no name server is marked as being local, the appliance functions as a stub resolver and load balances the name servers.

Add a name server by using the GUI

Navigate to Traffic Management > DNS > Name Servers and create a name server.

Enable DNS root referral

DNS root referral is disabled by default. When enabled, the ADC appliance responds with the root referral records.
Send a root referral if a client queries a domain name that is unrelated to the domains configured/cached on the NetScaler appliance. If the setting is disabled, the appliance sends a blank response instead of a root referral. Applicable to domains for which the appliance is authoritative. Disable the parameter when the appliance is under attack from a client that is sending a flood of queries for unrelated domains.

Enable root referral by using the CLI

At the command prompt, type the following commands to enable recursive resolution and verify the configuration:
-  set dns parameter -dnsrootReferral ENABLED  
-  show dns parameter  
Example:
> set dns parameter -recursion ENABLED
 Done
> show dns parameter
        DNS parameters:
            .
            .
            .
        DNS Root Referral : ENABLED
            .
            .
            .
 Done

Enable root referral by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, select the Enable Root Referral check box, and then click OK.

Set the Number of Retries

Configure the ADC appliance to make a preconfigured number of attempts (called DNS retries) when it does not receive a response from the server to which it sends a query. By default, the number of DNS retries is set to 5.

Set the number of DNS retries by using the CLI

At the command prompt, type the following commands to set the number of retries and verify the configuration:
-  set dns parameter -retries <positive_integer>  
-  show dns parameter  
Example:
> set DNS parameter -retries 3
 Done
> show dns parameter
        DNS parameters:
        DNS retries: 3
            .
            .
            .
 Done

Set the number of retries by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, in the DNS Retries text box, type the DNS resolver request retry count, and then click OK.