What is a DNS Resolver?

A DNS resolver is the mechanism that determines which Domain Name System (DNS) server answers a client’s request to translate a domain name into an IP address. In Versa SASE deployments, a DNS resolver is a configuration object that pairs a domain with a name server and is shared with SASE clients at registration.

Key takeaways

• DNS resolvers translate domain names into the IP addresses traffic needs.
• In Versa SASE, a resolver object pairs one domain with one name server.
• Split DNS sends only configured domains’ lookups through the SASE tunnel.
• Resolvers attach to gateways or shared gateway profiles, not per-user.
• Registration pushes resolver settings to the client in one XML config file.

On this page: Why it matters · How it works · Types · DNS Resolver & Versa · FAQ

Why is a DNS resolver important?

Every connection, whether a browser tab or a VPN client, starts by resolving a name to an address, so the resolver a device uses shapes what it can reach and how fast it responds. A resolver that is slow, unreachable, or compromised breaks the applications behind it before any real traffic moves – DNS trouble is one of the most common causes of “the network is down” tickets that turn out to be a resolution problem.

Resolver choice also carries security weight in remote-access architectures. Routing every DNS query through an encrypted tunnel protects lookups for private domains, but adds latency if applied to all public traffic too. Explicit resolver objects, paired with split DNS, let administrators decide domain by domain which queries need the protected path.

What is a DNS resolver?

At the client, a lightweight stub resolver hands each lookup to a configured DNS server. That server either answers from cache or, if it is a full recursive resolver, walks the DNS hierarchy – root, then top-level-domain, then authoritative server – until it finds the answer. Which server the client uses, and for which domains, is what a “DNS resolver” setting answers.

In the Versa secure access service, a DNS resolver is a configuration object rather than a running server: it has a name, a name server (the address to use), and a domain (what the server resolves). Administrators create these objects in the secure access portal and reference them from a gateway or gateway profile.

Types of DNS resolvers

DNS deployments rely on a few recognizable resolver roles. Recursive resolvers – run by ISPs or major public providers – accept a query and do the full hierarchy walk on the client’s behalf. Forwarding resolvers skip that walk and hand the query to another resolver, a pattern common inside enterprise networks that want one internal choke point for DNS. Stub resolvers are the minimal client-side component in an OS or application; they resolve nothing themselves, only forward to whichever resolver is configured. Split or conditional resolvers route different domains to different resolvers by policy – the pattern Versa’s DNS resolver objects and split DNS implement for SASE clients.

DNS Resolver & Versa

Within the Versa secure access service, administrators configure DNS resolver objects under Services > Secure Access > Portal > DNS Resolvers, then attach them to a gateway or a shared gateway profile so gateways with identical DNS needs don’t each need their own copy.

Split DNS, enabled by default from Release 22.1.3, works alongside them: requests for domains covered by configured resolvers go over the SASE tunnel, while the rest of the client’s DNS traffic resolves locally. When a user registers their Versa SASE client, the portal packages the assigned routes, gateways, and resolver objects into one XML configuration file and pushes it to the device – the same flow used across the Secure SD-WAN and NGFW variants of the service.

Frequently asked questions

What is the difference between a DNS resolver and a DNS server?

A DNS server (or name server) hosts and answers DNS records for a domain. A DNS resolver is the client-facing role that issues the query – either a stub resolver that forwards it, or a recursive resolver that walks the DNS hierarchy to produce a final answer.

What is split DNS?

Split DNS routes lookups differently depending on the domain queried. In Versa SASE, it sends queries for the domains covered by configured resolvers through the SASE tunnel to their assigned resolver, while every other query resolves over the user’s local internet connection instead.

Why would an organization run its own DNS resolver instead of a public one?

A private resolver can answer queries for internal-only domains that public resolvers never see, apply organization-specific filtering policy, and keep sensitive lookups on an encrypted path – capabilities widely used public recursive resolvers, run for the open internet, do not provide.

How does a Versa SASE client learn which DNS resolver to use?

At registration, the secure access portal sends the client an XML configuration file containing the routes, gateway details, and any DNS resolver objects tied to the assigned gateway or gateway profile, so the settings are applied automatically with no manual setup on the device.

Can one gateway use more than one DNS resolver?

Yes. Administrators can configure several DNS resolver objects, each pairing one domain with one name server, and associate all of them with a single gateway or a shared gateway profile so that multiple gateways reuse the same set of resolvers.

More on DNS Resolver

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DNS resolvers, these are worth looking at next.