What is Geo DNS?
Also known as: GeoDNS, Geographic DNS
Geo DNS is an authoritative DNS configuration that returns different resource records based on the geographic location of the requesting client, enabling traffic routing to nearby servers.
Geo DNS (Geographic DNS) is a configuration feature of authoritative DNS nameservers. Instead of returning a single static answer for a given query, the server evaluates the source IP address of the requesting resolver and selects a tailored response from a set of predefined records. The mapping from IP addresses to geographic regions relies on geolocation databases maintained by third parties or the DNS operator. These databases approximate the physical location of the querier's recursive resolver (or sometimes the end client via EDNS Client Subnet) at country, continent, or subnational region granularity.
When a stub resolver sends a DNS query for a name like "www.example.com", the recursive resolver forwards the query to the authoritative server. The Geo DNS-aware authoritative server extracts the resolver's IP address, looks up its likely region, and returns an A or AAAA record pointing to a server in that region. This mechanism is commonly implemented through DNS view functionality in BIND (split DNS), PowerDNS geoip backends, or commercial CDN platforms like Amazon Route 53 latency-based routing, Cloudflare, and Akamai. CDNs extend the concept to latency-based routing, which uses measurements rather than static geography.
Geo DNS operates at the application layer of the DNS hierarchy. It is transparent to end users and does not modify the DNS protocol itself; it merely changes the response logic inside the authoritative server. Because it relies on resolver-location inference, it works best when queries pass through geographically-close recursive resolvers. Users behind a VPN or a large centralized resolver may receive suboptimal mappings. Despite this limitation, Geo DNS remains a fundamental building block for global load balancing, content localization, and regulatory compliance.
Key facts
- Authoritative DNS uses client IP geolocation to select the response record.
- Relies on IP-to-location databases for region mapping, not the DNS protocol.
- EDNS Client Subnet (RFC 7871) can improve accuracy by passing the end-user subnet to authoritative servers.
- Often combined with CDN edge servers to reduce latency and balance load across regions.
- Standard BIND views or commercial geo-aware DNS services implement this capability.
How it works in practice
Related terms
References
More in DNS
A Record
A DNS resource record that maps a hostname to a 32-bit IPv4 address. It is the most fundamental record type for translating domain names to numeric addresses on the Internet.
AAAA Record
A DNS resource record that maps a hostname to a 128-bit IPv6 address, analogous to the A record for IPv4.
Authoritative DNS
An authoritative DNS server holds the definitive resource records for a specific domain and responds to queries with the final answer for that zone, not a cached copy.
CAA Record
A CAA (Certification Authority Authorization) DNS record lets domain owners specify which certificate authorities are permitted to issue SSL/TLS certificates for their domain.
CNAME Record
A DNS record that maps an alias hostname to the true or canonical hostname, allowing multiple names to resolve to the same IP address without duplicating A or AAAA records.
DNS
The Domain Name System (DNS) is a hierarchical, distributed naming system that translates human-readable domain names (like example.com) into IP addresses and other resource records used by internet protocols.
DNS Anycast
DNS Anycast uses one IP address served from multiple geographically distributed nameservers; queries are routed to the nearest or healthiest node, improving resilience and reducing latency.
DNS Caching
DNS caching stores resolved domain name query results for the specified TTL duration to avoid repeated queries to upstream authoritative servers.
DNS Hijacking
DNS hijacking is an attack or misconfiguration that returns forged DNS responses, causing users to connect to attacker-controlled hosts instead of the intended server.
DNSSEC
DNSSEC (DNS Security Extensions) add cryptographic digital signatures to DNS records, enabling resolvers to verify that responses have not been tampered with or spoofed.