A DNS server often have a set of root hints. IE the list about a dozen servers that hold the root .
zone. So if it needs to resolve a DNS name without forwarding it will start at the root and query things until it finds the answer. Perhaps by asking the root servers for the names servers for .org
, and the .org
server for the servers that handle .example.org
, and finally the .example.org
servers what the results are for www.example.org
.
When you have forwarding only enabled, this process is completely disabled, and all DNS requests will be forwarded on to some other server. So if you were forwarding to 8.8.8.8
that would be it. You send the request off to 8.8.8.8
and if you get a valid reply you return that, or you fail.
When you have forwarding enabled, but you have not set forwarding only, your DNS server will try to forward a request to another server and if there is a failure or a timeout then the request will fall back to resolving using the standard method starting at the root hints.
Keep in mind that a NXDOMAIN reply is not a failure. A failures is a SERVFAIL, a timeout, or something like that.