I realized I don't understand a pretty basic thing about DNS. So, here's the flow
Assuming nothing is cached, When I open stackoverflow.com, the request goes to the root, then to the .com TLD registry, which in turn returns the name server (NS record) for the stackoverflow domain, i.e. cf-dns01.stackoverflow.com. Q1: Does the TLD only return only the NS records for the domain?
After that, the request goes to cf-dns01.stackoverflow.com., which has and returns the A record(s) (=IP(s)) of stackoverflow.com.
Q2: where is the IP address of cf-dns01.stackoverflow.com configured, i.e. how is the authoritative name server's IP resolved? Especially in this case, when the name server is a subdomain of the domain it has to resolve.