When does a DNS server respond with a referral instead of an IP address?

When the server isn't authoritative for the requested name but knows a server closer to the answer, it hands back a referral — "ask them" — instead of an IP.

No single DNS server knows every domain on earth; knowledge is spread across the hierarchy. So a name server has exactly three possible replies to a lookup:

1. An IP address — it knows the answer (it is authoritative for the name, or has it cached).
2. A referral — it is not responsible for this name, but points you at the next, more specific server.
3. NXDOMAIN — the domain does not exist.

Resolving www.hslu.ch from scratch walks down the tree via referrals:

Client -> Root server:   "www.hslu.ch?"
Root   -> Client:        "ask the .ch server"      (referral)

Client -> .ch server:    "www.hslu.ch?"
.ch    -> Client:        "ask the hslu.ch server"  (referral)

Client -> hslu.ch server:"www.hslu.ch?"
hslu.ch-> Client:        "152.96.36.52"            (the answer)

Why this design? Distributing knowledge this way is what lets DNS scale to billions of names and stay resilient — no central server has to (or could) hold them all, and each organization runs the part it owns.